.avif)
Welcome to our blog.
Anthropic's Fever Dream: Claude's package that stole real keys
Anthropic disclosed that one of its own agents published live malware to PyPI and compromised a real third-party company in the process. I went looking, and I might have found the package it left behind.
The upgrade trap: when upgrading is the wrong answer to a CVE
"Upgrade to fix it" assumes that a fixed version exists, that it's shipped and that it won't break your app. Often none of these are true. This is the "upgrade trap," where both upgrading and not upgrading come with security risks and breaking prod. We look at what the way out looks like.
2026 State of AI in Pentesting
Our latest report captures the perspectives of 400 CISOs, CTOs, and senior engineering leaders across Europe and the US. It explores how AI is changing penetration testing, why traditional approaches are struggling to keep pace with modern software delivery, and what security leaders want from the next generation of penetration testing.
Vulnerabilities & Threats
Cut through the noise with real-world CVE breakdowns, malware analysis, exploits, and emerging risks.
Customer Stories
See how teams like yours are using Aikido to simplify security and ship with confidence.
Automate compliance with SprintoGRC x Aikido
Automate compliance with Aikido and SprintoGRC. Set up the integration today to put technical vulnerability management on autopilot.
Why we’re stoked to partner with Laravel
TL;DR Laravel helps PHP developers create their best work, now Aikido helps to secure it. Read all about becoming Laravel's preferred AppSec provider.
110,000 sites affected by the Polyfill supply chain attack
A critical supply chain attack has compromised over 110,000 websites via cdn.polyfill.io—remove it immedaitely to protect user data and app integrity.
Cybersecurity Essentials for LegalTech Companies
LegalTech companies handle vast amounts of sensitive client data, making robust cybersecurity frameworks essential. Experts from Aikido Security, Amberlo, and Henchman emphasize the need for secure coding practices, compliance with industry standards like ISO 27001 and SOC 2, and continuous monitoring through innovative methods like bug bounty programs. As cyber threats evolve, so must the strategies to protect valuable legal data.
Drata Integration - How to Automate Technical Vulnerability Management
How to become compliant without imposing a heavy workload on your dev team: Aikido and Drata integration automates technical vulnerability management. You'll better prepare for SOC 2 and ISO 27001:2022 while reducing false positives and saving time and money.
DIY guide: ‘Build vs buy’ your OSS code scanning and app security toolkit
Yes, you can enhance your app security posture by patching together open-source code and container scanning tools—if you can handle the infrastructure.
SOC 2 certification: 5 things we learned
What we learned about SOC 2 during our audit. ISO 27001 vs. SOC 2, why Type 2 makes sense, and how SOC 2 certification is essential for US customers.
How Aikido Intel detects malware and vulnerabilities first
Aikido Intel is a real-time feed that catches malware and undisclosed vulnerabilities across open-source ecosystems, often within 8 minutes of release.
Anthropic's Fever Dream: Claude's package that stole real keys
Anthropic disclosed an agent that pushed real malware to PyPI. We think we found the package, and every mistake in it points back to the AI.
5 Socket security alternatives and why they are better
Socket built its name on malware detection. But detection speed alone is no longer the whole story. Here's how Aikido and four other alternatives compare on supply chain security, reachability analysis, licensing, and more.
AI Pentesting Buyer's Guide: How to evaluate AI pentesting vendors
Learn how to evaluate AI pentesting vendors with practical buying criteria, research from 1,000+ AI pentests, and a downloadable evaluation checklist.
A practical CTO security checklist to be Mythos-ready
A practical checklist for SaaS CTOs navigating a world with Mythos and agentic AI threats. Built around the defender's advantage: you have context attackers have to work to get. Covers the controls, practices, and operational habits that determine whether your team finds and fixes issues before someone else does.
Get secure now
Secure your code, cloud, and runtime in one central system.
Find and fix vulnerabilities fast automatically.
