An intrusion point identification device includes: a threat information collector that collects and stores threat information including identification information identifying a moving body, route information indicating a route through which the threat has intruded into the moving body, and discovery information indicating a discovery date of an attack; a vehicle log collector that collects logs, extracts, from the logs, histories of points that indicate locations of one or more moving bodies within a predetermined period, and stores the histories of the points as history information, the logs indicating points that indicate locations of the one or more moving bodies, the predetermined period being set based on the discovery information; an intrusion point identification unit that identifies an intrusion point of the threat from a first attack source through a first route among the points indicated in the history information; and an intrusion point notifier that outputs the intrusion point.