When to call us

Not sure your public servers and VPN are patchedMost intrusions in Japan in 2026 started with a known vulnerability in a VPN appliance or an exposed server.
Your website is run by an outside agencyNobody in-house knows whether the CMS and plugins are current.
A customer or head office asked for assessment resultsYou want to answer "do you perform vulnerability assessments" with evidence.
You want Microsoft 365 checkedMFA, conditional access, legacy authentication, external sharing.
A new system is about to go livePre-release assessment and periodic checks afterwards.
After an incident, you want to know what else is openFind the other weaknesses in one pass, not just the entry point.

What is assessed

  • External perimeter:Internet-reachable servers, firewall and VPN appliances, mail configuration (SPF, DKIM, DMARC), open ports and services.
  • Websites and web applications:CMS and plugin versions, known vulnerabilities, misconfiguration, basic authentication and input handling checks.
  • Microsoft 365 and Google Workspace:MFA coverage, admin accounts, legacy authentication, external sharing, audit log settings.
  • Internal network (optional):Scanning from inside a site: outdated operating systems, missing patches, unnecessary services, share permissions.
  • Manual verification:A person reviews the results, removes false positives and confirms what is actually exploitable.

A scan is not an assessment. A scanner produces hundreds of possibilities. The assessment decides which of them matter in your environment and in what order to fix them.

How an engagement runs

  1. ScopeTarget IP addresses, domains and tenants, and the time window. Intrusive checks are agreed in advance so production is not affected.
  2. ScanSeveral automated tools, supplemented by manual checks.
  3. VerifyResults reviewed by a person; false positives removed; exploitability and impact assessed.
  4. ReportFindings graded critical, high, medium and low, with remediation steps, in English and Japanese, plus a management summary.
  5. Re-testAfter your fixes, the affected items are re-checked and the result added to the report.

Deliverables

  • Assessment report in English, Japanese or both: severity, evidence and remediation steps for each finding
  • Management summary (one or two pages)
  • Remediation list in priority order
  • Re-test results
  • A summary suitable for customers or head office where needed

Can be repeated quarterly or twice a year as a periodic assessment.

Indicative pricing

Starting pointFrom about JPY 350,000Indicative for an external perimeter of a few dozen IP addresses plus Microsoft 365, re-test included. The price depends on the number of targets, the size of any web application and whether the internal network is included. Scope and price are fixed before work starts.

Frequently asked questions

What does it cost?

The external perimeter plus Microsoft 365 starts at about JPY 350,000. The price depends on the number of targets, the size of any web application and whether an internal assessment is included. The re-test is included.

How is this different from a penetration test?

An assessment finds and ranks weaknesses comprehensively. A penetration test uses them to see how far an attacker could get. We recommend an assessment first and a test where the result justifies it.

Will it affect production?

Normal scanning does not. Intrusive or authenticated checks are run only at an agreed time and in an agreed way.

How often should we do this?

The external perimeter at least once a year and whenever public servers or VPN appliances change. For continuous checking, SecureWatch monitoring is the alternative.

Can you work in both English and Japanese?

Yes. Meetings, reports and management briefings are available in English and Japanese, so a foreign head office and the Japanese team can work from the same findings.

Do we have to do the fixes ourselves?

The report gives concrete steps for your IT staff or vendor. CS2 can also support or carry out the remediation.

Send us the targets and you will have scope and price within two business days.

Tell us how many domains and IP addresses you expose and whether you use Microsoft 365.

Contact