We are seeking alpha testers for the upcoming Attack Surface Management (ASM) capability in Takumi. The alpha test is free and focuses on discovering internet-facing assets associated with your domains from publicly available information.
Takumi Runner now provides threat detection, which proactively detects threats in CI/CD pipelines. When a supply-chain incident occurs — like the ones Takumi Guard has reported on in the past — we promptly investigate the trace data collected through Takumi Runner or cicd-sensor, and immediately notify you when a threat is detected.
Takumi now integrates with cicd-sensor, an open-source eBPF runtime security sensor. You can now collect trace logs from CI/CD jobs that run outside Takumi Runner's dedicated runners, such as on GitHub-hosted runners and GitLab CI/CD, and manage them in Takumi.
cicd-sensor trace logs also work with the threat detection feature released today.
Takumi now supports graybox assessment.
Specify both your source code and the URL of the application running that code. Takumi analyzes the code to enumerate candidate vulnerabilities and attacks the running application, then reports only the ones it manages to reproduce as findings.
Takumi assessments now support applications that require multi-factor authentication (MFA) by email.
Due to express configuration, a way of creating Aurora clusters without a VPC that AWS introduced in March 2026, we identified that the managed review item "Ensure that RDS instances are deployed in a VPC" (RDS.18) provided by Flatt Security could not judge instances in this configuration correctly.
We have published a workflow that addresses this issue, so please update yours.
We are rolling out AI Penetration Testing to pre-registered customers more broadly than before.
We have also improved how accurately Takumi finds the paths that lead to a given objective, along with the safeguards that keep a test running safely.
Bot trust conditions now accept ID tokens from any identity provider that complies with OIDC Discovery, not just GitHub Actions and GitLab CI.
Self-hosted CI/CD systems such as Jenkins, Buildkite, and CircleCI, another cloud's workload identity federation, GitHub Enterprise Server, and self-managed GitLab can all sign in as a bot without a static API key.
Custom OIDC provider support is currently in beta. Specifications and behavior may change without prior notice.
In Takumi blackbox assessments, APIs that have no web UI can now be specified as an assessment target.
Instead of crawling with a web browser, Takumi extracts the endpoints to assess from the attached schema files, such as an OpenAPI specification or a GraphQL schema.
We are expanding access to AI Penetration Testing, which we began rolling out on June 15, 2026, to more customers. The feature verifies whether a given objective is achievable, from the perspective of a real attacker.
Set a target and a concrete objective — such as accessing user data — and Takumi autonomously chains reconnaissance, vulnerability discovery, and exploitation.
The feature is not yet available to all customers, so if you'd like to use it, register from the application page.
