GMO Flatt Security launches AI-led surprise intrusion test for companies at 980,000 yen

GMO Internet Group announced on 21 October that it would offer companies a new service in which artificial intelligence carries out simulated, unannounced unauthorized access, Nikkei reported. The aim is to support stronger security by checking system vulnerabilities while attacks on companies continue. [ 1 ]

The service, "Unauthorized Access Surprise Test by GMO", is provided by GMO Flatt Security, the group's cybersecurity-related business, according to Impress Watch. ASCII.jp also reported that GMO Flatt Security had started offering it, describing it as a service in which AI tries to break into the whole company. The price is a flat 980,000 yen (excluding tax) for applications received by 31 December. [ 2 , 3 ]

Impress Watch said the test checks from an attacker's position whether a company can be broken into. It searches for public assets and targets all that it finds, so it covers assets the company itself does not know about. Impress Watch said the provider states that AI using various attack methods allows risk to be checked from several angles and with high accuracy. [ 3 ]

According to Impress Watch, the test differs from ordinary vulnerability checks of single applications or tests that follow a set scenario. GMO Flatt Security security engineers direct groups of AI agents, with the goals of obtaining personal and company-held information and taking control of systems, attacking from outside with no prior knowledge. The customer supplies only a list of domains that must be included. GMO Flatt Security uses those as a starting point to find public assets on the internet with attack surface management methods, and attacks all assets the customer approves. [ 3 ]

The test runs as a surprise within a 30-day period and covers the network layer through the application layer. It attempts both exploitation of known software vulnerabilities and discovery and exploitation of new ones. If a state allowing serious unauthorized access is found, a flash report is sent without waiting for the period to end. Both the flash and final reports list the assets found, whether the goal of intrusion or information theft was achieved, the chain of steps from initial entry to the goal, a system diagram showing the attack route and the information actually obtained. [ 3 ]

Impress Watch also said unauthorized access incidents in Japan have risen sharply since the start of October. It said new attacks have been reported, such as analysing public smartphone apps to extract API information and carry out improper operations, and that internal systems such as BI tools and employee management systems have also been breached. [ 3 ]