Continuous control monitoring and a once-a-year, point-in-time pentest don't sit well together. A manual test means scoping, waiting for a slot, and holding up the audit window for the report.
Teams choose Drata to get audit-ready quickly: controls monitored continuously, evidence collected automatically. The pentest is the part that doesn't move at that speed. And it stays a snapshot: in our State of AI in Pentesting report, 76% of leaders surveyed said they deploy significant production changes weekly or faster, but only 21% validate security on every release.
Drata and Aikido are closing that gap. New Drata customers can now claim an Aikido AI Pentest, complete with verified findings, an auditor-ready report, and results that sync straight into Drata.
What Drata and Aikido now do together
Aikido runs the checks and generates the evidence behind Drata's technical controls, including SOC 2, ISO 27001, PCI DSS (Payment Card Industry Data Security Standard), DORA (the EU's Digital Operational Resilience Act), and HIPAA. Findings, and the evidence behind them, sync into Drata without anyone exporting a spreadsheet. Fix something in Aikido and the Drata side updates with it, so audit prep stops depending on someone remembering to do that the week before the audit.
That now extends to pentesting specifically. Every Drata Tier (Foundation, Advanced, and Enterprise) includes an Aikido AI Pentest worth up to $4,000 (see How to claim it for more information).
That now extends to pentesting. New Drata customers on any tier (Foundation, Advanced, or Enterprise) get up to $4,000 in free Aikido AI Pentest credits, typically enough for a standard pentest of a smaller app. Larger apps still get meaningful findings and can add credits for full coverage. The setup takes less than 20 minutes, and about a business day later you get an auditor-ready report. Here’s a sample report so you can see exactly what you’d hand to your auditor.
Why the report holds up with an auditor
A pentest is only useful if an auditor actually accepts it. Aikido's agents test the app, its APIs, and the infrastructure behind them the way a human pentester would. The difference is what happens after a finding comes in: a separate agent re-exploits it before it's reported, so what makes it into the final write-up is a working proof of concept rather than a probabilistic guess.
In the same report mentioned above, 40% of leaders said they'd feel more confident defending reproducible system evidence in an audit than a pentesting firm's reputation (26%), with a further 34% weighing both equally. Auditors increasingly want to see the work itself, rather than take someone's word for it.
(For context, an independent Doyensec benchmark found Aikido identified 58% more verified vulnerabilities than XBOW at the same price tier. Worth knowing if you're comparing pentest tools directly, though it's a product comparison rather than an audit-acceptance one.)
The fix needs proof too
An auditor doesn't just want to see that an issue was found. They want evidence it was fixed. That's where most pentesting quietly falls apart: only 40% of leaders say they retest promptly after a fix, and 42% delay because of cost or scheduling, often past the audit deadline.
Every Aikido AI Pentest through this offer includes 6 months of unlimited retesting, so a fix can be verified the same week it ships instead of waiting on the next scheduled engagement.
How to claim it
New Drata customers on a Foundation, Advanced, or Enterprise plan can claim an Aikido AI Pentest here. Redeemable within the first 3 months of your Drata plan start date, or for Drata deals currently in progress. Existing Aikido customers aren't eligible. Not a Drata customer yet? Start with a demo to learn more.
Let’s get started
Compliance evidence and security testing end up running on the same clock instead of two separate ones. If you want the fuller picture behind these numbers, our State of AI in Pentesting report has the rest of the data.
