NDIAS

What NDIAS does

NDIAS is a Tokyo-headquartered, Japanese-domiciled cybersecurity specialist serving the automotive industry. Founded in December 2018 as a 50/50 joint venture between NRI Secure Technologies (a Nomura Research Institute subsidiary) and Denso Corporation, the company addresses the cybersecurity obligations imposed on vehicle manufacturers and their suppliers by UN-R155, UN-R156, ISO/SAE 21434, and emerging regional regimes including EU RED/EN 18031 and China GB 44495-2024. Its portfolio comprises three integrated pillars — automotive security consulting (threat analysis, security specification development, PSIRT building/operation, regulatory compliance, SBOM, log/monitoring design), automotive security assessment (ECU security evaluation, connected service security testing), and automotive security education and training — augmented by subscription-based threat and vulnerability intelligence feeds, an annual Automotive Cybersecurity Report, and a CTF competition. NDIAS monetizes primarily through professional-services engagements (consulting and assessment on a quote basis), open-enrollment training courses (e.g., 88,000 JPY for a 1-day beginner course; 660,000 JPY for a 5-day hands-on course), and recurring threat-intelligence subscriptions.

NDIAS sells B2B to automotive OEMs, Tier-N suppliers, and select non-automotive manufacturers (agricultural machinery, construction equipment, medical devices, aircraft, vessels) as well as IoT device manufacturers, leveraging direct enterprise sales backed by the NRI Group's distribution network and Denso's automotive-industry relationships. The company has accumulated 300+ projects, 130+ ECU security assessments, and 700+ detected vulnerabilities since inception, and its credentials include IPA Information Security Service Standards registration (Service Reg. 023-0024-50) for ECU security evaluation, Gold Sponsorship of DEF CON 33's Car Hacking Village, and multiple presentations at DEF CON and Auto-ISAC. Geographic service is concentrated in Japan, with growing international compliance offerings for China and the EU and limited global footprint claims.

The company operates as a private, boutique specialist (11–50 employees, 100 million yen registered capital, no external funding), relying on parent-company support for capital and customer access. Leadership transitioned in June 2024 with President Kiuchi Takenori (formerly NRI Secure Technologies) and expanded in June 2025 with Executive Vice President Hayashi Keisaku, reflecting a maturation phase as NDIAS broadens into adjacent verticals (IoT, space via Japan Space ISAC) and recurring-revenue threat intelligence services.

Name

NDIAS

Legal name

株式会社NDIAS

Website

https://ndias.jp

Company type

Private

Founded year

2018

Operating status

Operating

Headcount range

1–10 employees

Short description

NDIAS is a Tokyo-based automotive cybersecurity specialist founded in 2018 as a 50/50 joint venture between NRI Secure Technologies and Denso Corporation, delivering threat analysis, ECU security assessment, PSIRT support, training, and threat-intelligence services to automotive OEMs, Tier-N suppliers, and IoT manufacturers across Japan, Europe, and China.

Ownership category

akta.pro rank

Product category

Automotive Cybersecurity Consulting

NAICS

Other Scientific and Technical Consulting Services (541690), Professional, Scientific, and Technical Services (54), Computer Systems Design and Related Services (54151)

SIC

Services-Testing Laboratories (8734), Services-Commercial Physical & Biological Research (8731)

akta.pro primary industry

Security Risk Assessment, Auditing & Security Consulting Training (BPAKAOAH)

Keywords

• Automotive cybersecurity consulting
• ECU security assessment
• Vehicle threat analysis
• PSIRT operations support
• ISO/SAE 21434 training

Headquarters

HQ city

Minato

HQ country

Japan

HQ region

Asia

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Security Consulting Services: Automotive cybersecurity consulting including security process development, threat analysis, PSIRT building/operation support, and security specification development. Services are provided to automotive OEMs, suppliers, and other manufacturing companies.
2. Security Assessment Services: ECU security assessment, vehicle security assessment, and connected service security assessment. Includes penetration testing, vulnerability scanning, design review, and threat analysis.
3. Training Services: Automotive security training programs including basic courses, intermediate (hands-on) courses, advanced attack/defense techniques training, risk assessment training, ISO/SAE 21434 overview training, and PSIRT training. Both in-house and open enrollment formats available.
4. Threat Intelligence and Vulnerability Information Services: Subscription-based threat and vulnerability information distribution services for automotive and IoT products, including specific vulnerability alerts and quarterly reports.

Pricing tiers

Go-to-market motion1 record

Distribution channels4 records

Marketing channels8 records

Core offering

NDIAS is a specialized automotive cybersecurity consulting firm that delivers three integrated service lines for the automotive industry: (1) Consulting including vehicle/ECU threat analysis, security specification development, PSIRT building and operation, market research, and global regulatory compliance support (China GB standards, EU RED EN 18031, SBOM implementation); (2) Security assessment services for vehicle ECUs (penetration testing across CAN/Ethernet/Wi-Fi/Bluetooth/LTE/USB/NFC) and connected services (web apps, servers, smartphone apps); and (3) Security education including entry-level to advanced hands-on training, ISO/SAE 21434 seminars, and PSIRT training. Services are provided to automotive OEMs, Tier-N suppliers, and other connected-product manufacturers.

Product overview

NDIAS is a specialized automotive cybersecurity company jointly established by NRI SecureTechnologies and DENSO in December 2018, offering an integrated portfolio of cybersecurity consulting, security assessment, and training services for the automotive industry. The portfolio consists of three core service pillars: (1) Automotive Security Consulting covering threat analysis (車両・車載ECU脅威分析), security specification development, market research, PSIRT building and operation support, log/monitoring design, and global regulatory compliance (China GB standards, RED EN18031, SBOM); (2) Automotive Security Assessment services including ECU security evaluation (車載ECUセキュリティ評価), connected service security testing, and vehicle threat analysis; and (3) Automotive Security Education and Training spanning basic/intermediate courses, specialized attack/defense techniques (kernel exploitation, fuzzing, stack BOF), ISO/SAE 21434 seminars, and PSIRT training. The company also publishes annual threat intelligence reports (NDIAS AUTOMOTIVE CYBERSECURITY REPORT) and hosts the NDIAS Automotive/IoT CTF competition. With 130+ ECU assessments and 700+ vulnerabilities detected, NDIAS supports the entire vehicle lifecycle from upstream development through post-market PSIRT operations.

Differentiator

Problem solved

Functional benefit

Products and services

• Vehicle/Automotive ECU Threat Analysis Threat analysis and risk assessment services for vehicles and on-board ECUs, based on international regulations (UN-R155, UN-R156), international standards (ISO/SAE 21434), and other automotive guidelines (NHTSA Best Practice, JASPAR standards/technical documents). Targets automotive OEMs and Tier-N suppliers needing cybersecurity quality assurance for type approval and post-market compliance.
• Security Specification Development and Analysis Security specification development and analysis service using unique perspectives based on extensive automotive security experience to identify security design issues before product development. Targets automotive engineering and security teams.
• Market and Future Trend Research Research service covering latest automotive security technologies, regulations, standardization trends, and domestic/global market intelligence conducted by automotive security experts. Targets automotive strategy, regulatory, and engineering teams.
• PSIRT Operations Construction Consulting PSIRT (Product Security Incident Response Team) operations construction and consulting service covering team building, process design, vulnerability information monitoring, triage, alerting workflows, and ongoing training. Targets automotive and IoT manufacturers establishing post-market security operations.
• Cybersecurity Audit Support (CS Audit Support) Cybersecurity management system (CSMS) audit support service compliant with UN-R155, ISO/SAE 21434, and ISO/PAS 5112 standards. Supports external audits and internal audit framework development including auditor training for OEMs and suppliers.
• RED EN 18031 Self-Certification Test Support One-stop support service for RED (Radio Equipment Directive) EN 18031-1:2024, EN 18031-2:2024, and EN 18031-3:2024 self-certification testing required for wireless equipment in the European market from August 2025. Targets manufacturers placing connected/wireless products on the EU market.
• SBOM Introduction and Operation Support Service SBOM (Software Bill of Materials) introduction and operation support service for the automotive industry, covering tool selection, process integration, and ongoing vulnerability management operational consulting. Targets automotive OEMs and suppliers implementing software supply chain security.
• China Automotive Cybersecurity Standards Compliance Support Design assessment and testing environment construction service for Chinese automotive cybersecurity standards including GB 44495-2024, supporting compliance with China's mandatory requirements. Targets manufacturers entering the Chinese automotive market.
• Log and Monitoring Design Support Log and monitoring design support service for vehicle-related services, helping design appropriate log output, collection methods, and monitoring approaches aligned with security requirements. Targets automotive engineering and operations teams.
• Vehicle Security Technical Requirements Collection Utilization Service Service utilizing comprehensive security technical requirements collection covering CRA, PSTI, GB/T and other regional automotive security, software update, and IoT regulations to support compliance. Targets compliance and engineering teams.
• Vehicle ECU Security Assessment ECU security assessment service with 130+ evaluation experiences, covering threat analysis, hardware testing (CAN/Ethernet/Wi-Fi/Bluetooth/LTE/USB), and software analysis (dynamic/static) with comprehensive reporting. Targets automotive OEMs and suppliers.
• Connected Service Security Assessment Security assessment for vehicle-connected services including web applications, web servers, and smartphone applications, with system selection support and prioritization based on attack feasibility. Targets OEMs and connected service operators.
• Automotive Threat and Vulnerability Trend Information Distribution Subscription-based threat and vulnerability trend information distribution service providing weekly/biweekly text reports and monthly/quarterly analysis articles by automotive security experts. Targets PSIRT and security teams monitoring the automotive threat landscape.
• Specific Vulnerability Information Distribution Service Specialized vulnerability information distribution service focusing on cryptography and automotive-specific communication protocols (SOME/IP), with severity assessment and stakeholder alerting. Targets automotive and IoT manufacturers needing targeted vulnerability alerts.
• IoT Threat and Vulnerability Trend Information Distribution Monthly threat and vulnerability trend report service for IoT devices, available as monthly reports, quarterly reports, and detailed analysis of new vulnerabilities affecting IoT products. Targets IoT manufacturers and PSIRTs.
• PSIRT Training Customized training programs for PSIRT building and operation based on client requirements (minimum 20 participants), covering team construction, vulnerability triage, and incident response exercises. Targets enterprise clients establishing PSIRT functions.
• Automotive Security Intermediate Training (Hands-on) 5-day intensive hands-on training covering automotive interfaces (Cellular, Wi-Fi, Bluetooth, CAN, NFC, IP) and ECU hardware/software, including reverse engineering and practical attack techniques. Targets automotive security professionals and engineers.
• Automotive Security Basic Training 1-day basic automotive security training covering regulations, development processes, automotive networks, ECU composition, cybersecurity measures, and threat/incident cases. Targets new employees joining automotive security departments and developers from non-security backgrounds.
• ISO/SAE 21434 Overview Training Seminar covering ISO/SAE 21434 requirements referenced by UN-R155, including cybersecurity management, development processes, threat analysis, and risk assessment methods. Targets engineering and compliance teams implementing ISO/SAE 21434.
• Attack/Defense Technique Training — Stack BOF 2-day hands-on training on stack buffer overflow exploitation techniques and defense mechanisms in Linux environments, covering NX, ASLR, RELRO, PIE, and SSP bypass techniques. Targets advanced security researchers and exploit developers.
• Attack/Defense Technique Training — Software Fuzzing Overview Gray-box fuzzing training using AFL (American Fuzzy Lop), covering fuzzing fundamentals, implementation, techniques, and optimization for vulnerability discovery. Targets security engineers working on automated vulnerability detection.
• Attack/Defense Technique Training — Kernel Exploit Advanced lecture-based training on Linux kernel exploitation history, attack techniques, and defense mechanisms including DirtyCred, page table manipulation, and privilege escalation methods. Targets advanced exploit researchers and security specialists.
• Risk Assessment Training (TARA) TARA (Threat Analysis and Risk Assessment) training covering automotive frameworks (HEAVENS, EVITA), risk assessment methodologies, and group work. Targets security engineering teams conducting vehicle threat assessments.
• Privacy Response Training Half-day customized privacy training covering automotive and mobility service privacy cases, OECD principles, ISO/IEC 29100, GDPR, and Privacy by Design concepts for product development teams (minimum 20 participants). Targets automotive product development teams.
• NDIAS Automotive Cybersecurity Report Annual threat and vulnerability intelligence report analyzing automotive cybersecurity trends, PSIRT strengthening points, and regulatory features for automotive industry professionals. Targets automotive security strategists, PSIRT leads, and engineering executives.
• NDIAS Automotive/IoT CTF Competition Online Capture The Flag cybersecurity competition focused on automotive and IoT device security, covering vehicle protocols, firmware analysis, reverse engineering, exploit development, and waveform analysis. Targets security researchers and automotive security community globally.

Quantifiable outcome

• 130+ ECU security assessments completed
• +2 more outcomes

Named customers4 records

Segments4 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature8 records

Partnerships

Seven partnerships are on record, tiered minor and core.

• CeleriumminorStrategic or Co-development Partner · 7 May 2026Strategic partnership announced for automotive cybersecurity collaboration.
• Japan Space ISACminorStrategic or Co-development Partner · 20 April 2026NDIAS joined Japan Space ISAC (Information Sharing and Analysis Center) to strengthen cybersecurity in the space sector and promote information sharing. The partnership aims to leverage NDIAS's automotive security expertise for space industry applications.
• Tier IVcoreStrategic or Co-development Partner · 27 August 2019Joint research for safe autonomous driving security technology. Collaboration focuses on security risk assessment methods and countermeasures for autonomous driving hardware/software, connected systems, and Autoware OS security evaluation through The Autoware Foundation.
• Yeraze SecuritycoreStrategic or Co-development Partner · 5 June 2019Joint technology development partnership for automotive cybersecurity field, specifically for strengthening vehicle and in-vehicle electronic device security evaluation services. Yeraze Security contributes advanced software analysis and reverse engineering capabilities while NDIAS provides automotive domain expertise.
• JASPARminorStrategic or Co-development PartnerParticipation in Japan Automotive Industry Software Association (JASPAR) for standardization and industry collaboration in automotive cybersecurity.
• J-Auto-ISACminorStrategic or Co-development PartnerParticipation in Japan Automotive ISAC for industry-wide cybersecurity information sharing and collaboration.
• US Auto-ISACminorStrategic or Co-development PartnerParticipation in US Automotive ISAC for international cybersecurity information sharing and collaboration with North American automotive industry.

Scale indicators8 records

Recent moves8 records

Expansion highlights6 records

Direct peers

• Cybellum: Cybellum delivers automotive software bill of materials (SBOM), vulnerability management, and risk assessment platforms for OEMs and Tier-1s. Comparable to NDIAS in SBOM introduction/operation support, TARA, and regulatory compliance services.
• Argus Cyber Security: Argus (a Continental subsidiary) provides in-vehicle and fleet cybersecurity solutions including penetration testing, PSIRT support, and ECU protection. Comparable to NDIAS in ECU security assessment and threat analysis services for global automotive customers.
• VicOne: VicOne is a Trend Micro subsidiary specializing in automotive cybersecurity, offering VSOC, ECU security, and threat intelligence for OEMs. It is the closest direct peer to NDIAS in the Japan/APAC automotive cybersecurity market, with overlapping services and customer segments.
• Upstream Security: Upstream offers a cloud-based vehicle cybersecurity platform combining threat intelligence, monitoring, and incident response for connected fleets. Comparable to NDIAS in PSIRT support, threat intelligence distribution, and connected-vehicle security assessment.
• Karamba Security: Karamba provides ECU-level security software and consulting for automotive and IoT manufacturers, including threat analysis, penetration testing, and compliance with ISO/SAE 21434. Highly comparable to NDIAS's ECU security assessment and consulting offerings.

Broad incumbents

• ETAS (Bosch): ETAS, a Bosch subsidiary, provides automotive middleware, security solutions, and engineering services for embedded systems. Comparable to NDIAS in automotive ECU security evaluation and embedded software security, with a much larger parent and broader portfolio.
• Vector Informatik: Vector is a major automotive software tool and services vendor offering security testing, AUTOSAR, and cybersecurity consulting. Comparable to NDIAS as a broader automotive engineering services incumbent that competes for security testing and consulting budgets.
• Trend Micro: Trend Micro is a global cybersecurity incumbent with VicOne as its automotive arm, providing broad endpoint, cloud, and IoT security. Comparable to NDIAS in automotive cybersecurity research and threat intelligence, with vastly larger scale and product breadth.
• NRI SecureTechnologies: NRI SecureTechnologies is NDIAS's parent and one of Japan's largest IT security services firms, providing SOC, consulting, and managed security across multiple industries. Comparable to NDIAS in cybersecurity consulting and security assessment, with broader vertical and technology scope.

Regional players

• SBD Automotive: SBD Automotive is a UK-based automotive technology research and consulting firm covering connected car, ADAS, and cybersecurity. Comparable to NDIAS in providing automotive security research, market intelligence, and consulting to global OEMs, with primary European geographic focus.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat5 records

Key risks5 records

Key highlights6 records

Customer concentration

• GitHubgithub.com/NDIAS
• LinkedInlinkedin.com/company/ndais-ltd

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles7 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about NDIAS