SoftBank’s “Patching as a Service” targets 3,000 government-designated companies
In sum – what we know:
- A national-scale rollout – SoftBank is offering its OpenAI-based “Patching as a Service” to roughly 3,000 Japanese companies the government has certified as critical infrastructure operators.
- Agentic, not automatic – Semi-autonomous agents continuously scan, prioritize, and propose remediation plans, but the service doesn’t push patches into production — human teams still execute.
- The OpenAI conduit – Delivered through SB OAI Japan, the 50:50 joint venture, the service cements SoftBank as the primary channel for OpenAI tech in Japanese enterprise.
SoftBank Group and its telecom arm SoftBank Corp. are rolling out “Patching as a Service,” an AI-powered cybersecurity offering built on OpenAI models, to roughly 3,000 Japanese enterprises the government has designated as critical infrastructure. The service is delivered through SB OAI Japan GK, the 50:50 joint venture SoftBank Corp. and OpenAI formed in late 2025 to commercialize AI services for the Japanese market. It’s one of the more ambitious AI-driven cybersecurity deployments anywhere, and certainly the largest of its kind in Japan.
SoftBank CEO Masayoshi Son isn’t framing this as a product launch so much as a national obligation. At the Tokyo announcement, he described the work as a duty to “plug the holes” in Japan’s critical infrastructure — and stressed that defending once isn’t enough against attackers who are themselves increasingly armed with AI. It’s the kind of rhetoric Son reaches for often, but the underlying concern is real. AI-accelerated attacks compress the window between a vulnerability being disclosed and being exploited, and large infrastructure operators are rarely the fastest patchers.
The service didn’t appear out of nowhere. SoftBank ran internal pilots on its own infrastructure in early 2026, testing vulnerability scanning, risk prioritization, and remediation planning before taking the offering public.
How the patching service actually operates
At its core, the service uses OpenAI models tuned for cybersecurity to run continuous or scheduled vulnerability assessments across an enterprise’s systems — scanning software, configurations, and network exposure for gaps, including exploit paths that AI-driven attackers might chain together. The “agentic” part is what separates it from a conventional scanner. Rather than producing a one-off report, semi-autonomous agents run as ongoing processes that monitor, analyze, re-evaluate, and simulate attack paths over time.
From there, the system triages what it finds. Vulnerabilities get prioritized based on impact, exploitability, and business context, and the agents propose remediation plans — all under human oversight. The agents can also kick off workflows on their own, opening tickets, recommending patch schedules, and flagging urgent issues. That autonomous workflow initiation, driven by OpenAI’s reasoning models, is the main differentiator SoftBank claims over traditional vulnerability management tools.
The name deserves some scrutiny, though. Despite what “Patching as a Service” implies, the system does not automatically deploy patches into production at scale. It’s a decision-support tool that generates implementation advisory recommendations — diagnosis and planning, with human security teams doing the actual patching. Some coverage has described the service as providing automated vulnerability patching and threat response, which overstates what’s happening. For critical infrastructure operators, the more conservative reality is probably the right call. Nobody wants an AI agent pushing untested patches to a power grid. But customers should be clear-eyed that they remain responsible for execution.
Target enterprises
The target cohort is the roughly 3,000 companies the Japanese government has certified as critical infrastructure operators — energy, transport, telecom, finance, water, healthcare, and the like. To get things moving, SoftBank offered free cybersecurity posture diagnostics to enterprises attending the launch event, a fairly transparent entry point into deeper engagements.
Scaling to that cohort is the harder part. SoftBank Corp. CEO Junichi Miyakawa says the implementation team will grow from an initial 50 specialists to roughly 1,000 as adoption ramps, which gives a sense of how hands-on the local rollout and advisory work is expected to be. Son has said he wants all 3,000 companies protected as soon as possible. That’s an aggressive timeline, and given the onboarding complexity involved, the 3,000 figure is best read as a target universe rather than guaranteed full adoption. Some regional reporting has already framed the service as covering all 3,000 enterprises — treat that as marketing shorthand.
Business model
Strategically, this is SoftBank cementing itself as the primary conduit for OpenAI technology in the Japanese corporate ecosystem. SB OAI Japan handles the localization work that OpenAI can’t do alone — language, regulatory compliance, and alignment with domestic IT architectures that often run on legacy systems with slow, cautious patch cycles. It’s also a flagship case of agentic AI being commercialized at all, following the pattern of internal OpenAI capabilities like its “Aardvark” security work spinning out into actual business lines.
Pricing remains undisclosed, and it will almost certainly vary by client size and sector. The free diagnostics offered at launch look like a classic funnel — assess a company’s posture for nothing, then convert the findings into paid remediation planning and advisory services. Whether 3,000 of Japan’s most critical companies buy in by year-end is another question. But as a signal of where SoftBank intends to take its OpenAI partnership, the direction is hard to miss.
Table of Contents
