Assumed-Breach Tests
The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.
Real attacks often begin with a single workstation compromised through a targeted phishing email or a malicious package, and spread inward from there. With an assumed-breach test, you can treat a machine in your environment as compromised and run Takumi's AI penetration testing through it. Run the connection program, takumigateway, on a machine that can reach the systems you want to test, and Takumi uses it to autonomously explore attack paths and determine whether the objective you set can be achieved.
Systems such as internal admin consoles and APIs reachable only from a private network can be tested just like your internet-facing systems. The diagram below shows how it works.
In the console, the connection program is registered and managed as a gateway.
What Takumi Can Do
On the starting machine, Takumi runs commands just as an attacker would. It investigates the internal network and any credentials left on the machine, and attempts to attack the systems reachable from there.
On Windows and macOS, you can also enable desktop control. Takumi then reads the screen while operating the browser and other applications, and tests attack paths that commands alone cannot reach.
How It Connects
The connection program opens no listening port and accepts no incoming connections. It connects to Takumi only through outbound HTTPS (port 443) from the starting machine, runs the commands it receives on that machine, and sends the results back. No inbound port has to be opened on your side.
How Commands Are Checked
Commands run on the starting machine go through the same safety checks as in any penetration test. Before running a command, Takumi checks it against the rules you define, the scope, and the destructive actions policy, and stops it if it violates any of them. Desktop control actions are checked the same way before they run. See Command Execution Rules.
Next Steps
See Installation to download the connection program, then Start an Assumed-Breach Test to register a gateway and run a test.