At a glance
- Aikido replaced a stack of open source security tools that buried the team in false positives
- Developers now treat Aikido's findings as a working list of real problems to fix
- One-click AutoFix pull requests reach the working branch in minutes, through Codafication's own review pipeline
- When a client asked for attestation during a supply chain attack, an Aikido dashboard link had the answer ready
An open-source stack had turned security into a volume problem
Codafication, the Brisbane insurance software company, secures the code behind its claims platform with Aikido, after replacing a stack of open source security tools its own engineers had put together.
Curtis Wilkinson, CTO, oversees every technology function at Codafication, from security staff and cloud infrastructure to QA, engineering, and product. Founded in 2015, Codafication builds claims software that most of Australia's major insurers use to manage repairs on property and contents claims. Its main product runs on 70 to 80 separate components.
Before Aikido, the team ran container checks in its CI/CD pipeline, a SAST tool, and SBOM generation feeding an open source tracker. The setup worked exactly as configured, but the manual work behind it had become too much to keep up with. False positives arrived in volume, with no deduplication, grouping, automatic triage, or reachability analysis to filter them.
"It'd flag something and you'd be like, what even is that? You'd Google it and it'd be some weird Adobe thing from 1925. You were almost surprised to find an actual problem."
Confirming a single real issue meant checking by hand whether the code even used the affected function. None of it connected to Jira, where the team works from, so every ticket meant copy-pasting and updating in two places. Every improvement would have cost engineering time on top.
"Our job as a company isn't to build our own security management platform across our entire stack."
A findings list the team actually fixes
Aikido now feeds Codafication's ongoing remediation program, and the first thing it changed was the findings list. Deduplication and issue grouping collapse findings across all of the product's components into one view that shows every place an issue lives and which team should fix it.
The team also ran Aikido's AI Code Security Audit, part of AI Code Analysis, across most of the code behind its platform. The run took 14 hours, and the team has yet to find a false positive in its results. That made the findings easy to act on: they went straight to the top of the remediation roadmap, and developers fixed and merged 39 of them in about six weeks. Curtis gave the developers access and asked for their read.
"The comment was: wow, this is legit stuff. Everything on here should be treated as a problem we need to solve instead of a list of probably useless stuff."
Around three in four AutoFix pull requests merge without a single change from the team. Aikido raises the pull request, Codafication's own review agents assess it, and it goes to final merge approval, usually reaching the working branch in under 10 minutes. Curtis felt the difference when the first wave of AutoFix pull requests came in and he worked through a list himself. Each fix would have taken him half an hour to two hours by hand.
"It just got reduced to a button click."
With the Jira integration, ticket status now lives in one place. Curtis can scroll the list and see which developer owns each fix and which tester picked it up, and security fixes show up in sprint reports. Whenever questions came up while setting all of this up, the team took them straight to Aikido's technical staff in a shared channel.
"They were super helpful and very collaborative. There wasn't any ball passing. The people who could actually fix things were right there in the channel."
Why Codafication chose Aikido
- A strong first experience with Aikido Safe Chain, the free tool that blocks malicious open source packages before they install, and the starting point for Aikido's Device Protection. It's the tool the team rolled out to every developer device as npm supply chain attacks hit the ecosystem one after another
- Aikido's threat research, which already showed up among the sources the team used for its own threat intelligence
- A proof of concept that let the team explore the features and pick which ones to turn on first
"We'd had a good experience with Safe Chain, and we knew Aikido was a good company. It just made sense to come and see what they offered."
Aikido had the answer before the client asked
Codafication's clients work in a regulated industry with very low risk tolerance. Because of that, they watch supply chain attacks closely. When a major one hits, the emails and phone calls start.
During one recent attack, Curtis was traveling for work. Aikido's account team posted a dashboard link in the shared channel. One look showed a green tick: Codafication wasn't affected. Within half an hour, a client emailed asking Codafication to attest that its production system wasn't impacted.
"It was made a lot easier to just say yes."
Before Aikido, Curtis would have waited for the next scheduled check to run, a couple of hours depending on timing, before he could answer. This time, he had the answer before the client even asked.
How Codafication uses Aikido today
"We're lighting up different parts of Aikido as we go. A lot of it is replacing hand-rolled stuff, but some of it is just new capabilities."
- Pull request checks as the primary security gate for internal tooling, automation, and infrastructure repositories
- AutoFix and proactive branch checks on the main product repositories
- AI Code Security Audit, run across most of the code behind the claims platform
- Code quality checks, plus code coverage tracking
- Jira integration feeding sprint engineering reporting
- Domain monitoring, whose first findings matched two known issues from the last external pentest report
- Next: container repository access, and an AI pentest against the same scope as their twice-yearly external pentest to compare results
Final verdict
"We've always had tools that cover one specific part. Nothing had all of it together in a way that made it manageable and let you see whether we're on top of things."
