GMO Flatt Security Starts AI-Led Penetration Testing

GMO Flatt Security will launch its AI-led penetration testing service, “Unauthorized Access Surprise Test by GMO,” on October 21. Applications submitted by December 31 cost a flat ¥980,000, before tax. The company, which runs a cybersecurity business within GMO Internet Group, tests whether attackers could gain unauthorized access across an entire company.

The service searches for internet-facing assets, including assets customers may not know about. GMO Flatt Security says AI attempts entry using multiple attack methods, enabling a broad and precise assessment of risk. Unlike conventional vulnerability assessments that examine a single application or follow a predetermined scenario, this service covers the entire company.

The report says unauthorized access incidents in Japan have risen sharply since the beginning of October. Alongside attacks exploiting known vulnerabilities and configuration errors, reported incidents include analyzing public smartphone apps to identify API information and manipulate systems, as well as breaches of internal systems such as business intelligence tools and employee management systems.

During testing, the company’s security engineers direct a group of AI agents to attack from outside without prior knowledge, aiming to steal personal or corporate information and take control of systems. Customers provide a list of domains that must be included. Starting from those domains, the company uses attack surface management (ASM) to identify assets, then tests all assets approved by the customer. Unannounced tests take place within a 30-day period and attempt to exploit known software vulnerabilities or find and exploit new ones, from the network layer through the application layer.

If the company finds a condition that could allow serious unauthorized access, it sends an early alert without waiting for the testing period to end. The alert and final report include discovered assets, whether the test achieved its intrusion or information-gathering goals, the kill chain from initial entry to goal completion, a system diagram showing the attack route, and information actually obtained.

GMO Flatt Security will launch its AI-led penetration testing service, “Unauthorized Access Surprise Test by GMO,” on October 21. Applications submitted by December 31 cost a flat ¥980,000, before tax. The company, which runs a cybersecurity business within GMO Internet Group, tests whether attackers could gain unauthorized access across an entire company.

The service searches for internet-facing assets, including assets customers may not know about. GMO Flatt Security says AI attempts entry using multiple attack methods, enabling a broad and precise assessment of risk. Unlike conventional vulnerability assessments that examine a single application or follow a predetermined scenario, this service covers the entire company.

The report says unauthorized access incidents in Japan have risen sharply since the beginning of October. Alongside attacks exploiting known vulnerabilities and configuration errors, reported incidents include analyzing public smartphone apps to identify API information and manipulate systems, as well as breaches of internal systems such as business intelligence tools and employee management systems.

During testing, the company’s security engineers direct a group of AI agents to attack from outside without prior knowledge, aiming to steal personal or corporate information and take control of systems. Customers provide a list of domains that must be included. Starting from those domains, the company uses attack surface management (ASM) to identify assets, then tests all assets approved by the customer. Unannounced tests take place within a 30-day period and attempt to exploit known software vulnerabilities or find and exploit new ones, from the network layer through the application layer.

If the company finds a condition that could allow serious unauthorized access, it sends an early alert without waiting for the testing period to end. The alert and final report include discovered assets, whether the test achieved its intrusion or information-gathering goals, the kill chain from initial entry to goal completion, a system diagram showing the attack route, and information actually obtained.