Internet Initiative Japan and the Value of Being the Serious Internet Layer

Summary

• What it says: The real question is not whether IIJ is large. The useful way to consider Internet Initiative Japan is not as an undersized national operator, nor really as a traditional ISP.
• Main topic: Institutional legitimacy
• Context: Infrastructure / Company research / Japan

The real question is not whether IIJ is large. The useful way to consider Internet Initiative Japan is not as an undersized national carrier, nor really as a traditional ISP. It is better understood as a company that monetizes institutional trust in the Japanese Internet stack. This trust was built first in connectivity, then extended to operations, then to cloud, then to security, then to managed mobile, and finally to a broader systems integration model that allows the company to sell “Internet expertise” in increasingly expensive forms.

At the end of the fiscal year ended March 31, 2026, IIJ generated revenue of 345.4 billion yen and operating income of 34.8 billion yen, with management explicitly describing the accumulation of recurring revenue, large multi-year contracts, and service integration as the engine for the next phase of margin expansion. The company’s own presentation is unusually revealing: it highlights monthly recurring revenue, the fixed costs of backbone operations, and the difficulty for new entrants to replicate the combination of engineers, capital expenditures, and operational track record required to run a genuine network business.

This presentation is important because the user’s anchor entity, AS4688, is not where the obvious scale lies. Public routing evidence shows that AS2497 is the main living backbone identity of IIJ, while AS4688 resembles a historical and institutional residue: still attached to Internet Initiative Japan in PeeringDB, still visible in routing registries and IX records, still labeled “HI-HO” by Cloudflare Radar and BGP tools, but showing zero originated prefixes in multiple public datasets and no public peering ports listed in PeeringDB.

In other words, AS4688 is economically interesting not because it clearly carries IIJ’s traffic core today, but because it exposes how IIJ’s value is layered: the company has accumulated network identities, relationships, brands, and operational surfaces over decades, and some of those surfaces continue to have significance long after their original retail story has faded.

The thesis of this essay is that IIJ’s sustainable margin in Japan comes from being the “serious Internet layer” for enterprises and public institutions. That means four things at once. First, it operates one of Japan’s largest backbones and can credibly sell reliability, low operational drama, and network engineering depth to buyers who care more about failure costs than the lowest monthly price. Second, it converts that credibility into adjacent managed services — security, cloud interconnection, outsourced operations, SASE, DNS, messaging security, mobile gateways — where trust compounds.

Third, it uses MVNO economics not just to chase consumer SIM volume, but to create flexible mobile infrastructure for enterprise IoT, cable operator MVNE partners, and specialized network use cases. Fourth, it turns systems integration from a low-multiple project business into a feeder system for recurring revenue by bundling build, operation, connectivity, cloud, and security into long-term contracts. This combination explains why IIJ can be smaller than NTT, KDDI, or SoftBank in raw telecom heft and still earn structurally respectable margins.

The skeptical version of the same argument is also true. IIJ’s moat is real, but not mystical.

It depends on its ability to maintain enterprise trust after incidents like the 2025 Secure MX breach; on its continued access to carrier inputs provided by companies that are also owners and competitors; on its ability to pass through supplier cost shocks such as the VMware repricing disclosed by management; and on the proposition that Japanese enterprises still want a neutral, highly skilled operator to assemble networks, cloud, and security at a time when hyperscalers, SASE vendors, and major carriers are all trying to sell their own integrated stacks. The serious Internet layer is valuable. It is also expensive to defend.

Who IIJ really is: IIJ asserts, rightly, that it was the first large-scale commercial Internet service provider in Japan, founded in December 1992. This origin story isn’t just branding; it explains why the company continues to see itself less as a telecommunications utility and more as a technical institution: a place where the backbone network, engineers, and operational culture are the core asset, and the product portfolio is built on that foundation.

In its integrated report, IIJ explicitly states that its backbone is one of the largest in Japan, extends to the U.S., Europe, and Asia, has been continuously expanded with traffic growth, and has sustained long-term relationships mostly with large enterprises and government agencies. The same documents note that about 70% of employees are engineers and that the group’s customer base is around 16,000 enterprises, mostly large companies and public bodies.

This customer mix is the first hint at margin quality. IIJ is not economically organized as a consumer broadband provider that lives or dies by household churn and advertising spend. Its own service provider materials boast 99.9999% availability, guaranteed connectivity, DDoS mitigation, and expert operations. Investor-facing documents describe long-standing recurring revenue relationships with large enterprises, minimal customer churn over 30 years, and a proposition-based sales force built around large-company IT needs.

This is a very Japanese kind of defensibility: less a winner-takes-all consumer franchise and more a trusted-provider status within hard-to-displace institutional accounts.

The financial composition confirms the point. In FY2025, total network services revenue reached 178.7 billion yen, while systems integration added 163.7 billion yen and vending machine operations remained negligible. Within network services, enterprise internet connectivity generated 53.9 billion yen, enterprise mobile 18.2 billion yen, MVNE platform 12.0 billion yen, consumer internet connectivity 28.7 billion yen, outsourcing 67.6 billion yen, and WAN services 28.6 billion yen. The word that matters in this is outsourcing.

The highest expression of IIJ’s franchise is not a simple transit line; it’s an ongoing operational relationship around someone else’s infrastructure and workflows. That is where the company’s “serious Internet layer” turns into margin.

This is also why IIJ’s cloud and security businesses should be seen as close relatives of its backbone, not as separate adventures. The company moved from connectivity into security services, network operations and monitoring, cloud computing, system construction, and managed operations because these are the natural adjacencies once a customer trusts you for core network behavior.

Its business documents show an unusually coherent set of overlaps: cloud exchange for AWS, managed firewalls, DDoS protection, remote access, private mobile gateways, DNS platforms, cloud messaging security, SaaS web gateway security, SOC services, private backbone services, and closed-network connections to third-party security providers like Prisma Access. In economic terms, IIJ keeps trying to answer the same customer question: “If my business depends on the Internet, can you make the ugly parts go away?”

There is a second, more subtle truth in the company’s story. IIJ is not simply a service seller; it is an institutional entity in Japan’s Internet plumbing. Its securities report notes that it connects high-capacity lines from multiple points in Tokyo and Osaka to JPNAP, which is operated by INTERNET MULTIFEED, an equity-method affiliate, and that it has been part of the WIDE project’s dix-ie exchange since the project’s inception. INTERNET MULTIFEED itself is described by IIJ as a joint venture with the NTT group that operates interconnection points and provides IPv6 connectivity for telecom operators.

This is not the profile of an ordinary reseller. It’s the profile of a company embedded in the governance and interconnection layers of the national Internet ecosystem.

This embeddedness helps explain why IIJ still looks strategically important even relative to much larger companies. Against national carriers, it lacks retail reach and spectrum ownership, but it is faster, more engineering-focused, and more neutral in how it integrates third-party technologies. Against conventional systems integrators, it has something they typically lack: a living backbone network, significant peering and IX presence, and operational experience with traffic, attack surfaces, and protocol behavior at carrier scale. IIJ’s own presentations make this comparison explicitly.

The business significance is simple: it occupies a valuable space between the bureaucratic mass of incumbent carriers and the application-rich but network-light systems integration firms. In a mature market, this middle position can be more profitable than it looks.

What AS4688 proves and what it does not AS4688 matters because it reminds that IIJ’s network value is not captured by a single flagship ASN. The public data presents a layered and slightly messy picture. PeeringDB lists a network called “Internet Initiative Japan AS4688,” linked to Internet Initiative Japan Inc., with the company’s website override set to IIJ’s English site, operational status noted as active, an open peering policy, but with zero IPv4 prefixes, zero IPv6 prefixes, no public peering exchange points currently listed, and no interconnection facilities listed.

Cloudflare Radar identifies AS4688 as “HI-HO,” with the AKA “Internet Initiative Japan AS4688,” in Japan, and shows it under the same organizational umbrella as AS2497, AS61215, and AS59258. BGP tools, meanwhile, display the aut-num name as “HI-HO-AS,” describe it as “hi-ho Inc.,” note it is maintained by MAINT-AS2497, and show legacy-looking IX IP addresses at DIX-IE, NSPIXP3 Osaka, and NSPIXP6 Tokyo.

The first economic conclusion is negative rather than positive: public routing evidence does not prove that AS4688 is a major living production backbone in the way that AS2497 clearly is. PeeringDB’s zero-prefix entry and Cloudflare’s routing page argue strongly against that interpretation, and AS2497 is the network that public peering data associates with very large announced prefix counts, global scope, and the broader IIJ backbone identity.

IIJ’s own as-set, AS-IIJ, includes AS4688 among many other ASes routed by IIJ members, but this tells us only that the autonomous system is institutionally part of IIJ’s routing orbit, not that it carries flagship flows today.

The second conclusion is more interesting: AS4688 appears to be an administrative and historical residue from IIJ’s long involvement in the hi-ho access business. The current hi-ho company history states that the Panasonic “Panasonic hi-ho” Internet service brand started in 1995; that hi-ho Inc. was established in 2007 and wholly acquired by IIJ from Panasonic Network Services the same year; and, importantly, that IIJ sold all hi-ho shares to ISP Holdings in December 2017.

Yet AS4688 still appears in public network resource registries as organizationally linked to IIJ, and BGP registry metadata still references hi-ho, with maintenance by IIJ-linked entities. This mismatch is commercially significant. It suggests that IIJ’s historic control over consumer and wholesale network layers survived the equity ownership of the original retail brand, and that some network resource legacies were not fully “cleaned separated” in the public Internet registry even after the share sale.

Several interpretations are possible, and public registries do not let us choose confidently among them. AS4688 could be effectively dormant but retained for contingency, registry continuity, IX membership, historical reachability, or non-public operational uses. It could represent legacy surfaces still meaningful for former customers or partners. It could be a placeholder identity with more administrative value than traffic.

The fact that PeeringDB shows “Never via route servers” and an open peering policy, while listing no current exchange ports, strengthens the idea that it is a historical entity with institutional life but no obvious current scale role. This is exactly the kind of detail investors often ignore — but it matters when a company’s business advantage depends on accumulated operational rights and relationships rather than a single flagship asset.

To see why, compare AS4688 to AS2497. PeeringDB’s AS2497 record shows IIJ’s main network as a global NSP with very large public prefix counts and participation in a larger active peering footprint. Cloudflare Radar shows real traffic views for AS2497. The same organization owns both. In business terms, this means IIJ’s visible network domain has a core identity and a sedimentary layer. AS2497 is the core. AS4688 is the sediment: evidence of earlier lines of business, earlier interconnection surfaces, and a long-term institutional presence.

The economic value of the sediment is not throughput; it is optionality, continuity, and proof that the company has been embedded in the country’s Internet architecture long enough to accumulate residues that competitors lack.

This also avoids a category error. The business model of “Internet Initiative Japan AS4688” is not, in 2026, separable from the wider IIJ group. The public record does not support the argument that AS4688 alone is a standalone money machine. What it does support is a narrower point: AS4688 is a clue to how IIJ turned early consumer ISP and interconnection experience into something broader and more durable. The company did not become valuable because an old ASN was special; it became valuable because it kept building adjacent revenue streams around network competence while preserving the credibility that made those adjacencies credible.

It’s better to read AS4688 as archaeological evidence of that transition.

The hi-ho side of the story sharpens the contrast. Today’s hi-ho company presents itself as a provider of FTTH/ISP services and MVNO/mobile offerings, and in 2026 it received administrative guidance after inadequate customer notification about a VDSL service discontinuation that left some apartment residents without working connectivity. The brand also attracts poor public complaints on Japanese comparison sites about support quality and, in some cases, service quality. These anecdotes should not be over-weighted; forum and review evidence is noisy. But the business significance is fairly clear.

The retail ISP layer attached to the historic AS4688 identity is plainly not carrying the premium trust economics that defines IIJ proper. If anything, the public signals around hi-ho reinforce the idea that IIJ’s real moat migrated away from consumer access long ago, toward enterprise-grade operations and adjacency businesses.

Where the margin really comes from IIJ’s business becomes much easier to understand if you start with the cost structure rather than the products. The company says plainly that the main costs of enterprise internet connectivity and outsourcing are network and system operations costs — leased circuits, equipment depreciation, data center fees, and personnel — that are not directly tied to revenue at the unit level. This is the classic fixed-cost backbone model. Once built, staffed, and kept reliable, it becomes more profitable the more recurring revenue is loaded onto it.

IIJ also says this model is hard for new entrants to imitate because it requires highly skilled engineers and sustained capex at meaningful scale. This is not just corporate self-praise; it is the economic heart of the company.

This fixed-cost logic shows up in the margin line. For FY2025, IIJ reported total gross profit of 76.2 billion yen and a total gross margin of 22.1%. Network services gross profit was 48.4 billion yen with a 27.1% margin, while systems integration produced 26.3 billion yen gross profit at a 16.1% margin. This tells you immediately how the company thinks internally: network services are the profit engine, while systems integration is the revenue engine and door-opener. Management language mirrors this.

Large service-integration deals create immediate build revenue, but their real value lies in the monthly recurring network and operations revenue that follows. That is why IIJ keeps emphasizing the accumulation of MRR rather than celebrating quarterly project wins in isolation.

The FY2025 numbers sharpen the point. Network services grew 9.9% year-on-year to 178.7 billion yen. Outsourcing — where many of the security and managed operations services sit — grew 14.3% to 67.6 billion yen. Enterprise mobile grew 17.6% to 18.2 billion yen. Consumer connectivity grew only 6.9% to 28.7 billion yen, and the straightforward MVNE line grew 5.2% to 12.0 billion yen. This profile is exactly what you would expect from a company whose best economics lie in managed, enterprise-grade, more technically entangled services rather than pure consumer access.

It is also what you would expect if management’s “serious Internet layer” thesis is correct: the more operationally critical the service, the better the growth.

The foundation on which all of this rests is the enterprise internet and IP services franchise. IIJ’s enterprise connectivity business reached 53.9 billion yen in FY2025, and the total contracted bandwidth for IP services rose from 13,832.2 Gbps to 16,532.1 Gbps according to the latest filing. This is not dramatic mass-market scale, but it is the kind of volume that matters when sold to businesses that use the service for primary or mission-critical connectivity rather than cheap backup.

The company’s own presentations underscore that its IP service contracts are guaranteed-bandwidth, are used as critical connectivity, and are typically purchased by enterprises rather than households. The economic consequence is lower churn, higher technical stickiness, and better cross-sell into security, cloud, and managed operations.

Then comes outsourcing, where the backbone stops being simply transport and becomes a rent-extraction platform. IIJ’s security business is a good example. In company presentations, IIJ claims that its cloud-based email security holds the leading share in the cloud-based email security market, that its SaaS web gateway security service has retained market share leadership for ten consecutive years, that enterprise email service accounts including OEM exceeded 10 million in July 2024, and that SMX and SWG had 2.9 million and 1.2 million contracted accounts respectively as of September 2024.

The presentation also lists named customers for the web gateway service, including Sumitomo Life, Fuji TV, Mitsubishi Chemical, Meiji Gakuin University, and Morinaga. Whatever one thinks of self-reported market positioning, these are not minor positions. They show that IIJ has converted its network position into a large installed base of security services.

Security is important economically because it is both a premium adjacency and a trust amplifier. A network operator can sell DDoS mitigation and firewall management in a way that feels native. An operator with a long track record of serving enterprises can also sell email security, SASE integration, and SOC services with less buyer anxiety than a pure software entrant might face in heavily regulated or traditional Japanese accounts.

IIJ’s recent launches underscore continuity: Security Doctor in 2025, Prisma Access cloud exchange in late 2025, IFMS Cloud in 2026, AI security consulting via IIJ Global in 2026, and repeated security-partner recognition from Palo Alto, Okta, and Sophos at the subsidiary level. The line of continuity is not innovation theater; it is the methodical widening of a trusted operational envelope.

Cloud is similar, but the economics are a little different. IIJ is not trying to out-hyperscale AWS, Azure, or Google Cloud. Instead it sells secure attachment, governance, migration, and operation. Its AWS cloud exchange service provides secure private connectivity between customer networks and AWS. Multi-cloud support shows up repeatedly in filings as a growth driver for operations and maintenance revenue. A 2024 partnership with IBM Japan positioned IIJ as part of a common distributed-systems platform for regional financial institutions.

In this world, IIJ’s cloud business is not an alternative to hyperscalers; it is the Japanese network and operations layer that makes them usable inside old, regulated, or latency-sensitive institutions. This can be a better business than trying to be an undersized cloud landlord.

The own-data-center strategy deepens this margin logic. IIJ says it operates 16 data centers in Japan, of which two are owned. The Matsue Data Center Park and Shiroi Data Center Campus are not vanity real estate; they are balance-sheet tools. Matsue opened in 2011 as Japan’s first containerized data center with outside-air cooling, while Shiroi is a large-scale data center with 50 MW of receiving capacity; the company says construction of the third building phase started in June 2025. In investor materials, IIJ explicitly says it expects higher efficiency from gradually migrating rented data center space into its own facilities.

This is classic gross-margin management: replace external rent with owned infrastructure once the load is sufficient to justify the capex.

The mobile business is where many outside observers underestimate IIJ. Consumer SIMs matter, but mostly as one strand of a larger utilization story. IIJ’s presentations say profitability should improve by aggregating consumer and enterprise traffic, because their usage peaks differ: consumer traffic peaks during commuting and lunch hours, while enterprise traffic from dongles and IoT devices is more 24/7. This is network-engineering insight turned into a business model. If the same mobile platform can absorb both patterns, utilization rises and unit economics improve.

IIJ also highlights the strategic value of becoming a full MVNO in 2018: it built its own HLR/HSS and eSIM platform, launched eSIM in 2019, has pursued local 5G and multi-profile SIM offerings, and continues to tie mobile into private network and IoT solutions. This is not low-end SIM commoditization; it is a modular mobile platform.

The MVNE business adds another layer. IIJ says most MVNE customers are Japanese cable operators with direct consumer relationships, and a company presentation in late 2024 said IIJ had 192 MVNE customers as of March 2024, of which 94 were cable operators. This structure is economically clever. IIJ avoids the full burden of owning consumer distribution while monetizing the underlying mobile platform. The cable operators bring local billing relationships and home bundling; IIJ brings the boring but difficult part: the network, provisioning, and compliance-heavy operation. In cable terms, it sells picks and shovels.

The same goes in the consumer market, where IIJ’s direct brand matters less than one might think. IIJmio is important, and it keeps growing: consumer internet connectivity subscriptions reached 1.72 million in March 2026, of which IIJmio mobile services accounted for 1.43 million. But the company’s descriptions of its consumer channels — direct web sales, partner retail via BIC Camera and Japan Airlines, plus MVNE supply to others — make clear that IIJ treats the consumer line as a component of a mobile platform rather than the center of group valuation.

Independent market research reinforces the interpretation: MM Research Institute reported that IIJ held the largest share of the Japanese single-service SIM card market in March 2024, with strong enterprise IoT SIM demand helping it increase share. That IoT was the explanation for growth is telling: even where IIJ leads “consumer” MVNO statistics, the higher-quality economics often come from enterprise-type lines.

This is why the apparent dormancy of AS4688 is not a problem for the thesis. The serious economic machine is not a single access-network identity; it is a stack: backbone credibility, reliability resale value to enterprises, adjacent managed services, owned infrastructure where it helps, mobile platform leverage, and service integration that converts one-off projects into recurring operational relationships. If you insist on finding the value in a specific old ASN, you miss the wider point. IIJ makes money by turning the seriousness of the Internet layer into a rent; AS4688 is just a shard of the pottery.

Dependencies, regulation, and the underlying state-shaped market No network company in Japan is fully self-sufficient, and IIJ is unusually honest about it. Its filings say that a significant portion of access circuits, domestic and international backbone circuits, WAN lines, mobile interconnectivity and facilities, and even data center facilities are purchased from the NTT group and KDDI. Those same groups also compete with IIJ in internet connectivity, mobile, WAN, outsourcing, and systems integration. In other words, two of IIJ’s structurally most important suppliers are also two of its permanent rivals.

This is a vulnerable position, but also a stabilizing one: if IIJ can stay commercially relevant under those conditions, its franchise is probably real.

Ownership makes this coopetition more explicit. As of March 31, 2025, KDDI held 11.52% of IIJ, while NTT and NTT Communications together held another 11.52%. The present ownership balance emerged after NTT’s partial exit in 2023, when KDDI purchased 18.707 million IIJ shares from NTT as part of a capital and business alliance and IIJ bought back its own shares in a separate off-market transaction.

IIJ states there are no special business arrangements tied to these shareholdings, but the alliance with KDDI explicitly envisions cooperation in procurement, mobile services, mutual use, and joint development of business products, as well as personnel exchange. This does not make IIJ a captive, but it means its independence is always strategic rather than absolute.

The state dimension goes beyond shareholdings. IIJ’s current president, Yasuhiko Taniwaki, comes from the Japanese communications bureaucracy: Ministry of Posts and Telecommunications, then MIC, with senior roles including Director-General of the Telecommunications Bureau and Vice-Minister for Policy Coordination, plus a cybersecurity role connected to the Cabinet Secretariat and NISC before joining IIJ as an advisor in 2022 and becoming president in 2025. His career does not prove favoritism, and IIJ says it operates independently.

But it places the company in the overlap between technical infrastructure and state policy, exactly where one would expect a national Internet institution to sit.

This overlap is especially important in mobile. Japan’s MVNO market did not emerge by accident; it was shaped by prolonged regulatory pressure around competition, interconnection fees, and fairness relative to mobile network operators. Public Japanese documents around mobile market competition and interconnection fee studies repeatedly set out predictability, transparency, and a level playing field for MVNOs as competition-policy objectives.

IIJ itself has long benefited from these rules; an old IIJ presentation to an international audience explicitly credited the growth of the Japanese MVNO market to strong protection policy, non-discriminatory access, and guideline-based wholesale rates. More recent regulatory shifts have also been important at the technical edge: J:COM’s 2025 note about receiving mobile phone numbers attributes a MIC policy decision and subsequent reform allowing MVNOs to progress toward voice/SMS interconnection.

The economics is simple: IIJ’s mobile platform exists partly because Japanese telecom policy spent years ensuring wholesale access does not remain purely discretionary.

There is a more delicate state interaction on the security side. In 2025, IIJ disclosed that unauthorized access to its enterprise email security platform, IIJ Secure MX Service, had occurred on or after August 3, 2024, with up to 6,493 contracts and 4,072,650 email accounts potentially affected.

A follow-up statement narrowed the confirmed leak to 586 customer contracts, including 311,288 account IDs, six contracts involving email content and header data, and 488 contracts involving third-party cloud authentication information, with overlaps removed; the company attributed the breach to exploitation of a previously undiscovered vulnerability in third-party software used in the platform.

In July 2025, IIJ reported that it had received written administrative guidance from the MIC concerning an incident involving a leak of communications secrecy, and said it had already strengthened behavior detection functions and layered web application firewall defenses.

Economically, the incident has a dual effect. On the one hand, it damages exactly the trust layer IIJ monetizes. A serious Internet operator running email security for premium customers is supposed to be where risk is reduced, not where it concentrates. On the other hand, the list of customers that surfaced through affected-user disclosures is a reminder of how deeply IIJ is embedded: Tokyo Metropolitan Government units, Kioxia, Hitachi Construction Machinery, Keidanren-entities, and others all disclosed they were customers or counterparties in the impact zone.

This is bad incident optics, but it is also evidence of IIJ’s institutional market position. A commodity provider does not create this kind of notification chain involving the public sector and large enterprises.

The other regulatory lesson comes from the hi-ho side. In March 2026, hi-ho disclosed it had received administrative guidance from the MIC because customer notification about service suspension or termination had been inadequate; press coverage reported that some apartment residents using a VDSL-based service were not properly informed before the service shutdown, with the disruption appearing after service cessation.

From IIJ’s perspective, this matters less as a direct profit issue — hi-ho was sold in 2017 — than as a reminder that legacy consumer access businesses live in a stricter, more complaint-sensitive regulatory environment than institutional managed services. It reinforces the idea that the economically superior part of IIJ’s historic legacy was never “consumer ISP” in the abstract; it was the operational and interconnection competence that could be extracted from that world and sold upward.

Why the margin is sustainable and how it could still be eroded The strongest argument for IIJ’s sustainability is that the company has already survived the commoditization of businesses that normally kill old ISPs. Consumer Internet access became crowded. Mobile became price-competitive. Cloud infrastructure became hyperscaler territory. Enterprise networking became software-defined. Security filled with specialist vendors promising to eat the incumbent carrier. Yet IIJ kept moving up the stack while continuing to use its backbone and operational competence as the reference point for trust.

Its own medium-term plan puts it in very simple terms: improve the core business through large composite deals, increase enterprise recurring revenue to achieve economies of scale, and differentiate further through stable, high-quality network operation and higher-value-added security services. The company is not trying to win the market by being the loudest; it is trying to make itself the least embarrassing choice for important networks.

This strategy has visible customer traction. The project list for 2025–2026 in investor materials includes infrastructure and operations for public institutions, work on a shared platform for regional banks, global network for a megabank, educational infrastructure, public safety mobile services, and security improvement projects for financial institutions and manufacturers. Elsewhere, IIJ’s pages and releases show targeted solutions for GIGA School environments, regional financial systems, and closed-network security overlays for enterprises.

These are not generic SME web hosting offers; they are long-term, institution-shaped contracts where failure is expensive and switching is socially costly. This is where sustainable margins tend to live in Japan.

Job-ad evidence tells the same story from the inside. IIJ and IIJ Global are hiring across network, cloud, server, security, and IoT engineering roles, with published environments including MPLS, VPNs, OpenStack, VMware, Prisma, Zscaler, Cato, Linux, Kubernetes, and major public clouds. HRMOS listings for IIJ Global emphasize top-tier national projects, end-to-end network and security proposals, access to test labs, and long client engagements.

This is not the recruitment pattern of a consumer ISP optimizing call-center scripts; it is the pattern of an engineering-heavy operations company trying to stay broad enough to remain relevant at the frontier where networks, cloud, and security now meet.

The market noise, such as it is, also fits. Consumer reviews of IIJmio often describe the service as inexpensive and broadly acceptable rather than outstanding in raw speed; some older user threads focus on throttling rules or the difference between “good enough” and premium mobile performance. This is not a problem if the group’s real money lies elsewhere. In fact, it might be a feature. IIJ does not need to win a consumer speed beauty contest if the consumer volume mainly helps with platform utilization, supports eSIM and full-MVNO capabilities, and feeds a wider mobile infrastructure business.

The informal evidence matters mainly because it tells you what the company is not: it is not a retail glamour asset.

The risks, however, are real and not just theoretical. The first is trust erosion. The Secure MX breach is the most obvious example, precisely because it hit a premium trust product. If it repeats or is followed by evidence that IIJ cannot keep its own managed security surfaces clean, the central logic of “buy IIJ because they are serious” weakens materially. The company’s response — strengthen monitoring, harden WAF layers, form a project directly overseen by the CEO — shows it understands the risk is not just legal but commercial. “Serious” is the brand; brand damage here is margin damage.

The second is supplier and partner dependency. IIJ discloses that it depends heavily on NTT and KDDI for circuits, mobile interconnectivity, facilities, and other services. This is manageable when industry relations are stable; it becomes a problem if carrier incentives harden against neutral wholesalers, if mobile feature parity for MVNOs lags behind MNO services for too long, or if access economics tip against independent operators. The regulatory history of Japanese MVNO competition has prevented the most obvious foreclosure, but it has not abolished the structural dependence.

The third is platform lock-in by big tech. IIJ’s recent success in areas like SASE integration, firewall management, and cloud attachment depends partly on its ability to act as a neutral implementer of third-party tools. There is real value in this, and partner awards from Okta, Sophos, and Palo Alto suggest the channel remains healthy. But the same model means that vendor consolidation or a stronger direct move by those vendors into enterprise could squeeze operator margins.

The VMware shock disclosed by IIJ during FY2024 is a warning from a related angle: third-party platform decisions can land directly in IIJ’s cost base, and while the company says it managed a substantial pass-through, this is not a pure moat; it is operational competence under pressure.

The fourth is capital intensity. IIJ’s investment in facilities is rising. It has disclosed rising capex, increasing borrowings and lease obligations, and an expectation of continuing spend on network facilities, cloud-related systems, service development, own data center construction, and human resource expansion. In the company’s FY2025 presentation, capex reached 32.2 billion yen, with a notable increase related to Shiroi and Matsue data center spending.

This is not alarming in itself — owned infrastructure is part of the margin story — but it means the business only stays attractive if utilization and recurring revenue keep filling the pipes and buildings. Serious infrastructure is wonderful until it is empty.

The final risk is that IIJ’s “middle position” becomes less valuable. If the big carriers become more credible and less bureaucratic in enterprise managed services, and if the big systems integration firms become more network-native through partnerships or acquisitions, IIJ could find itself squeezed from both sides. The company’s answer is the service-integration model: use large multi-year composite deals to make switching hard and to move the relationship from “supplier” to “operational partner.” The recent deal flow suggests this strategy is working, but one should not pretend it is unassailable.

What makes IIJ dangerous to competition is also what makes it vulnerable: too much of its value rests on reputation, not on a legal monopoly.

What the public record can say confidently and what it cannot The public record can say a good deal about IIJ’s economic shape. It can say that the company is an engineering-heavy Japanese Internet institution with a large backbone, deep enterprise and public-sector penetration, growing recurring revenue, expanding outsourcing and security lines, a meaningful mobile platform, and a business model built around converting network credibility into adjacent managed services. It can say that the main living network identity is AS2497, while AS4688 appears to be a hi-ho-related historic residue still attached to IIJ’s organizational orbit.

It can say that IIJ’s core margins come from network services and the operations-and-maintenance tail attached to systems integration, not from the romance of home broadband. And it can say that trust is both the company’s key asset and the source of its greatest exposure, as demonstrated by the 2025 messaging security incident.

What it cannot say confidently is just as important. It cannot prove what AS4688 is used for internally today, if anything meaningful, beyond what public routing and registry traces suggest. It cannot cleanly break out profits between sub-lines like enterprise IP, consumer IIJmio, MVNE, security services, cloud interconnection, and systems operation. It cannot tell us how concentrated IIJ’s marquee customer base is, or what share of recent MRR growth comes from a handful of very large public and financial contracts.

It cannot show the precise negotiated economics of access and interconnection with NTT and KDDI, beyond IIJ’s acknowledgment of dependence and competition. And it cannot reveal whether the 2025 security incident caused material but slow-moving damage to forward bookings that had not yet appeared in FY2025 numbers.

This uncertainty should not lead to agnosticism; it should lead to a more disciplined conclusion. IIJ’s value is not that it owns a magic backbone, or that an old autonomous system somehow hides secret activity. The value is that the Japanese market still appears willing to pay for a specialist operator that is clearly neither a full incumbent carrier nor a pure software integrator; that IIJ has built enough engineering depth and interconnection legitimacy to fill that role; and that it has spent decades widening its revenue streams without abandoning the network posture that made the wider selling credible.

AS4688 is a fragment of that story, not the whole story. But the fragment is revealing. It shows how durable Internet companies are often built: not by replacing the old layer, but by stacking new margins on top until the original layer becomes less visible than the trust it created.

Evidence register IIJ FY2025 earnings release — URL:https://www.iij.ad.jp/en/ir/library/financial/pdf/IIJ4Q25E.pdf— Source type: company filing / earnings release. Supports: FY2025 revenue, operating profit, recurring revenue growth, network services breakdown, subscriber numbers, and current management strategy language. Does not prove: exact profitability by sub-product or customer cohort. Why it matters economically: it is the best current primary source for seeing where revenue is actually generated and how management wants investors to think about margin.

IIJ FY2025 presentation materials — URL:https://www.iij.ad.jp/en/ir/library/financial/pdf/IIJ4Q25E_presentation.pdf— Source type: company investor presentation. Supports: network services gross margin, systems integration gross margin, large project pipeline examples, capex trajectory, and service-integration model as current strategy. Does not prove: realized lifetime value of these contracts or whether management target-setting is conservative. Why it matters economically: it shows how IIJ converts projects into recurring revenue and where the company thinks operational leverage emerges.

IIJ Integrated Report 2025 — URL:https://www.iij.ad.jp/en/ir/integrated-report/archives/pdf/integrated-repot2025_en.pdf— Source type: integrated report. Supports: backbone fixed-cost economics, “newcomers cannot easily imitate” claim, customer mix, employee-engineer ratio, data center footprint, and general value-creation narrative. Does not prove: that management’s cultural self-description is fully borne out in day-to-day operations. Why it matters economically: it contains the clearest articulation of why IIJ thinks its network-plus-engineers asset model is scarce.

IIJ annual securities report FY2024 — URL:https://www.iij.ad.jp/en/ir/library/sec-report/pdf/FY2024_EndE.pdf— Source type: regulatory securities filing. Supports: revenue and gross profit breakdown by service line, risk factors, NTT/KDDI supplier dependency, shareholder data, backbone interconnection with JPNAP and dix-ie, and capex and funding disclosures. Does not prove: current FY2026 conditions beyond March 2025. Why it matters economically: it is the most solid, audit-type public source on structural dependence, coopetition, and underlying service economics.

PeeringDB entry for AS4688 — URL:https://www.peeringdb.com/net/32317— Source type: public network resource registry. Supports: organizational link to IIJ, zero public prefixes listed, open peering policy, no public exchange ports or facilities currently listed, and the continued existence of the ASN as an operational entity. Does not prove: whether AS4688 has non-public uses or internal traffic significance. Why it matters economically: it shows that AS4688 is real but publicly quiet, changing how one should interpret its strategic significance.

Cloudflare Radar routing page for AS4688 — URL:https://radar.cloudflare.com/routing/as4688— Source type: public routing observation dataset. Supports: AS4688 labeled “HI-HO,” country/organization link to IIJ, and visibility of entity ASNs including AS2497. Does not prove: precise traffic volume or business role. Why it matters economically: it is a clean external check that AS4688 persists as part of IIJ’s network domain but is not the obvious center of activity.

BGP.HE page for AS4688 — URL:https://bgp.he.net/AS4688— Source type: public routing/IRR aggregation. Supports: HI-HO-AS naming, hi-ho description, maintenance by MAINT-AS2497, and legacy IX interface addresses at DIX-IE and NSPIXP. Does not prove: current revenue-generating use or whether these IX endpoints remain materially used. Why it matters economically: it is the clearest public sign that AS4688 sits in IIJ’s orbit as a historical network resource artifact rather than a random stale entry.

PeeringDB entry for AS2497 — URL:https://www.peeringdb.com/net/690— Source type: public network resource registry. Supports: that AS2497 is the main IIJ network identity with large public prefix counts and global scope. Does not prove: actual traffic profitability. Why it matters economically: it provides the essential contrast that prevents over-interpreting AS4688 and anchors the business analysis in IIJ’s real core network identity.

hi-ho company history page — URL:https://hi-ho.co.jp/company— Source type: company history page. Supports: Panasonic origin of the hi-ho brand, IIJ’s acquisition in 2007, and IIJ’s sale of all hi-ho shares to ISP Holdings in 2017. Does not prove: how every network resource was separated after the sale. Why it matters economically: it explains why a hi-ho-related ASN can still illuminate IIJ’s story without implying hi-ho remains a core IIJ operating business.

hi-ho services page — URL:https://hi-ho.co.jp/service— Source type: company services page. Supports: hi-ho’s current positioning in FTTH/ISP and MVNO/mobile services. Does not prove: service quality or business scale. Why it matters economically: it helps separate hi-ho’s current retail proposition from IIJ’s enterprise-driven margin engine.

IIJ Secure MX breach disclosures — URLs:https://www.iij.ad.jp/en/news/pressrelease/2025/0415.htmlandhttps://www.iij.ad.jp/news/pressrelease/2025/0422-2.html— Source type: company incident disclosures. Supports: timing, potential and confirmed scope, cause via third-party software vulnerability, and nature of exposed information. Does not prove: long-term revenue damage from the incident. Why it matters economically: it is the most direct challenge to the trust premium on which IIJ’s security and outsourcing businesses rest.

IIJ notice on MIC administrative guidance after breach — URL:https://www.iij.ad.jp/news/pressrelease/2025/0718.html— Source type: company statement on regulatory action. Supports: that MIC issued written guidance, that IIJ framed the incident as involving a leak of communications secrecy, and that corrective measures were underway. Does not prove: the full content of the MIC notice or whether corrective measures are sufficient. Why it matters economically: regulator criticism raises the cost of repairing trust in IIJ’s premium service lines.

Tokyo Metropolitan Government notice on IIJ incident — URL:https://www.digitalservice.metro.tokyo.lg.jp/information/press/2025/04/20250417— Source type: customer/public-sector notice. Supports: that Tokyo government units were users of the affected IIJ Secure MX service. Does not prove: the overall public-sector customer concentration of IIJ. Why it matters economically: it is a visible piece of evidence that IIJ’s enterprise security installed base reaches sensitive public institutions.

MM Research Institute report on Japanese SIM card market — URL:https://www.m2ri.jp/release/detail.html?id=630— Source type: industry research press release. Supports: that IIJ led the single-service SIM card market in March 2024 and that enterprise IoT SIM cards were a major growth driver. Does not prove: IIJ’s profitability per SIM or exact 2026 share. Why it matters economically: it supports the claim that IIJ’s mobile economics are materially rooted in enterprise/IoT rather than only low-end consumer plans.

IIJ Global 2026 news page — URL:https://www.iijglobal.co.jp/en/news/— Source type: subsidiary news page. Supports: IIJ Global’s recognition by Okta, Sophos, and Palo Alto in 2026. Does not prove: the scale of security revenue directly attributable to these partnerships. Why it matters economically: partner awards are weak evidence alone, but in context they confirm IIJ’s serious role in the enterprise security implementation channel.

ITmedia report on MIC guidance to hi-ho — URL:https://www.itmedia.co.jp/news/articles/2603/31/news153.html— Source type: local-language press. Supports: the business significance of hi-ho’s 2026 notification failure and the VDSL transition issue affecting apartment residents. Does not prove: full scale of hi-ho’s customer losses or its financial position. Why it matters economically: it highlights how different the retail ISP quality signals are from IIJ’s enterprise-quality positioning, reinforcing the argument that the durable value migrated upward.

What would change the view of the serious Internet layer The business view would change materially if any of the following four facts became public.

First, if credible routing or operational evidence showed that AS4688 actually carries meaningful production traffic, customer assets, or private interconnection of strategic significance, then the old-identity thesis would shift from “archaeological clue” to “hidden living asset.” Nothing in the public record today proves that.

Second, if future disclosures showed that the Secure MX incident caused measurable deterioration in large-account renewals, public sector wins, or security attachment rates, then IIJ’s trust premium would warrant a lower multiple than this essay implies. At present, the evidence proves the incident and the regulator’s response, but not long-tail business damage.

Third, if NTT, KDDI, or major security/cloud vendors were shown to be squeezing IIJ’s supply economics or successfully bypassing it in the upper-enterprise segment, then the “serious Internet layer” would look more like a transitional role than a durable one. IIJ’s disclosures show dependence and coopetition, but not yet structural displacement.

Fourth, if the owned Shiroi and Matsue infrastructure failed to fill with profitable recurring workloads, then IIJ’s capex story would stop looking like operational leverage and start looking like ballast. For now, the evidence still points the other way: rising MRR, expanding outsourcing revenue, and a pipeline of long-duration service-integration deals suggest the serious Internet layer is still being bought.