Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing)

What it does

Takumi byGMO is GMO Flatt Security's 'security AI agent' (セキュリティAIエージェント). Its product page says Takumi uses AI agents for vulnerability detection and fixing: continuously running AI diagnosis (AI-SAST/AI-DAST) that the vendor says detects logic flaws and authentication/authorisation gaps at senior-security-engineer level in hours to about a day per run; automatic fixes, where Takumi submits the fix as a pull request with unit tests and a report; and AI penetration testing, where 'AI actually attempts intrusion' to show realistic damage and which vulnerabilities to fix. The same subscription includes developer-malware protections (Takumi Guard blocks malicious packages before install; Takumi Runner records CI/CD traces). Takumi Images is in beta and not part of this listing. The vendor says it is used by 300+ organisations, with testimonials from Nikkei, freee and Findy. Data is processed in Japan by default and not used for LLM training (LLM inference excepted unless a paid domestic-inference option is bought). The company holds ISMS certification covering Takumi operations (vendor claim). Pricing is published.

Frameworks (vendor-stated)

No framework tags yet.

Vendor-claimed ISO 27001 (ISMS certification, vendor claim)

Pricing (as published)

Published on flatt.tech/takumi: base fee JPY 70,000/month (excl. tax) including 250 credits shared across diagnosis, auto-fix and AI pentest, 15 Takumi Guard users and Runner minutes; overage JPY 280 per credit; a 30-day AI penetration test offer at JPY 980,000 (excl. tax, through end of 2026).

Tasks

appsecsastremediationpr reviewpen test managementvulnerability management

Sources

1. flatt.tech/takumi (primary)
2. flatt.tech/

Last verified 20 Oct 2026. Framework tags indicate relevance, not certification; “vendor-claimed” items are as marketed by the vendor. Spotted an error? Submit a correction or email [email protected]. See our methodology.

Use-case comparisons

• AI code security agents — 33 verified listings (Application security scanning, suggested or automated code fixes, and pull-request security review)
• Agentic pentesting AI agents — 33 verified listings (Autonomous or AI-assisted penetration testing, attack-surface testing and exploitable-path verification)

Compare Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing) with

• 
  Aikido AI AutoFix vs Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing)
• 
  AISLE (autonomous vulnerability discovery, triage and verified-fix agents) vs Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing)
• 
  Amazon Q Developer security scanning vs Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing)
• 
  Amnify security agents (agent-driven code audit, AI pentesting, PR review and autofix pull requests) vs Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing)
• 
  Black Duck Signal (agentic AI AppSec) vs Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing)
• 
  Checkmarx One Assist vs Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing)
• 
  Claude Code security review vs Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing)
• 
  Codacy AI Reviewer vs Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing)
• 
  Contrast AI SmartFix (agentic vulnerability remediation) vs Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing)
• 
  Cursor Bugbot vs Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing)

Alternatives

• 
  Aikido AI AutoFix — Aikido AutoFix turns SAST, SCA, IaC, container, pentest and AI code-audit findings into reviewable pull requests or IDE patches. Vendor is Belgium-founded with a Ghent European HQ.
• 
  AISLE (autonomous vulnerability discovery, triage and verified-fix agents) — Prague-headquartered AI code-security platform in which thousands of agents analyse a codebase in parallel for exploitable vulnerabilities, fix agents write patches, and agentic verification builds the repo and runs tests before opening a pull request for human merge. October 2026 added agent-driven proof of exploitability against running web apps and APIs. Cohere signed a letter of intent to acquire AISLE on Oct 15, 2026.
• 
  Amazon Q Developer security scanning — Amazon Q Developer code reviews that scan for SAST issues, secrets, IaC misconfigurations, quality issues, deployment risks and SCA, with some in-IDE suggested fixes.
• 
  Amnify security agents (agent-driven code audit, AI pentesting, PR review and autofix pull requests) — German AppSec product from Düsseldorf: a team of agents audits repositories (SAST, secrets, SCA, IaC, CI/CD) and cloud accounts, triages signals so only confirmed findings surface, pentests running apps inside a verified scope with a separate agent reproducing every finding, reviews pull requests with a merge-blocking status check, and opens fix pull requests that run your tests but never merge themselves.
• 
  Black Duck Signal (agentic AI AppSec) — Agentic AI application security tool (GA March 2026) with role- and task-based agents that analyse new code in any language, filter findings by exploitability and apply verified fixes, callable from Claude Code, Gemini and GitHub Copilot via MCP.
• 
  Checkmarx One Assist — Family of agentic AppSec agents on Checkmarx One (Developer Assist in the IDE, plus triage/remediation). Checkmarx Ltd’s registered office is Ramat Gan, Israel.

See all Takumi byGMO security AI agent alternatives →

FAQ (from this dataset)

What does Takumi byGMO security AI agent do?

Japanese security AI agent that continuously finds vulnerabilities with AI-SAST and AI-DAST (including logic, authentication and authorisation flaws), generates fix patches and opens pull requests with unit tests, and runs AI penetration tests that actually attempt intrusion to prove exploitability.

How much does Takumi byGMO security AI agent cost?

Published on flatt.tech/takumi: base fee JPY 70,000/month (excl. tax) including 250 credits shared across diagnosis, auto-fix and AI pentest, 15 Takumi Guard users and Runner minutes; overage JPY 280 per credit; a 30-day AI penetration test offer at JPY 980,000 (excl. tax, through end of 2026).

Where is GMO Flatt Security (GMO Flatt Security株式会社) headquartered?

Japan

What are alternatives to Takumi byGMO security AI agent?

See the Takumi byGMO security AI agent alternatives page for category-sharing listings in relevance order, not a ranking. Takumi byGMO security AI agent alternatives.

Stay updated