An information processing apparatus connected to one or more vehicles and a threat information server via a network, the threat information server storing at least one piece of threat information, each of the at least one piece of threat information indicating an attack on a vehicle and a resolution state to the attack associated with each other, the information processing apparatus comprising: an obtaining unit which obtains a detection result of an attack on one of the one or more vehicles connected to the information processing apparatus; a first determining unit which determines whether the attack indicated by the detection result is included in any one of the at least one piece of threat information stored in the threat information server; a second determining unit which determines, when the attack indicated by the detection result is included in any one of the at least one piece of threat information, whether the resolution state to the attack indicated by the detection result included in the one of the at least one piece of threat information indicates that the attack has not been resolved or indicates that the attack has been resolved; a deciding unit which decides a processing priority level of the attack indicated by the detection result, based on a result of determination made by the first determining unit and a result of determination made by the second determining unit when the attack indicated by the detection result is included in any one of the at least one piece of threat information, and which decides a processing priority level of the attack indicated by the detection result, based on the result of determination made by the first determining unit when the attack indicated by the detection result is not included in the at least one piece of threat information; and an output unit which outputs the processing priority level decided by the deciding unit. an obtaining unit which obtains a detection result of an attack on one of the one or more vehicles connected to the information processing apparatus; a first determining unit which determines whether the attack indicated by the detection result is included in any one of the at least one piece of threat information stored in the threat information server; a second determining unit which determines, when the attack indicated by the detection result is included in any one of the at least one piece of threat information, whether the resolution state to the attack indicated by the detection result included in the one of the at least one piece of threat information indicates that the attack has not been resolved or indicates that the attack has been resolved; a deciding unit which decides a processing priority level of the attack indicated by the detection result, based on a result of determination made by the first determining unit and a result of determination made by the second determining unit when the attack indicated by the detection result is included in any one of the at least one piece of threat information, and which decides a processing priority level of the attack indicated by the detection result, based on the result of determination made by the first determining unit when the attack indicated by the detection result is not included in the at least one piece of threat information; and an output unit which outputs the processing priority level decided by the deciding unit.