H2O Retailing Deploys Tenable One for Unified Multi-Cloud Exposure Management
Japanese retail group H2O Retailing uses Tenable One to unify cyber exposure management across its complex multi-cloud infrastructure and business units.
Key points
- H2O Retailing deployed Tenable One to replace annual, outsourced vulnerability assessments with continuous monitoring.
- The platform provides unified visibility across external attack surfaces, web apps, and IaaS configurations.
- The move aims to reduce costs, eliminate management silos, and enable proactive security governance by business units.
Exposure management firm Tenable Holdings announced that H2O Retailing has deployed the Tenable One Exposure Management Platform across its diverse multi-cloud infrastructure. This implementation provides the Japanese retail group with unified visibility and risk-based prioritization capabilities. The deployment marks a shift from fragmented security tools to a single, integrated system for managing cyber risks across all assets.
According to Industrial Cyber, the platform utilizes AI capabilities to objectively assess which vulnerabilities pose the highest real-world exploitation risk. This allows H2O Retailing to prioritize remediation efforts effectively. The system provides clear security scores that empower individual business units to transition toward self-managed, proactive security governance. This approach replaces the previous reliance on manual data collection and point-in-time assessments.
Context and Background
H2O Retailing is a leading retail group in Japan’s Kansai region. The group operates Hankyu Hanshin Department Stores and various food retail brands, including Izumiya, Hankyu Oasis, and Kansai Super. It also manages numerous commercial facilities. As the group advanced its digital transformation initiatives to modernize customer experiences, its IT infrastructure grew increasingly complex. This complexity made it difficult and costly to maintain real-time visibility of risks across the organization.
Previously, H2O Retailing relied on annual, outsourced vulnerability assessments. These assessments were primarily focused on public-facing systems, such as the company’s portal. With the rapidly changing threat landscape, the group determined it was necessary to manage risk across all its assets, not just external touchpoints. Yuji Kumasaka, manager of the Information Security Promotion Department at H2O Retailing Corporation, stated that the group needed a solution supporting external attack surface management, web application security, and IaaS security configuration within a single platform.
Who Is Affected
The cybersecurity teams at H2O Retailing are the primary users of this new framework. They can now view assets and cyber exposure through a single platform to understand their risk posture. This unified view helps eradicate management silos that existed when separate tools were used for different security domains. The continuous monitoring framework allows the group to track changes over time, rather than relying on static snapshots.
Importantly, the group achieved significant cost optimization from reduced outsourcing expenses. The move away from manual data collection further streamlined operations. Naoya Kishima, country manager for Tenable Japan, noted that retail runs on trust, which depends entirely on safeguarding customer data and maintaining uptime. This deployment supports those operational goals by enhancing the group's ability to respond to threats quickly.
What should you do?
Organizations should evaluate whether their current vulnerability management processes provide continuous visibility or rely on periodic snapshots. If you manage multi-cloud environments, ensure your security tools can integrate data from IaaS, web applications, and external attack surfaces. Review your outsourcing contracts to determine if in-house continuous monitoring could reduce long-term costs.
Background: Attack surface management
Attack surface management identifies every digital entry point attackers could exploit. Small businesses benefit by mapping external assets, prioritizing risks, and delegating complex scanning to managed providers. This reduces exposure without requiring a large security team.
Read the full guide: Attack Surface Management for Small Businesses: Practical Steps
What to do and how to stay safe: Tenable One
- Audit your current vulnerability assessment frequency to determine if annual checks leave gaps in your security posture.
- Consolidate security tools to ensure external attack surface, web application, and infrastructure data are viewed in a single pane.
- Implement continuous monitoring frameworks to track asset changes and exposure risks in real time rather than point-in-time.
- Train business units on security governance using clear security scores to encourage proactive, self-managed risk mitigation.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why did H2O Retailing switch to Tenable One?
The group needed a single, integrated platform to manage external attack surface, web application, and IaaS security, replacing fragmented tools and annual outsourced assessments.
What specific benefits did H2O Retailing achieve?
The group gained unified visibility, accelerated response times via AI, significant cost optimization from reduced outsourcing, and enabled proactive security governance for business units.
Which brands are part of H2O Retailing?
H2O Retailing operates Hankyu Hanshin Department Stores, Izumiya, Hankyu Oasis, Kansai Super, and various commercial facilities in Japan’s Kansai region.
