Japan External Attack Surface
Using information anyone can see from the internet, we observe the external attack surface of Japanese companies every month. We do not publish individual company names or domains; we show trends for Japan as a whole and by industry and company size.
- Observed
- October 2026
- Companies observed
- 44,425
- Observed at
- October 22, 2026 at 05:59 JST
- Email spoofing protection
Base: Companies with resolvable DNS and a mail server (MX) 40,515
- DMARC set to quarantine or reject9.2%
- DMARC set (no quarantine or reject)41.6%
- SPF only45.0%
- Neither SPF nor DMARC found4.2%
- Website CMS
Base: Companies whose top page could be retrieved 35,841
- CMS not identified73.6%
- Another CMS or site builder identified5.2%
- WordPress (version not readable)6.9%
- WordPress version readable from outside11.8%
- Running a version WordPress marks as insecure2.5%
- Website certificates
Base: Companies with a certificate retrievable on port 443 38,497
- Valid95.8%
- Expired0.3%
- Name mismatch (listed URL is https)0.2%
- Name mismatch (listed URL is http etc.)3.7%
- Website PHP version
Base: Companies whose top-page response headers could be read 38,331
- PHP version not readable92.3%
- Security fixes applied0.9%
- Security fixes not applied0.8%
- Version no longer supported5.9%
- CVE-2026-109618 / CVE-2026-109619 (PHP, disclosed 21 October 2026)
Base: Companies whose PHP version could be read from outside 2,941
- Fixed release applied12.2%
- Earlier than the fix (supported version)10.7%
- Affected (version no longer supported)77.1%
Why look at the external attack surface?
Attackers use information that can be checked from the internet to look for attack targets and methods. Basic conditions such as email authentication, website software and certificates can also serve as material for those decisions.
In supply chain security, it matters to cover business partners as well as your own company. Regardless of company size, understanding how your external attack surface appears from outside is a first step in cybersecurity.
Selection
All of JapanCompanies in this selection: 44,425
Email spoofing protection
Emails pretending to come from a business partner or from the company itself are a common entry point for fraud, fraudulent payments and malware. SPF declares which servers may send a company’s mail, and DMARC decides what happens to mail judged to be spoofed; set to quarantine or reject, it makes fake mail using the company’s domain less likely to reach recipients. This breakdown shows how far companies have gone with these settings.
Base: Companies with resolvable DNS and a mail server (MX)
- DMARC set to quarantine or reject
- DMARC set (no quarantine or reject)
- SPF only
- Neither SPF nor DMARC found
By industry (top row: all of Japan)
Underlying numbers
All of JapanBase: 40,515
| Group | Share | Companies | vs last month |
|---|---|---|---|
| DMARC set to quarantine or reject | 9.2% | 3,709 | +0.2 pt |
| DMARC set (no quarantine or reject) | 41.6% | 16,872 | +0.3 pt |
| SPF only | 45.0% | 18,237 | -0.4 pt |
| Neither SPF nor DMARC found | 4.2% | 1,697 | -0.1 pt |
- ※ Both DMARC groups include companies that have no SPF record.
Website CMS
A website CMS left on an old version with known weaknesses can be defaced or taken over using publicly known techniques. When the CMS and its version can be read from outside, sites running a vulnerable version are easier to pick out. This breakdown shows whether the top page reveals which CMS is used, whether a WordPress version can be read, and whether it is a version WordPress itself marks as insecure.
Base: Companies whose top page could be retrieved
- CMS not identified
- Another CMS or site builder identified
- WordPress (version not readable)
- WordPress version readable from outside
- Running a version WordPress marks as insecure
By industry (top row: all of Japan)
Underlying numbers
All of JapanBase: 35,841
| Group | Share | Companies | vs last month |
|---|---|---|---|
| CMS not identified | 73.6% | 26,382 | +3.7 pt |
| Another CMS or site builder identified | 5.2% | 1,863 | -0.2 pt |
| WordPress (version not readable) | 6.9% | 2,490 | -0.9 pt |
| WordPress version readable from outside | 11.8% | 4,212 | -2 pt |
| Running a version WordPress marks as insecure | 2.5% | 894 | -0.7 pt |
- ※ “CMS not identified” includes sites that do not name a CMS, hand-built sites, and WordPress sites that hide it from outside.
- ※ “Another CMS or site builder identified” covers pages whose generator tag names a CMS or site builder.
Website certificates
A website certificate (the TLS certificate used for HTTPS) lets visitors confirm they are connected to the real site over an encrypted connection. When it has expired or does not match the site’s name, browsers show a warning, and visitors who get used to clicking through warnings are less likely to notice a fake site or an intercepted connection. This breakdown shows whether each certificate is valid, expired, or issued for a different name.
Base: Companies with a certificate retrievable on port 443
- Valid
- Expired
- Name mismatch (listed URL is https)
- Name mismatch (listed URL is http etc.)
By industry (top row: all of Japan)
Underlying numbers
All of JapanBase: 38,497
| Group | Share | Companies | vs last month |
|---|---|---|---|
| Valid | 95.8% | 36,871 | +1.2 pt |
| Expired | 0.3% | 121 | -0.1 pt |
| Name mismatch (listed URL is https) | 0.2% | 83 | 0 pt |
| Name mismatch (listed URL is http etc.) | 3.7% | 1,422 | -1.1 pt |
- ※ “Name mismatch (listed URL is http etc.)” covers companies that appear not to have set up HTTPS.
Website PHP version
PHP is the runtime behind many websites, including WordPress. Staying on a version whose support has ended, or on an outdated release, leaves a site open to takeover through publicly known weaknesses. This breakdown shows whether the PHP version can be read from the top page’s response headers and, if so, whether it is the latest supported release or one that needs updating.
Base: Companies whose top-page response headers could be read
- PHP version not readable
- Security fixes applied
- Security fixes not applied
- Version no longer supported
Only one month so far. The trend will appear as more months are observed.
By industry (top row: all of Japan)
Underlying numbers
All of JapanBase: 38,331
| Group | Share | Companies | vs last month |
|---|---|---|---|
| PHP version not readable | 92.3% | 35,390 | — |
| Security fixes applied | 0.9% | 358 | — |
| Security fixes not applied | 0.8% | 316 | — |
| Version no longer supported | 5.9% | 2,267 | — |
- ※ “PHP version not readable” includes companies that do not use PHP and those that hide the version.
- ※ Distribution builds (Ubuntu, Debian, etc.) are assessed against the distribution’s own security information (Ubuntu USNs, the Debian security tracker): whether the last security update published for that release by the day the observation started has been applied. Distribution builds of versions whose support has ended are counted as no longer supported.
- ※ “Security fixes applied” means the same as or newer than the last security release PHP had published for that version series by the day the observation started. Bug-fix-only releases are not counted.
CVE-2026-109618 / CVE-2026-109619 (PHP, disclosed 21 October 2026)
On 21 October 2026 the PHP security team released fixes for two critical vulnerabilities (CVE-2026-109618 / CVE-2026-109619). This breakdown shows, month by month, how many companies whose PHP version could be read have applied the fixed release and how many are still on an earlier version. Versions whose support has ended (8.1 and earlier) receive no fix.
Base: Companies whose PHP version could be read from outside
- Fixed release applied
- Earlier than the fix (supported version)
- Affected (version no longer supported)
Only one month so far. The trend will appear as more months are observed.
By industry (top row: all of Japan)
Underlying numbers
All of JapanBase: 2,941
| Group | Share | Companies | vs last month |
|---|---|---|---|
| Fixed release applied | 12.2% | 358 | — |
| Earlier than the fix (supported version) | 10.7% | 316 | — |
| Affected (version no longer supported) | 77.1% | 2,267 | — |
- ※ The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (PHP security advisories). Versions whose support has ended are counted as affected, following the range registered in NVD (before 8.2.35).
- ※ Distribution builds (Ubuntu, Debian, etc.) are assessed against the distribution’s own CVE tracker (the package version that carries the fix for that release). Where a distribution has fixed a version through extended support, it is counted as having the fix applied even if PHP itself no longer supports that version.
Methodology
The companies in scope are those listed on Shokubalabo, the workplace information site run by Japan’s Ministry of Health, Labour and Welfare. The companies and their industry, employee size and prefecture were derived by processing data from that site.
Observation is limited to what anyone can see from the internet. We check DNS records, each company’s top page and the website certificate, and perform no intrusive or load-generating tests.
Email spoofing protection, website CMS and website certificates are each counted against the companies for which that item could be checked. The detailed group definitions are given for each item.
Comparisons with ISMS-certified companies use only companies matched by name and prefecture against the ISMS certification registry. Companies that could not be matched are not treated as “not ISMS certified”.
Source: Shokubalabo