What Is the Cyber Threat Forecast? The Four Levels and How to Read Them

Just as a weather forecast tells you "rain is likely today," the Cyber Threat Forecast tells you "the risk of cyber attacks is higher right now." This guide explains how to read it, without technical terms.

What this page tells you

It shows the current level of cyber-attack risk — four levels, shown separately for Japan and for the world. It is free, and no sign-up is needed. You do not need to change how you use your computer or phone; the page is there to help you decide "today, I will be a little more careful."

Where the information comes from

The levels are based on information published by public organisations such as JPCERT/CC and IPA in Japan and CISA in the United States. The data is collected automatically every 3 hours, and the level is decided by fixed rules. A level never changes because of someone's impression, and never for promotion.

The four levels

• Normal (green) — No unusual activity is being seen. You can go about things as usual. It does not mean "completely safe."
• Attention (blue) — Activity is a little higher than usual. It is a good moment to check that no app or device updates are waiting.
• Warning (yellow) — Attacks that are actually being exploited have been confirmed on everyday devices or services. Please complete the actions shown on the page within the week.
• Emergency (red) — A serious situation affecting a wide range is under way, and public agencies are issuing urgent calls as well. Please act the same day.

If the information cannot be confirmed, the page shows "Unknown" instead of forcing a level. It does not present guesswork as fact.

How to read the page

• Japan and the world have separate levels. The world may be at Warning while Japan is at Normal. The Japan level is the one that directly concerns devices at home and at work.
• The "Checked" time is when the information was last confirmed. It is shown so that old information is never dressed up as new.
• Below each level you will find the basis and the actions. The basis explains why the level is what it is, and the actions say concretely what to do now.

Use it like a weather forecast

Checking it in the morning, the way you check the weather, is enough. On days when the level rises, change your behaviour just a little — the way you would carry an umbrella.

Three basics that work at any level

1. Do not let updates pile up — Updates for your computer, phone and apps close the doors that attacks use.
2. Do not reuse passwords — If one service leaks, the same password can open your other accounts.
3. Keep backups — If something does happen, you will not lose your photos or work data.

For details, see the first guide: "Stop Reusing Passwords — The First Step."

→ See the Cyber Threat Forecast

Check your understanding

Tap an answer to check yourself. Nothing is saved or sent.

Q1. What are the Cyber Threat Forecast levels based on?

Information from public organisations, judged by fixed rulesThe operator's impression on the dayWhichever threat is most in the news

See the answer

Public information from JPCERT/CC, IPA, CISA and others is collected automatically every 3 hours and judged by fixed rules — never by impression or promotion.

Q2. When the Japan and world levels differ, which one directly concerns devices at home and at work?

The world levelThe Japan levelAn average of the two

See the answer

Japan and the world have separate levels. The Japan level is the one that directly concerns your devices.

Q3. What does "Normal (green)" mean?

Completely safeNo information could be collectedNo unusual activity is being seen

See the answer

Normal means no unusual activity is being seen — not "completely safe." When information cannot be confirmed, the page shows "Unknown."

Read next

See the latest threat intelligence

Start Here — security in 3 steps

← Back to the guide list