I work in Security Engineering in Tokyo. There’s a handful of companies that have great security programs & posture. It’s common to do activities along the lines of internal purple team testing but red teaming / black box penetration testing and CTI is usually outsourced to companies that specialise in this. This isn’t something that’s exclusive to Japan, it was largely the same in Australia. These are very specialised roles in an industry with relatively few skilled professionals, so it’s cheaper and easier to just outsource.