Now Available: November 12, 2025
Offensive Web Security,
Fully-Autonomous.
Takumi, the AI agent, starts to delivers human-level blackbox/graybox pentesting.
High-quality assessments with just a URL, no source code required.
With source code, unlock even higher detection rates and lower noise.
Our Commitment
Stay ahead of attackers.
Discover and defend what matters.
With our mission of “We are the backbone of engineers,” we see identifying, fixing, and defending against vulnerabilities ahead of threats as essential actions.
From our earliest days, we have proactively contributed to the discovery and remediation of vulnerabilities in widely used software across society.
In the services we provide to our customers as well, we have strived to uncover every critical vulnerability. Thanks to the efforts and expertise of our security engineers, we have reported numerous vulnerabilities that are difficult to detect with conventional vulnerability scanners available on the market.
Now Available: November 12, 2025
Takumi Rolls Out
AI-Native Blackbox/Graybox
Web Pentesting Feature
Blackbox Pentesting.
High vulnerability coverage.
Even logic flaws.
With just a URL or testing constraints—no source code required—you can run assessments covering common perspectives like the OWASP Top 10. When applicable, it can serve as a replacement for conventional low-cost vulnerability scans or DAST tools.
(1) Takumi's blackbox mode
Capable of operating a browser, enabling verification of vulnerabilities that require in-browser checks such as DOM-Based XSS.
Generates and executes attack code, making it possible to test issues involving manipulation at the HTTP level, such as Request Smuggling.
Incorporates LLMs in parts of the process, allowing detection of vulnerabilities that require natural language interpretation (e.g., exposure of registration status on a login screen).
Graybox Pentesting.
Higher vulnerability coverage,
but still Validated.
When integrated with source code platforms such as GitHub, Takumi combines two types of testing. This enables highly accurate detection of complex vulnerabilities that are difficult to discover externally, as well as precise evaluation of whether issues identified in the code are truly reproducible and pose real risks.
(2) Takumi's graybox mode
Largely functions as an agentic workflow, integrating both white-box and black-box approaches.
By using the black-box engine as a validator, it enables evaluation of actual exploitability and reproducibility.
Background Story
Takumi Cloned Our Human Researchers with 100+ Public CVEs.
Our team has improved global software security by reporting vulnerabilities in widely used applications. These real-world experiences helped shape Takumi into a practical, production-ready cybersecurity AI agent.
Visit Our Research Blog
Now Available: November 12, 2025
Want to hire the new Takumi?