Aikido’s Kiro Power brings Aikido’s software security capabilities directly into Kiro, enabling AWS customers using Kiro to automatically detect and remediate vulnerabilities, exposed secrets, and insecure infrastructure configurations as AI agents generate code. It helps teams build faster on AWS while keeping security embedded in the development workflow.

‍

Kiro provides the velocity for AI-driven software development. Aikido provides the security guardrails. Together, they deliver Secure Velocity — helping AWS customers accelerate development while maintaining security by default, without adding friction for developers.

Aikido continuously analyzes and helps secure code, infrastructure, and dependencies generated by Kiro agents, providing AWS customers with security guardrails to adopt AI-driven development safely, reduce security review bottlenecks, and build cloud-native applications on AWS with confidence.

CSPM continuously audits your cloud configurations to identify misconfigurations or risky settings in AWS, Azure, GCP, and other cloud platforms. Even small errors - like a public S3 bucket - can expose sensitive data. Aikido automates this process, flagging dangerous settings before attackers exploit them. It helps you stay secure without manually reviewing hundreds of cloud settings.

Aikido connects via read-only API to your cloud accounts and scans for risky configurations. It checks things like storage access, IAM roles, and firewall rules against best practices. Misconfigured or overly permissive settings are flagged for review. No agents are required - it works entirely from metadata and config analysis.

Examples include public S3 buckets, unencrypted databases, open SSH ports, or IAM policies granting admin to everyone. It also flags resources deployed outside allowed regions or with missing tags. Anything that could expose services or data is surfaced for review.

Aikido is fully agentless. It uses your cloud provider's APIs to read configuration data - no installs, no performance impact. You simply grant it read-only access, and it continuously monitors your setup from the outside.

You connect by creating read-only roles or credentials in AWS, Azure, or GCP. Aikido only requests minimal permissions to read configurations - it cannot change settings or access data. It's like giving a security auditor read-only access. You can revoke access anytime.

Aikido prioritizes issues based on risk and context. High-impact misconfigs in production rank higher than minor ones in dev. You won't get overwhelmed with noise - just a focused list of meaningful risks that need attention.

Aikido offers guided remediations, auto-generated fixes (e.g. Terraform), and one-click PRs for many issues. It won't change infrastructure automatically, but it helps you resolve problems quickly - with safe, developer-friendly fixes.

Unlike Wiz or Orca, Aikido offers full-stack security - from code to cloud - in one platform. You get fewer duplicate alerts, better context linking (like vulnerabilities tied to exposed resources), and developer-first features like auto-fixes. It's lighter, faster, and built to support DevSecOps teams.

Aikido supports AWS, Azure, GCP, and select others like DigitalOcean. It covers services such as EC2, S3, RDS, IAM, Kubernetes (EKS, AKS, GKE), and more. If it's a widely used cloud resource, Aikido likely scans it.

Yes. Aikido's CSPM is part of a CNAPP that includes code scanning (SAST, SCA), IaC scanning, container security, secrets detection, and more. All tools work together to give you full visibility from development to production, with unified reporting and alerts.

Yes. You can read more about custom CSPM rules here.