An information processing device comprising: a processor; and a memory including at least one set of instructions that, when executed by the processor, causes the processor to perform operations. The operations include: obtaining incident information about an incident of a cyberattack that occurred in a vehicle; obtaining second vehicle information about a state of a second vehicle via communication with the second vehicle; determining a risk level of a vehicle function of the second vehicle based on a degree of matching between the incident information and the second vehicle information; generating a function restriction command for restricting a vehicle function of a first vehicle corresponding to the vehicle function of the second vehicle, when the risk level is higher than a first criterion, the vehicle function of the first vehicle being one among one or more vehicle functions of the first vehicle; and outputting the function restriction command.