At a glance
- A single security engineer covers 50 developers shipping 70 to 80 times a day
- More than 80 percent of new code at Omnea is AI-generated
- Chose Aikido over Snyk after a six-week Snyk proof-of-concept trial
- Adopted Aikido as Omnea's first dedicated AppSec tool, with no prior tooling to replace
- Aikido sits quietly in the developer workflow about 90 percent of the time
- Low false positives mean a single engineer can trust and action every alert
- SOC 2 evidence flows into Vanta, and license reports cover investor diligence on demand
- Piloting AI pentesting and planning to roll out device protection
Challenge
Omnea is an AI-native procurement company whose customers include global enterprises like Spotify, MongoDB and Monzo. It serves them from a team that hires aggressively and ships continuously. When the team first adopted Aikido, it was 14 developers and growing fast. Security had to scale with engineering without becoming a release blocker, and it had to stand up to enterprise procurement reviews at the same time.
"When we first came to Aikido we needed a security tool that could scale with us. We were 14 developers at the time and growing rapidly. We needed something that would let us stay secure and ship to enterprise customers, without becoming a blocker."
Solution
Aikido covered a broad AppSec surface under one platform, and it earned developer adoption by staying quiet. It only interrupts engineers when there is something real to look at.
"Our developers use Aikido every single day, but it isn't a major blocker. Ninety percent of the time it sits quietly in the background. Half the time most developers forget it's there. It only pulls them in when something is real."
Omnea connected Aikido to the tools its engineering and security functions already used: GitHub, Linear and Vanta. The Vanta integration reshaped how the team handles SOC 2 audits.
"We've integrated Aikido into GitHub, Linear, and Vanta. With Vanta, our SOC 2 tool, Aikido gives auditors evidence right out of the box, no going back and pulling specific issues."
AI-generated code is now the norm at Omnea rather than the exception. That changes how fast the codebase moves, and what a security tool has to keep up with.
"Eighty-plus percent of our code nowadays is AI-generated. Having a tool that's checking what we're doing, as things shift and move so quickly, is really important."
Why Omnea chose Aikido
Omnea weighed Aikido against Snyk and a few incumbents. What decided it was how easy Aikido was to work with from the start: transparent pricing, broad coverage out of the box, and a team that shipped feature requests in days.
"It was just clear from the beginning how much easier Aikido was to work with. Transparent pricing, more out of the box, and a team that responded. It made it a clear and easy choice."
The contrast with the Snyk evaluation was easy to see. A six-week trial there made the difference in responsiveness plain, where Aikido turned feedback around the next day.
- Transparent pricing with no enforced multi-week evaluation cycle
- Broad out-of-the-box coverage beyond a standalone SCA tool, including SAST, SCA, and AutoFix
- A team that responds to feature requests in days, not quarters
- Native integrations into GitHub, Linear, and Vanta
- A platform built for the velocity of an AI-native engineering team
Results
Security that keeps pace without extra headcount
With Aikido, Omnea runs a ratio that would be hard to sustain with a noisier or more manual tool: one security engineer covering fifty developers. The ratio holds because Aikido covers code, cloud and dependencies in one place and keeps the noise down, so a single engineer can see the whole surface and trust what it flags.
"Aikido has enabled us to ship to enterprise customers while still maintaining a high security posture. We're shipping to production 70 to 80 times a day. We have one security engineer for 50 developers, and they manage the full workload because Aikido does the heavy lifting."
Alerts the team can trust
A lean security function only works if every alert is worth acting on. At Omnea the absence of false-positive noise is what lets one engineer keep up, and it is why developers take the tool seriously when it does speak up.
"Developers trust that when Aikido raises an issue, the issue is real. Not having all the noise and false positives means when you look at something, you know there's a real problem to fix."
Supply-chain risk, now visible
Aikido surfaces the volume of supply-chain risk moving through Omnea's dependencies, in one place rather than scattered across registries. In one recent three-month window that came to seven times more supply-chain vulnerabilities than the prior quarter, all of it visible to the team.
"It's so easy for developers to install a vulnerable or compromised package, having something block what's being installed is really valuable."
Security that pays off in the diligence room
For a company raising capital, Aikido paid off somewhere Omnea didn't expect. When investors asked for evidence of a mature security posture, the answer was already generated and waiting.
"Aikido has even helped us with investor due diligence. A report on every license type, instantly generated. We didn't even know we had it until our investors asked, and it solved the problem instantly."
It also changed how investors read the company. Being able to show, on demand, that security was handled took a whole line of questioning off the table before it started.
"When you're raising, investors want to see you're mature across the board on security. With Aikido there were no concerns from the start. We could say we're on top of it and proactive about our posture."
The same evidence trail serves the team's SOC 2 audits, where Aikido hands auditors proof of remediation inside SLA without anyone pulling issues by hand.
How Omnea is expanding its use of Aikido
Already using
- SAST and SCA scanning
- AutoFix
- Vanta integration for SOC 2 evidence
- License reporting
- Aikido Safe Chain
Piloting
- AI pentesting, with initial runs done and a continuous launch planned
"Before, we'd just have an annual pentest once a year, often more of a checkbox than anything else. With AI pentesting we can find problems as soon as we release them. We can fix them before someone finds it."
Planning to adopt
- Device protection
Evaluating next
- Aikido Zen Firewall, as a possible replacement for AWS WAF for outbound and learning-based rules
Final verdict
"For us, the main impact of Aikido is that we can stay continuously secure while shipping at lightning-fast speed."
