Emergency 30-min call
Physical × Cyber Integrated Defense

Systems and facilities you cannot afford to stop.
We investigate, fix and watch over them.

We find out what could stop your core systems and your plant or store equipment, fix them even when nobody knows how they work, and watch over them from both the physical and the cyber side. When something has already stopped, we investigate that too.

Order only what you need, one service at a time. The principal engineer handles it directly.

Book a free 30-min call → Start from what you need

Already stopped, or already hit? Go to emergency

  1. InvestigateAssessment · Specification analysis
  2. FixRemediation · Rebuild
  3. WatchIntegrated monitoring
  4. RespondEmergency investigation
For you

Which of these is closest to you?

Start with any of them. If you are not sure, we decide together in a 30-minute call.

Fix

We cannot fix it because nobody knows how it works

The person in charge left, the vendor contract ended, there is no documentation.

Example requestAnalyze a sales management system whose owner has left, write the specification, confirm the impact scope, then fix it without stopping the business.

When we finishYou know what breaks when you touch what, and can fix it safely.

First step: Specification analysis (from JPY 3M)

 Investigate

We want to know what could stop us

You do not know what could take it down, or where to start fixing.

Example requestAssess a production management system for cyber attack, insider misuse and failure of dependent systems, and summarize estimated loss and the order of fixes on one page for management.

When we finishManagement can decide what could stop you and what to fix first.

First step: Assessment (from JPY 500K, 2–4 weeks)

 Watch

We want to catch anomalies early

Cameras, access records and logs exist, but nobody watches them. Nights and weekends are unstaffed.

Example requestWatch server-room cameras, access records and signs of unauthorized login together, and notify the person in charge of situations to check first, with what to do next.

When we finishAnomalies at night and on weekends reach the right person, most important first.

First step: Integrated monitoring, quoted after a site check

 Respond

Something has already happened

Unauthorized access, data taken out, a break-in, equipment stopped. Cause unknown.

Example requestA case where we started the same day on unauthorized access to a shipping system. Preserve evidence, identify the path, put interim procedures in place so shipping continues, and close the way back in.

When we finishThe path and the scope of damage are known, and prevention is in place.

First step: Free emergency call (30–60 min)
Cases

Requests and track record

What clients came with, what we did, and where things stood when we finished.

Manufacturing · Assessment

If the production management system stops, the line stops. Is watching the cyber side enough?

Situation
A production-management core system and the server room inside the plant.
What we did
Mapped what could stop it, from cyber attack and physical intrusion to equipment failure and insider misuse, together with dependent systems and business impact, and assessed from the attacker's side. Reviewed server-room locks, entry records, and power and cooling monitoring through web-meeting interviews and documents, and identified the gaps between those and the cyber controls. Produced a one-page executive summary with estimated loss.
Result
One page that lets management decide what could stop the line and what to fix first. Critical and high findings confirmed fixed by retest.
Retail · Specification analysis, assessment and remediation

Nobody knows what is inside our core system.

Situation
A core system handling store sales, inventory and ordering. No documentation, and the contract with the original vendor had ended. If it stops, store ordering stops.
What we did
Analyzed source, configuration, logs and traffic to produce a full specification covering screens, batch jobs and external integrations. Then assessed from the attacker's side and presented risk and fix priority translated into business impact (ordering outage, tampered sales data). With the impact scope documented, applied fixes outside store hours.
Result
Delivered the specification and the scope of remediation, so the team now knows what breaks when they touch what. Critical and high findings fixed within 3 weeks and confirmed by retest.
Wholesale · Remediation

Orders, inventory and shipping all run on one internal system. We want it fixed, but if it stops, nothing ships.

Situation
A sales and inventory management system handling everything from orders to shipping instructions. A daytime outage means missing the day's dispatch.
What we did
For the findings from assessment (an unauthenticated admin screen, a single permission level for all users, API keys embedded for external integrations), set the order of fixes and remediated authentication, permission separation and audit logging without stopping shipments.
Result
Zero shipping downtime during remediation. Fixes confirmed by retest.
Manufacturing · Incident response

Someone got into our order and shipping system. We cannot issue shipping instructions. What happens to today's shipments?

Situation
An unauthorized login to the order and shipping management system. Entry point unknown, and unclear whether other servers were reached.
What we did
On the case the same day. Cut off the entry path and preserved logs and devices as evidence. Correlated authentication, network and cloud audit logs to identify the entry point and determine whether there had been any lateral movement. Set up interim procedures and an isolated environment so shipments could continue during the investigation. Rotated credentials, redesigned permissions and closed the way back in.
Result
Operations restored after 6 hours of downtime. No lateral movement or re-intrusion. Delivered an executive report and prevention measures.
Finance · AI agent assessment

We deployed an AI assistant over internal documents. The web app passed assessment, but is the AI side safe?

Situation
An internal document search assistant already in use. The web application had been assessed, but the AI-specific paths had not.
What we did
Inventoried the agent's tools, permissions and data sources, then ran attack simulations: prompt injection, retrieval of documents beyond user permissions through RAG, and privilege escalation through tool execution.
Result
Identified and fixed paths to documents beyond user permissions that the web assessment could not see. Retest confirmed that documents nobody should see no longer come out.
SaaS · Secure application development

We are building an internal AI agent on business data. We want it defensible from day one.

Situation
A new internal AI agent app connected to business data and tools.
What we did
Designed on zero trust: per-request authentication, WAF, network isolation, least privilege, audit logs. AI tool execution allowlisted, critical operations gated by human approval. Accompanied from design review through release.
Result
Every critical finding fixed before release. No security-related rework or downtime since release, and zero critical or high findings in external assessment.
Sound familiar? Get in touch Not sure? Start with an assessment (from JPY 500K). The founder replies directly within one business day.
Process

From first call to kickoff

You pay nothing until you have agreed to the quote and signed.

  1. STEP 01

    Free call (30 min)

    We hear what you cannot afford to stop and what is bothering you now. Online, no preparation needed.

    Free
  2. STEP 02

    Scope and quote

    Scope: what we look at, deliverables, duration and price.

    No fees until you agree
  3. STEP 03

    Contract

    We sign once you agree to the quote. Fees start from here.

    Paid from here
  4. STEP 04

    Investigation or rollout

    For assessment or specification analysis, you receive the report, the order of fixes and a quote for the next stage. For monitoring only, this is where we install and tune it.

    Paid
  5. STEP 05

    Choose the measures

    Based on the report, pick only what you need: remediation, rebuild or monitoring. Stopping after one is fine.

    Only what you choose
  • No documentation? You can still talk to usWe work out systems with no original developers from source, configuration and logs.
  • Paid work only after you agree to the quoteWe never start work without agreement.
  • An assessment alone is fineDecide on the next stage after you have read the report.
  • No action on production without prior agreementWe agree in advance on what we touch, when, and how to roll back, and touch nothing else.
Services & pricing

Investigate, fix, watch, respond.

You do not have to go in order. Order only what you need, one service at a time. Prices are guideline figures in JPY, tax excluded, and vary with scale. Once quoted, the price is fixed against defined deliverables and completion criteria. Anything outside the scope is quoted separately.

InvestigateWhat could stop it, and what is inside

Assessment

From JPY 500K2–4 weeks

Typical target
One core system such as sales, inventory or production management
Deliverables
Report, one-page executive summary with estimated loss, order of fixes and a quote for the next stage
Included
Remote attacker's-eye review, interviews over web meetings
Extra
Additional systems, fixing what we find (quoted as remediation)

Specification analysis

From JPY 3Mquoted

Typical target
A business system with no documentation, no original developers and no vendor
Deliverables
Full specification (screens, batch jobs, external integrations, data) and the scope of remediation
Included
Analysis of source, configuration, logs and traffic, interviews with the business users
Extra
Parts with no surviving source code, the remediation itself

FixFix it while it runs, or rebuild it to stop less

Remediation

From JPY 4Mquoted

Typical target
A system whose scope of fixes has been set by assessment or specification analysis
Deliverables
The repaired system and a re-assessment confirming the fixes work
Included
Order of fixes, a cutover plan that keeps the business running, the fixes, testing
Extra
New features outside the scope, hardware purchases, ongoing maintenance after the fix

Rebuild

From JPY 5Mquoted

Typical target
An aging core system that is faster to rebuild than to fix
Deliverables
The rebuilt system and an annual re-assessment
Included
A design that stops less, and phased migration from the old system
Extra
Hardware and cloud usage fees, new features outside the scope

WatchPhysical and cyber signals, watched together

Integrated Monitoring Omamori

Quotedafter a site check

Typical target
Server rooms in plants, stores, warehouses or hospitals, and the core systems running there
Deliverables
Notifications (what, where, when, what to do next), detection items and recipients set per site
Included
Installation, connection to existing cameras, access control and logs, sensitivity settings, one month of false-positive tuning after rollout
Extra
Video-processing hardware, converters or replacements for cameras that cannot stream, on-site response and fixes after a notification

Cameras that can stream video over the network do not need replacing. Whether yours are supported and whether extra hardware is needed is decided at the site check and included in the quote.

RespondInvestigation after something has stopped

Emergency investigation

Initial response JPY 1.5M–3Mfirst call free

Typical target
Unauthorized access, data taken out, break-in or theft, systems or equipment stopped for unknown reasons
Deliverables
Initial response: one-page interim report. Full investigation: executive report plus material for insurers, regulators and police
Included
On-site response, evidence preservation, isolating the cause, interim measures to keep operations running, aligning physical and cyber records
Extra
Full investigation (JPY 3M–6M), recovery and prevention, night and holiday call-outs (+50%)

We take it whether the cause is cyber, physical or still unknown. See Emergency for each stage.

Who does whatRoles and responsibilities

Monitoring system (Omamori)

  • Collects signals and groups related ones into one situation
  • Judges fault, attack or physical breach, with reasons
  • Notifies situations to check first, with a recommended response

By default it does not act on its own. It automates only what you have approved.

The principal (Green Tea)

  • Assessment, specification analysis, remediation and rebuild work
  • Monitoring rollout, sensitivity settings, false-positive tuning
  • Investigation and prevention when an incident occurs

Only what is in the contract. Production changes only with prior agreement.

You and your maintenance vendor

  • Receive notifications, approve and carry out the response
  • Provide network lines and installation space, day-to-day maintenance
  • Approve any action on production

Approval and execution stay with you or your maintenance vendor.

Technical advisory (monthly) also available.

Emergency

Already stopped? We still take it.

Omamori Emergency Investigation: incident investigation whether the cause is cyber, physical, or still unknown.

When to call

  • You suspect an employee or former employee has taken data out
  • After a break-in or theft, you want to check nothing was planted
  • Security equipment such as cameras or access control is acting strangely
  • A plant or equipment has stopped, and you cannot tell fault, attack or human action
  • A cyber attack such as ransomware involves a plant or site

Our commitment

  • The principal takes the call, and goes on site the same day when available
  • We take it whether the cause is cyber, physical or still unknown
  • We do not stop at investigating: we fix it and prevent recurrence
0
First call — free (30–60 min)
We hear the situation by phone or online, tell you what to do now and what not to touch, and confirm whether we can take it with a rough estimate.
1
Initial response — 2–3 days, JPY 1.5M–3M
On site. Stop the spread, preserve evidence (devices, logs, video, access records), inspect the premises, isolate the cause, and put interim measures in place (isolation, temporary recovery, interim procedures) so operations continue during the full investigation. One-page interim report.
2
Full investigation — 1–3 weeks, JPY 3M–6M
Align physical and cyber records on one timeline to identify the path and the scope of damage. Executive report plus material for insurers, regulators and police.
3
Recovery and prevention — quoted
Decide the order of repair, design, arrange and supervise contractors, re-assess after the fix.

You can stop after the initial response. Night and holiday call-outs +50%; clients who have had an assessment with us get a discount on the initial response.
We do not take surveillance of people, interviews, legal judgment, simultaneous forensics of hundreds of devices or ransom negotiation, and we decline when we do not have capacity. In each case we refer you to a partner.

Emergency call (free) Email us
Why Us

Why Green Tea LLC

1
Builds on your existing equipment
Cameras and systems that work stay in place. We replace only what the site check shows is needed.
2
Cyber and physical, covered by one firm
Network-borne attacks and building-side factors — server room, power — handled through a single point of contact. No vendor split, no finger-pointing.
3
The principal engineer handles it directly
From first consultation through investigation, fixes and operation, the principal stays involved end to end.
4
Defense designed from the attacker's side
Hands-on penetration testing and OSINT experience means defenses are built around how attackers actually operate.
5
You decide the scope of automation
Human approval by default, with the automated scope widened to match your requirements. Designed so that a false positive does not stop the business.

The principal brings both cyber security (formerly Nomura Research Institute, GWAPT penetration testing certification) and physical security (international bodyguard training and INTCPO certification), and supports you directly.

How it works

Connecting physical and cyber.

Physical security (cameras, guards) and cyber security (IT, SOC) sit in different departments, with different vendors and different timelines. Incidents that cross both are recorded on only one side. Omamori connects the signals from your existing equipment on one timeline.

STEP 01

Collect

  • Physical: cameras, access control, server-room temperature and power sensors
  • Systems: logs, security products (SIEM/EDR), uptime signals
→
STEP 02

Connect

  • Match physical and system signals into a single situation on one timeline
  • Decide whether it is a fault, an attack, or a physical breach — and explain it in plain words
  • Group related signals and notify the situations to check first
→
STEP 03

Deliver

  • Notify the people agreed in advance
  • Hand over what happened, where, when, and what to do next, on one page
  • People approve and execute (you or your maintenance vendor)
It does not act on its own. Omamori covers detection, judgment and recommendation. The automated scope can be widened step by step as your requirements and AI maturity allow.

The actual screen

A night-time intrusion and a system anomaly connected on one timeline, through to the recommended response.

What we watch

People and behavior

  • People, suspicious loitering
  • Line crossing, abandoned objects
  • Falls, after-hours entry, camera tampering

Facilities and environment

  • Server-room temperature and power
  • Power outages, cooling failures
  • Locks and entry

Cyber (existing SIEM integration)

  • Unauthorized login
  • Privilege escalation attempts
  • Suspicious outbound traffic

Detection items and sensitivity are set per site. We do not promise accuracy as a number. We check it in your environment at rollout and tune false positives with you.

Where are you now?

Protecting the building (physical)

Physical is covered

Cameras, access control and a guard contract exist

  • Cameras record, but nobody analyzes suspicious people or movement
  • Entry records exist, but nobody reviews them
  • VPN and server logs are looked at about once a month
Not visible: what someone who entered the building did to your systems

Both on one timeline

Where Omamori works

  • A suspicious person at the entrance camera and an unauthorized server login right after appear on the same screen
  • Fault, attack or physical breach is judged, with reasons
  • Who should do what arrives on one page
Cyber-only attacks, physical-only intrusions and attacks across both, judged the same way

Neither yet

Unstaffed at night and on weekends

  • Cameras only record, or are not installed
  • Server-room keys or PINs are shared, with no entry records
  • Antivirus is installed, but nobody reads the logs
Not visible: when it stops, no clues remain to find the cause

Cyber is covered

Monitored with SOC, EDR or SIEM

  • The server-room door PIN is shared, so nobody knows who entered
  • Power or cooling problems are noticed only after something stops
  • Camera video never reaches the SOC screen
Not visible: someone who tailgated in uses a valid card to enter the server room
Protecting the data (cyber)
Physicalapprox. 47,000/ yearReported burglaries in JapanSource: National Police Agency crime statistics
Cyberapprox. JPY 550MAverage cost per incident (Japan)Source: IBM study

Typical industries: manufacturing (plants), retail and wholesale, logistics, healthcare (hospitals and clinics), finance, data centers.

FAQ

Frequently asked questions

We have no documentation and nobody who built it. Can we still ask?

Yes. We start by analyzing source, configuration, logs and traffic to write the specification (specification analysis).

When do fees start?

After you agree to the quote and sign. The 30-minute call is free.

Can we order only an assessment, or only monitoring?

Yes. Every service can be ordered on its own. You do not have to go in order.

Will you touch our production environment without asking?

No. We agree in advance on what we touch, when, and how to roll back, and touch nothing else. The monitoring system, by default, only notifies and does not act on its own.

Can we use our current cameras?

Cameras that can stream video over the network can be used as they are. Whether yours are supported and whether extra hardware is needed is decided at the site check and included in the quote.

Will false positives stop our business?

By default the monitoring system only notifies and does nothing that stops the business. You decide what it may automate. For the first month after rollout we tune false positives with you. We do not promise accuracy as a number.

Will you fix the problems you find?

Yes. Fixes are quoted separately as remediation and done after you agree. We re-assess afterward to confirm the fixes work.

Contact

Book a 30-minute call.

The 30-minute call is free. The founder replies directly within one business day.

Get in touch →

For an emergency, go to Emergency.

Company
Green Tea LLC
Representative
Reo Onozawa
Address
Miyamasuzaka Building 609, 2-19-15 Shibuya, Shibuya-ku, Tokyo 150-0002
Founded
June 2022
Business
Integrated Monitoring Omamori / security assessment / specification analysis, remediation and rebuild of core systems
Email
sales@greentea.earth
X
@onoz_jp