Skip to main content

Takumi AI Penetration Tests Now Pursue Their Goals More Persistently

· 3 min read
Tsubasa Umeuchi
Tsubasa Umeuchi
Software Engineer @ GMO Flatt Security Inc.

We improved AI penetration tests so that Takumi keeps testing toward the goal more persistently.

Overview​

With this release, we revised how Takumi proceeds through a penetration test as a whole. Takumi now makes better use of what it learns during a test in its next attacks, and explores attack paths more deeply toward the goal you set.

More Persistent Exploration​

Until now, Takumi could finish a test as not achieved at an early stage, even when much of the credit threshold was left. With this release, while plenty of credits remain, Takumi more actively looks for attack paths it has not tried yet and keeps verifying them. Because it can make full use of the credits you set, it is more likely to discover attack paths and techniques that were not found before. The diagram below shows how a test proceeds before and after this change.

How a test proceeds before and after this change

As before, Takumi may still finish while credits remain when continuing is unlikely to make progress, for example when it cannot connect to the target system.

Testing Based on What Takumi Discovers and Observes​

Beyond how it uses credits, Takumi now actively records what it learns about the target system and the events it observes as the test proceeds. As a result, when the report claims that the goal was achieved, the grounds for that claim are now clearly tied to what was actually verified during the test.

What Takumi records carries over when you resume a test, or when you start a new penetration test from its results. As you repeat tests, the results of each new test build on what has already been confirmed, which makes the testing more accurate.

Credit Consumption​

Because Takumi is now less likely to end a test early without achieving the goal, a test that ends without achieving the goal may consume more credits than before. A test that achieves the goal ends as soon as it does, as before.

Note that you are never billed for more than the credit threshold you set. To keep consumption down, adjust the credit threshold when you create or resume a test.

Getting Started​

No configuration is needed. The changes apply to the penetration tests you start or resume from now on. Try a test again on a target where the goal was not achieved before.

▼ User Guide: Penetration Test