Abstract: Provided is a determination device including an acquisition unit that acquires a vulnerability identifier for uniquely identifying a vulnerability, a search unit that searches for vulnerability information identified by the vulnerability identifier by referring to a database in which vulnerability information for each vulnerability identifier is registered, a generation unit that generates an instruction to determine necessity of responding to a vulnerability identified by the vulnerability identifier by using the vulnerability information identified by the vulnerability identifier and a norm regarding information security, and an output unit that outputs determination data including a determination result output from a model in response to the instruction.

Abstract: A diagnosis support device according to an aspect of the present disclosure includes: at least one memory storing a set of instructions; and at least one processor configured to execute the set of instructions to: extract a device characteristic indicating information related to security of a target device from information of the target device; determine, from the device characteristic, a magnitude of a device risk based on a magnitude of a risk of a security item that is a predetermined item related to security, the device risk being a risk that is capable of existing in the target device; and output a magnitude of the device risk.

Abstract: An extraction unit extracts damage information including a keyword related to content of a case of damage caused by a certain type of vulnerability in information security, from a document describing the case of damage; a generation unit generates an explanation regarding the case of damage by using the damage information extracted from the document; and an output unit outputs information based on the generated explanation.

Abstract: Provided is an information presentation device including an acquisition unit that acquires document data regarding cybersecurity, an extraction unit that extracts a candidate for an entity related to the cybersecurity from the acquired document data, a search unit that searches for relevant information associated with the extracted candidate, a generation unit that generates an instruction to request identification of an entity related to security, which is included in the document data, by using the document data and the relevant information extracted for each candidate, and an output unit that outputs attack information including an entity output from a model in response to the instruction.

Abstract: An information presentation device includes an acquisition unit that acquires attack data including an attack technique in a cyberattack test, a search unit that searches for a method for using a security tool correlated with the attack technique, a generation unit that generates an instruction to request presentation of an attack instruction using the method for using the security tool found in the search, and an output unit that outputs attack instruction data including the attack instruction output from a model in response to an input of the instruction.

Abstract: Whether the information indicated by a plurality of pieces of text data describing an information security-related event is consistent is determined. An acquisition unit acquires a plurality of pieces of text data describing an information security-related event; an analysis unit analyzes whether information indicated by the pieces of acquired text data is consistent by using information security-related knowledge information; and an output unit outputs information based on an analysis result as to whether the information indicated by the pieces of text data is consistent.