Flatt Security

Established in May 2017, GMO Flatt Security Inc. is a Tokyo-based cybersecurity firm operating with the mission to provide next-generation security for developers. The company was founded by Koki Ide, who aimed to create a globally competitive company to enhance Japan's economic strength. In February 2024, a significant milestone was achieved when GMO Internet Group acquired a 66.6% stake in the company and invested approximately ¥1 billion, integrating Flatt Security into its extensive network. This strategic partnership aims to leverage GMO's vast customer base to accelerate Flatt Security's growth and its ambition to become a global leader in product security. Following this, the company changed its name from Flatt Security Inc. to GMO Flatt Security Inc. in January 2025.

The firm specializes in product security, offering a suite of services and products designed for organizations that develop their own software and services. Its business model is centered on providing both professional services and SaaS products. Professional services include expert-led security assessments and vulnerability diagnostics for a wide range of technologies, such as web applications, IoT devices, and modern cloud architectures like AWS and GCP. This is a fee-based service where they provide customized testing plans. The company also develops and sells its own security products. One of its key offerings is "Shisho Cloud byGMO," a SaaS platform that automates application security. Shisho Cloud performs continuous application scanning (DAST) and security posture reviews (CSPM and CIEM) to help development and DevOps teams manage security at the speed of cloud development. Another product is "KENRO," a secure coding learning platform that provides hands-on exercises for developers.

GMO Flatt Security targets technology companies and enterprises with in-house development teams, assisting them in building and maintaining secure products. The company is composed of a team of security professionals, many of whom are recognized researchers and have presented findings at major cybersecurity conferences like DEF CON. Their expertise underpins the development of their automated tools and the quality of their manual assessments, creating a synergistic business model where practical consulting experience informs product development. This approach allows them to offer tailored, high-fidelity security solutions that address the specific challenges faced by modern development organizations. The firm operates with a global perspective, with English as a primary language for its development team, and aims for international expansion.

Keywords: product security, application security, AppSec, vulnerability assessment, penetration testing, security automation, SaaS, cloud security, CSPM, DAST, secure coding, developer security, GMO Internet Group, Tokyo, Koki Ide, Shisho Cloud, KENRO, cybersecurity services, DevSecOps, vulnerability diagnosis