H2O Retailing

Benefits of Tenable Adoption 

• Unified Visibility and Governance
• Risk-Based Triage
• Speed and Cost Optimization
• Improved Transparency

Interviewees

Yuji Kumasaka, CISSP, CISA
Manager, Information Security Promotion Dept., Risk Management Office
H₂O Retailing Corporation

Defining the Retail Security Strategy and Priorities

Q. Could you tell us about your role within the group and your day-to-day responsibilities?

Mr. Kumasaka: Within the Information Security Promotion Department, I oversee the development and execution of IT governance and security strategy for the entire group. Our company operates a diverse range of businesses, including department stores and supermarkets. My mission is to build the foundation that securely supports service transformation through DX while protecting our customers’ trust and safeguarding our critical data, which we consider our most valuable intangible assets. 

Q. What are your current security priorities?

Mr. Kumasaka: We are focusing on three key areas: enhancing our vulnerability triage by using AI to assess business risk, expanding visibility across the group's entire IT assets, and strengthening security governance throughout the organization.

Q. Could you elaborate on these priorities?

• AI-driven, risk-based vulnerability triage
  Mr. Kumasaka: Previously, we took a uniform approach to every detected vulnerability—addressing them all the same. As our systems grew more complex, however, filtering through all that information became a challenge. Moving forward, we aim to leverage Tenable's AI capabilities, such as Vulnerability Priority Rating (VPR), so we can objectively assess which vulnerabilities pose the highest real-world exploitation risk. This allows us to focus resources on the areas that truly require attention and achieve effective risk reduction with minimal operational effort.
• Expanding IT asset visibility across the group
  Mr. Kumasaka: We are gradually expanding the scope of IT asset visibility across the group to achieve two main goals: to gain an accurate understanding of the assets we need to protect and where they are located, and to do so in a cost-effective way.
• Strengthening security governance
  Mr. Kumasaka: To further strengthen governance, we are building an environment where each business unit can independently understand and monitor its own risk using clear security scores. Our aim is a fundamental shift from “security that is imposed” to “security that is autonomously managed.”

Q. What are some unique security requirements for the retail industry, and how are you addressing them?

Mr. Kumasaka: Retail is fundamentally a business built on trust. Protecting customer personal information is essential, but operational availability is just as critical. Any downtime at our stores or e-commerce sites immediately results in lost sales opportunities and inconvenience for customers. In environments where diverse systems coexist, especially following M&A activity, maintaining an up-to-date, comprehensive view of all assets is critical. Rather than relying on point-in-time assessments, we have established a continuous monitoring framework that allows us to track changes over time. This ensures our security keeps pace with the fast-moving retail environment.

Overcoming Hybrid and Multi-Cloud Challenges: Why H₂O Retailing Chose Tenable for Unified Visibility

Q. What challenges led you to implement Tenable?

Mr. Kumasaka: Our biggest challenge was the growing diversity of IT assets across the group, ranging from on-prem systems to multi-cloud environments. Maintaining a real-time understanding of the entire environment had become increasingly difficult.

Traditionally, we conducted annual, outsourced vulnerability assessments focused mainly on externally facing systems. However, with the rising threat landscape, it became necessary to manage vulnerabilities across all assets, including internal systems. The difficulty was that internal systems involve a very large number of IP addresses, making traditional approaches extremely costly. To achieve both comprehensive visibility and cost optimization, we decided to bring vulnerability management in-house and automate the process.

Q. Why did you choose Tenable?

• What were your key requirements for a solution?
  Mr. Kumasaka: We had four main requirements: external attack surface management (ASM), web application security testing, platform assessment, and IaaS security configuration assessment. A fundamental prerequisite was that all these capabilities had to be managed within a single, integrated platform, rather than across separate tools.
• What made Tenable the right choice?
  Mr. Kumasaka: The deciding factor was Tenable’s ability to provide unified visibility across our hybrid, multi-cloud environment. Our infrastructure includes AWS, GCP, OCI, and on-prem systems, and Tenable One allows us to visualize all of them through a single platform. Preventing management silos was a huge advantage—it accelerates decision-making for our CSIRT and strengthens our overall governance. Additionally, Tenable’s strong ratings from third-party analysts gave us confidence in the quality of the solution.

Q. How long did it take from initial evaluation to full implementation?

Mr. Kumasaka: It took approximately six months from the start of evaluation to full deployment. During the early stages, one challenge was how to organize the large volume of detected information. By leveraging Tenable’s scoring features, we established a clear operational rule to address high-priority issues first. This allowed for a smooth rollout without placing excessive burden on operational teams.

Quantitative Gains, Qualitative Impact, and the Road Ahead for H₂O Retailing's Security

Q. What results have you seen since deployment?

Mr. Kumasaka: From a quantitative perspective, we have seen dramatic improvement in how quickly we identify and fix vulnerabilities. By bringing vulnerability management in-house, we have optimized the costs previously spent on outsourced services. At the same time, time once spent on manual data collection can now be used for implementing actual remediation measures.

From a qualitative perspective, one major benefit is the ability to report security risk to executive management using objective scoring. This has improved transparency in how security risk is communicated at the leadership level.

Q. Are there areas where you would like to see improvements?

Mr. Kumasaka: We hope to see further growth in the Japanese user community as well as enhanced Japanese-language reporting capabilities to make them even more intuitive to use. We see Tenable not just as a vendor, but as a partner in helping us elevate our security maturity.

Q. What are your plans for the future?

Mr. Kumasaka: Looking ahead, we plan to advance our “shift left” strategy—ensuring security early in the development process to standardize more secure system development practices. We will also invest in developing our team’s expertise to fully leverage these tools. By strengthening both our technology and our people, we aim to further solidify our foundation as a retail group that customers continue to choose for its safety and reliability.

* Details as of June 2025