Cybersecurity subsidies 2026: eligible software, caps, and tax points to watch
Ransomware and targeted email attacks are not just a big-company problem — small and mid-sized businesses, which tend to have thinner defenses, are in fact the ones being targeted. That said, installing EDR (software that detects suspicious behavior) or a UTM (a device that bundles several defense functions) costs a substantial amount. This is where national and local cybersecurity subsidies and grants come in. This article organizes the main programs that small and mid-sized businesses can use in 2026 — eligible software, caps, and the application flow — and, from the distinctive viewpoint of a tax-focused publication, goes as far as "the tax on a subsidy after you receive it," based on primary sources.
・The national "Digitalization / AI Adoption Subsidy (formerly the IT Adoption Subsidy), Security Measures Promotion Frame" subsidizes up to two years of usage fees for a registered service, at ¥50,000 to ¥1.5 million
・Tokyo's Cybersecurity Measures Promotion Grant subsidizes the cost of adopting a UTM, EDR, and the like up to a cap of ¥5 million (many local governments have their own programs)
・Easily overlooked, but a subsidy you receive is, in principle, "taxable income." Check compressed-entry accounting, consumption tax, and pay-first-then-reimbursed timing as well
Why are there subsidies for security measures in the first place?
The reason the government supports security measures at small and mid-sized businesses is that damage spreads through the supply chain (the network of business partners). Weak defenses at a single company ripple all the way out to that company's large-enterprise or public-sector partners. So the government has set up a scheme that certifies private security services against a fixed set of standards to make them easier for small and mid-sized businesses to adopt, and it supports their use with subsidies. Getting a handle on this framework of certified services first makes the overall picture of the programs easier to see.
This is a security-service program for small and mid-sized businesses, certified by the IPA (Information-technology Promotion Agency). Its defining feature is that it bundles "watching over (monitoring)," "rushing in (emergency response)," and "simple cyber insurance" into a single package offered at a relatively low price, and certified services carry the "Otasuketai mark"[IPA Otasuketai Service Program (in Japanese)]. The national subsidy described later covers services listed on this certification list.
The two main subsidies: national and Tokyo (2026)
(1) Digitalization / AI Adoption Subsidy
- Eligible
- Services listed on the "Cybersecurity Otasuketai Service List" and registered by an IT adoption support provider
- Subsidy rate
- Small enterprises: up to 2/3 / Small and mid-sized businesses: up to 1/2
- Subsidy amount
- ¥50,000 to ¥1.5 million (up to two years of service usage fees)
- Key point
- Formerly the "IT Adoption Subsidy." The name changed from 2026. There are multiple application deadlines
(2) Cybersecurity Measures Promotion Grant
- Eligible
- Small and mid-sized businesses etc. in Tokyo that have declared the two stars (★★) of SECURITY ACTION
- Grant rate
- Up to 1/2
- Grant amount
- Floor of ¥100,000 to a cap of ¥5 million
- Key point
- Covers the "purchase cost of devices and software" such as a UTM or EDR. Split into three application rounds a year
(1) is a monthly service-usage-fee type, while (2) is a device/software adoption-cost type — the subsidy targets differ. (1) can be used by a small or mid-sized business anywhere in the country, whereas (2) is a Tokyo program. Because you generally cannot stack multiple subsidies on the same expense, choose the one that fits your own approach (whether you want to keep using a service on an ongoing basis, or buy devices outright). For how to find subsidies in general, see the Subsidies and grants guide; for award records, you can look them up by company name in the Subsidy award database.
A subsidy's cap, subsidy rate, eligible expenses, and application period change by fiscal year and by application round. This article is an overview based on each official source as of 2026. Before applying, always check the latest application guidelines on each program's official site. Beyond Tokyo, prefectures and municipalities may set up their own security-measure subsidies.
What software and services are eligible?
It is not "any security software qualifies" — eligibility is set for each program. The main categories are as follows.
| Type | Example of role | Programs it mainly qualifies for |
|---|---|---|
| Otasuketai service (integrated type) | Bundles monitoring, consultation, emergency response, and simple insurance | National Security Measures Promotion Frame |
| EDR / EPP (endpoint measures) | Detects and blocks suspicious behavior on a device | Tokyo grant, and others |
| UTM / next-generation firewall | Defends the entry point of the internal network in one place | Tokyo grant, and others |
| Antivirus / email and spam measures | Blocks malware and suspicious email | Tokyo grant, and others |
| Encryption / access management / backup | Prepares for information leaks and post-incident recovery | Tokyo grant, and others |
Note that AI-based monitoring and detection tools and the like may suit a different frame rather than only the security frame. If the use cases overlap, consider the Subsidies usable for AI adoption as well.
[Tax point] A subsidy is, in principle, "taxable income"
This is what we most want to convey as a tax-focused publication. A subsidy or grant you receive is, in principle, subject to tax (gross profit for a corporation; business-income revenue for a sole proprietor)[National Tax Agency No.5765 (in Japanese)]. It is not "pure gain because it was subsidized" — you need to note that profit rises in the year you receive it, and tax applies.
You receive a ¥500,000 subsidy against ¥1 million of equipment. The ¥500,000 subsidy enters gross profit, so it is taxed together with your other profit (in simplified terms, the tax burden rises by about ¥150,000). Meanwhile, the equipment is recorded as an asset and expensed through depreciation. Picturing your actual out-of-pocket cost as "¥500,000 plus the tax on the subsidy" will keep you from getting your funding plan wrong.
What eases this burden of "being taxed all at once in the year you receive it" is compressed-entry accounting. When you acquire a fixed asset (such as equipment) with a subsidy, a blue-return filer can use compressed-entry accounting to defer that year's tax to the following year and beyond[National Tax Agency No.5765 (in Japanese)]. Because the accounting gets complicated, corporations should consult their retained tax accountant. The overall picture of accounting and filing is explained in the Guide to corporate tax filing.
When the target is a monthly service usage fee, as with the national Security Measures Promotion Frame, it is in principle that year's expense (a deductible expense / a necessary expense). In this case "subsidy = revenue" and "usage fee = expense" roughly fall in the same year, so a deferral issue like compressed-entry accounting is less likely to arise. If you buy software or a tool outright and record it as an asset, also check whether you can expense it in one go under the special provision for small-sum depreciable assets.
Another pitfall: consumption tax and "pay first"
(1) Consumption tax: A subsidy itself is outside the scope of consumption tax (non-taxable revenue). However, many national subsidies may require you to later return (report) the portion of the consumption tax included in the eligible expenses that you can claim as an input tax credit. This is a mechanism to prevent a double benefit, and taxable businesses in particular need to check it
(2) Pay first (reimbursement basis): A subsidy is, in principle, granted after you have carried out the measures and completed payment. You need to front the full amount with your own funds first, so a plan for cash on hand is essential
(3) Orders placed "before" the grant decision are ineligible: Under many programs, expenses you contracted, ordered, or paid for before the grant decision are not eligible. "I went ahead and signed the contract first" is a classic failure
The common application steps
| Step | Content |
|---|---|
| 1. Declare SECURITY ACTION | The IPA's self-declaration program. It is a prerequisite for applying under many programs (Tokyo requires the two stars) |
| 2. Obtain a gBizID Prime | The account needed for the electronic application to national subsidies. It takes days to obtain, so do it early |
| 3. Choose the eligible service/product and the support provider | For the national one, choose from registered services. Obtain a quote |
| 4. Apply for a grant → wait for the grant decision | Ordering or paying "before" the decision is ineligible. Contract and adopt after the decision |
| 5. Report results → receive the subsidy | Prove payment and adoption. Received on a pay-later basis in principle. Keep your supporting documents |
SECURITY ACTION is a free program in which you self-declare that you are working on security measures, and it is the entry point for a subsidy application[SECURITY ACTION (in Japanese)]. Starting here first makes the subsequent application smoother.
Summary
FAQ
Does any security software qualify for a subsidy?
No. Eligibility is set for each program. The national Security Measures Promotion Frame covers monthly services that are listed on and registered under the "Cybersecurity Otasuketai Service List." The Tokyo grant covers the adoption cost of devices and software such as a UTM or EDR. Always check before applying whether the product you want to adopt is included among the eligible ones.
Is a cybersecurity subsidy I receive taxed?
In principle it is subject to tax. It is included in the year's profit and taxed as gross profit for a corporation, or as business-income revenue for a sole proprietor. If you acquire a fixed asset (such as equipment) with the subsidy, a blue-return filer can use compressed-entry accounting to defer the tax to the following year and beyond. Because the accounting gets complicated, corporations are advised to consult a tax accountant.
When do I receive the subsidy? Do I need the money up front?
A subsidy is granted on a pay-later basis (reimbursement basis) in principle. Because it is granted after you have carried out the measures, paid the costs, and gone through the results report, you need to front the full amount with your own funds first. Have a plan for cash on hand. Also, expenses you contracted, ordered, or paid for before the grant decision are generally ineligible.
Are there programs that companies outside Tokyo can use too?
Yes. The national "Digitalization / AI Adoption Subsidy (formerly the IT Adoption Subsidy), Security Measures Promotion Frame" is open to small and mid-sized businesses nationwide. In addition, prefectures and municipalities may set up their own security-measure subsidies. Check the latest calls for applications on your local government's business-support page or on a subsidy search site.
What should I start with when applying?
It goes smoothly to start with the IPA's "SECURITY ACTION" self-declaration (free), which is a prerequisite for many programs. For national subsidies, obtaining the gBizID Prime for electronic applications also takes days, so prepare early. On that basis, choose the eligible service/product and the support provider, obtain a quote, and proceed to the grant application.
Reference links (sources)
This article is based on the following official materials (neutral, primary sources).
- Digitalization / AI Adoption Subsidy 2026, Security Measures Promotion Frame (Organization for Small & Medium Enterprises and Regional Innovation) (in Japanese)
- Tokyo Metropolitan Small and Medium Enterprise Support Center — Cybersecurity Measures Promotion Grant (in Japanese)
- IPA — Cybersecurity Otasuketai Service Program (in Japanese)
- SECURITY ACTION (IPA) (in Japanese)
- National Tax Agency — Tax Answer No.5765 Compressed-entry accounting for national subsidies etc. (in Japanese)
* This article is general information, not tax advice. A subsidy's cap, subsidy rate, eligible expenses, and application period change by fiscal year and application round. For whether you can apply and for accounting and tax judgments, please confirm with each program's administration office, a tax office, a tax accountant, or another professional.