An operation information specification unit 82, with use of terminal-specific countermeasure information indicating an applicable countermeasure for each terminal against a security risk and definition information defining a correspondence relationship between a type of operation information of the terminal and a countermeasure against the security risk, specifies a type of operation information corresponding to the countermeasure applicable to the terminal. An operation information acquisition unit 83 acquires operation information of the type specified by the operation information specification unit 82, from among operation information of the terminal. A prediction unit 85, based on the operation information acquired by the operation information acquisition unit 83, predicts the number of remaining terminals at a future time, and predicting the number of remaining terminals at the future time in expectation of the number of countermeasure suspension days that is the number of delay days from a scheduled date of countermeasure application in the past to an actual date of countermeasure application in the past.