Publishing the external attack surface of about 44,000 Japanese companies every month — Japan External Attack Surface

Pentacon Research, Inc. (Chuo-ku, Tokyo; CEO: Kazuya Hiradate) published Japan External Attack Surface in September 2026. The research observes, every month and using only information anyone can see from the internet, the state of email authentication, website CMS and website certificates at about 44,000 Japanese companies.

Why we publish it

The state of systems exposed to the internet can be observed by attackers as well. The state of email authentication, website software and certificates can serve as material when attackers look for targets.

Defenders, on the other hand, have almost no way to see where their own company stands against Japan as a whole or against others in the same industry. This research does not publish individual company names or domains. By showing aggregated trends, it turns the external attack surface that attackers can already see into material for defenders' decisions.

As supply chain security becomes more important, companies of every size are expected to take security measures that cover their business partners as well as themselves. By observing the external attack surface of Japanese companies continuously and publishing where they stand and how that changes, we aim to prompt action on security.

What you can see in Japan External Attack Surface

• The state of email authentication, CMS and certificates
• Comparisons by industry, company size and ISMS-certified companies
• The monthly trend (updated every month)

The results and comparisons from the first observation, in August 2026, are published in Japan External Attack Surface.

Methodology

• Scope: 43,987 Japanese companies (first observation, August 2026)
• Observation: DNS records, each company's top page and website certificates, checked only within what anyone can see from the internet. No intrusive or load-generating tests are performed

About Pentacon Research

Pentacon Research, Inc. carries out research and analysis on information security and provides PentaTrail CTEM/ASM, which covers the discovery of externally exposed assets through to their remediation.

Company profile

Enquiries

Pentacon Research, Inc. — contact form