ricsec.co.jp

What It Is

Ricerca Security（株式会社リチェルカセキュリティ） is a Japanese offensive security company based in Tokyo and founded in 2019. Rather than offering traditional security products, it positions itself as a professional services provider staffed by CTF players, security researchers, and offensive/defensive R&D specialists. Its services cover vulnerability assessment/penetration testing, red team exercises, consulting, training, and automation R&D for Exploit/Post-Exploit workflows.

Core Capabilities and Dimensions

In terms of protection approach, Ricerca Security emphasizes validation from an “attacker’s perspective”: it can be used to identify internal security risks, verify the effectiveness of existing defenses, and test defense and incident response through red team exercises. Case studies show experience across Flutter/Dart, gRPC, AI SaaS, automotive security, retail groups, and crypto-asset scenarios, indicating strong adaptability to different technology stacks. Delivery is mainly project-based; training can be provided online or offline. For management and alerting, the reviewed materials do not indicate a continuous monitoring platform or alerting console, but diagnostic reports include remediation cost estimates and recommended countermeasures. On compliance, the company does not disclose its own certifications, but its consulting can support ISMS (JIS Q 27001:2023), Japan Financial Services Agency guidelines, IPA guidelines, and automotive security guidelines from JAMA/JAPIA.

Pricing

Pricing transparency is moderate. Training prices are relatively clear: several one-day courses are priced at 150,000 JPY per person, excluding tax, while the browser exploitation course starts from 600,000 JPY per person, excluding tax. Consulting is available either on a time-and-materials basis or by quotation. Standard pricing for vulnerability assessments, penetration testing, and red team exercises is not publicly listed and requires submitting requirements for a quote.

Pros and Cons

Its strengths are notable technical depth, with courses covering advanced topics such as Linux/Windows kernels, browser exploits, and fuzzing; a relatively complete service chain from assessment to consulting and training; and customer cases demonstrating the ability to handle non-standard technology stacks and sensitive business environments. Limitations include insufficient disclosure around pricing, payment methods, communication with Chinese customers, and delivery boundaries. The company has around 40 employees, so its ability to handle large-scale parallel multi-project delivery should be further confirmed.

Best Fit and Access from China

Ricerca Security is suitable for R&D-driven startups, AI/SaaS companies, finance and crypto-asset businesses, automotive security teams, security departments of large enterprises, and security teams looking to improve red team or penetration testing capabilities. There is no evidence in the reviewed materials regarding access from China, so the status is marked as unknown; payment methods are also not disclosed. Chinese enterprises that require local delivery, Chinese-language communication, and compliance implementation may also compare alternatives such as Qi An Xin, NSFOCUS, Venustech, DBAPP Security, and Chaitin Tech.