Initiatives for Product Security

We regard enabling our customers to use our products safely and secure of mind as our highest responsibility, and we are continuously working to ensure robust security.

This page presents our basic policy on product security and our Vulnerability Disclosure Policy, which governs the proper and timely disclosure of, and response to, vulnerabilities in our products.

Through these initiatives, we strive to earn the trust of our customers and society, and to provide products that can be used with confidence.

We comply with laws and regulations related to product security. With regard to personal information, we take appropriate protective measures based on our internal policies.

If a security incident occurs in our products or services, or if a critical vulnerability is identified, we promptly report it to relevant authorities in accordance with applicable laws, regulations, and internal rules. At the same time, we verify the facts and investigate the root cause, strive to prevent the occurrence and escalation of damage, and take swift and appropriate action for customers and other affected parties. 

We continuously collect information on vulnerabilities in our products and services from both internal and external sources, including customers. When a vulnerability is identified, we promptly implement countermeasures. We also provide customers with security advisory on measures to reduce security risks arising from discovered vulnerabilities.

Where necessary, we coordinate with relevant government agencies and regulatory authorities regarding security incident and vulnerability information affecting our products and services, and take appropriate steps to enable disclosure.

We establish internal security design and development standards that appropriately incorporate applicable industry standards, guidelines, and verification methods related to product security. Based on these standards, we carry out product development, implement measures to reduce security risks, and endeavor to remediate vulnerabilities before products are shipped. We also thoroughly analyze past security incidents and incorporate preventive and damage-mitigation measures into these internal standards to help prevent future incidents. 

To ensure the safe use of our products and services, we include instructions on secure usage methods that help reduce security risks in user manuals and other documentation provided to customers. In addition, we proactively issue security advisories and cautions related to our products and services through our corporate website and other channels.

To help ensure that product operations in our customers’ environments using our products and services are not interrupted, we work to reduce security risks across the supply chain, including customers and suppliers related to our business. Initiatives include providing machine-readable Software Bills of Materials (SBOMs) for components and libraries developed by our company, and collaborating closely with supply chain partners.

To enhance knowledge and technical capabilities regarding the security of our products and services, and to improvement security awareness, we continuously provide security education and awareness-raising activities for our officers and employees.

We have established a Product Security Incident Response Team (PSIRT) to ensure that customers can use our products and services safely. Our PSIRT responds to vulnerabilities related to our products and services.

In order to provide appropriate mitigation measures for vulnerabilities and help reduce security risks for our customers, we disclose vulnerability-related information in accordance with ISO/IEC 29147 and the “Information Security Early Warning Partnership Guideline” (Japan).

We accept reports of vulnerabilities not only for current products, but also for products that are no longer in production. Please note, however, that for products that are no longer in production, technical or support-related constraints may prevent us from conducting investigations or implementing countermeasures.

Vulnerability information regarding our products and services that is reported to us is promptly reviewed and investigated by the responsible department in cooperation with the design and development departments.

In the course of investigation and remediation, we may ask the reporter to provide additional information or clarification, such as technical details and procedures to reproduce the issue.

For vulnerability information regarding our products and services reported to us, we work with coordination organizations such as the Innovation Platform Agency, Japan (IPA) and JPCERT Coordination Center (JPCERT/CC), as necessary, to implement appropriate measures.

Where an impact is confirmed, we take countermeasures such as providing patches, and/or guidance on configuration changes or workarounds.

Where necessary, we publish vulnerability information and remediation measures via our corporate website and platforms such as JVN (Japan Vulnerability Notes). If a particular customer is expected to be significantly affected, we may also contact them individually through our sales channels.

We provide the reporter, to the extent reasonably possible, with periodic updates on the status of our response until the measures are completed. However, for security or other reasons, we may not be able to disclose all details of our investigation.

When a new vulnerability affecting our products is identified, we publish a security advisory on our corporate website, including details of the vulnerability and countermeasure information, once preparations for mitigation and public disclosure have been completed.

The publication date will be coordinated with the reporter and relevant parties, and with coordination organizations where necessary, and a CVE ID will be assigned before publication.

When we receive a vulnerability report, we will, in principle, acknowledge receipt within five business days after confirming the notification.

Please note that notifications received on Saturdays, Sundays, national holidays, or during extended holiday periods such as summer vacation or the New Year holidays will be handled from the next business day onward, and our response may therefore be delayed.

If a person who has contributed to the discovery or resolution of a vulnerability in our products or services agrees, we will publish an acknowledgment of their contribution in the relevant advisory or on our corporate website.

If we receive multiple reports regarding the same vulnerability, we will, in principle, acknowledge the first valid report.

Personal information provided to us is appropriately protected in accordance with our internal rules.

For details, please refer to our Privacy Policy.

Vulnerability reports are accepted via the “Report Form.” Communication through this form is protected by SSL/TLS encryption.