A security device (2110, 300, 3001) connected to one or a plurality of busses (2190a to 2190c, 101 to 103) of an onboard network which is onboard a vehicle (2100, 500, 1000), the security device comprising: a reception unit that receives a frame from one of the busses; a determination unit that determines, with regard to the frame received by the reception unit, whether or not predetermined conditions are satisfied to distinguish whether or not the received frame may be an attack frame, wherein the predetermined conditions satisfied include the frame having a correct format, and that determines, in accordance to the predetermined conditions, whether or not to transmit a determination request for the frame to an external device (2200, 400, 600) that exists outside the vehicle; wherein the security device is characterized by an obtaining unit that effects control so that the determination request, for determining by the external device whether or not the frame is normal, is transmitted to the external device (2200, 400, 600) in a case where the determination unit has determined to transmit the determination request when the predetermined conditions are satisfied and obtains determination results transmitted from the external device in accordance to the determination request, the determination results indicating one or the other of whether the frame is normal or not; and an output unit that outputs first presentation information for calling an attention of a driver in the vehicle in a case where the determination unit has determined to transmit the determination request, and outputs second presentation information indicating determination results in a case where the obtaining unit has obtained determination results from the external device, wherein the output unit includes a speaker and causes the speaker to output the first presentation information and the second presentation information. a reception unit that receives a frame from one of the busses; a determination unit that determines, with regard to the frame received by the reception unit, whether or not predetermined conditions are satisfied to distinguish whether or not the received frame may be an attack frame, wherein the predetermined conditions satisfied include the frame having a correct format, and that determines, in accordance to the predetermined conditions, whether or not to transmit a determination request for the frame to an external device (2200, 400, 600) that exists outside the vehicle; wherein the security device is characterized by an obtaining unit that effects control so that the determination request, for determining by the external device whether or not the frame is normal, is transmitted to the external device (2200, 400, 600) in a case where the determination unit has determined to transmit the determination request when the predetermined conditions are satisfied and obtains determination results transmitted from the external device in accordance to the determination request, the determination results indicating one or the other of whether the frame is normal or not; and an output unit that outputs first presentation information for calling an attention of a driver in the vehicle in a case where the determination unit has determined to transmit the determination request, and outputs second presentation information indicating determination results in a case where the obtaining unit has obtained determination results from the external device, wherein the output unit includes a speaker and causes the speaker to output the first presentation information and the second presentation information.