Raisin is a Berlin-based fintech that runs an online savings and investment marketplace, connecting more than a million customers with deposit and savings products from a network of partner banks across Europe, the UK and the US. That means handling a lot of people's money in a regulated market, which puts real weight on application security.
Raisin’s CISO and product security lead were watching AI-assisted engineering outrun a self-maintained open-source security stack. Here's why they chose Aikido to keep up, and how it fits the way the team already works.
At a glance
- Replaced a self-maintained open-source scanner stack with one platform for application and supply-chain security
- Runs Aikido inside JetBrains and VS Code, and inside developer AI assistants through MCP, so security sits in the workflow rather than beside it
- Uses reachability analysis on JavaScript and Python to cut manual triage
- Generates around 200 AutoFixes a month
- Had a code-quality rule for a new AI skills threat shipped within two weeks of asking
- Uses Aikido Safe Chain for developers in the NPM and PyPI ecosystems
- Ships to production around 50 times a day, with security keeping pace rather than blocking
Challenge
A DIY open-source stack that stopped scaling
Before Aikido, the product security team ran security on open-source scanners it maintained in-house, wired into the build pipelines as separate jobs. That worked while the engineering team was small. As the team grew and new services arrived, the jobs started to fail, and the team spent its time fixing scanners instead of acting on what they found.
“We were running a lot of open-source scanners, with separate jobs in our pipelines that we had to maintain. As we scaled and added services, those jobs started to fail, and we spent a lot of time fixing them instead of acting on what they found.”
Steeven George, Head of product security, Raisin
Triage piled on top. On SCA the team checked by hand whether a finding was reachable, or risked dropping 10 or 20 criticals per project on developers who already treated security as a blocker. Supply-chain malware was the part they had no real answer for. Attacks on the NPM and Python ecosystems had been climbing for a couple of years, and the AI boom made it cheap to churn out malicious packages. Raisin generated software bills of materials with an open-source tool and then verified each one by hand, which was its own slow job. On the malware side the team had a blind spot it could not close with the tooling it had.
Security falling behind AI-accelerated engineering
Nitesh Gaikwad, Raisin’s CISO, saw the same problem from the top. AI coding tools were speeding the engineers up, and application security wasn’t keeping pace. Older projects held issues the team had no clear way to see.
“Our engineers were speeding up, especially with AI tooling, but we weren’t catching up on the application and product security side. We needed something that could find security issues fast, inside the engineering workflow.”
Nitesh Gaikwad, CISO, Raisin
The gap showed up in the workflow too. Raisin had no IDE-integrated security, so the team leaned on CI/CD pipelines and scans, and issues only surfaced once code reached the merge stage. That slowed delivery and left no real way to shift checks earlier, which was the opposite of where Nitesh wanted security to sit.
For Nitesh the job was risk: find the gaps in projects the team had never been able to inspect, and keep critical issues out of production, without becoming the thing that slowed delivery down.
Why Raisin chose Aikido
Nitesh ran the evaluation against tools including Wiz and CrowdStrike, and against the option of staying on the in-house setup. Aikido stood out for its malware analysis on open-source packages and third-party libraries, and for covering the range in one platform rather than across disconnected tools.
“What stood out was the malware analysis on open-source packages and third-party libraries. No other tool we evaluated covered the range in one platform.”
Nitesh Gaikwad, CISO, Raisin
Breadth that wide raises an obvious worry, that a platform covering this much might not be strong in any one area. Nitesh's answer was the evaluation itself. His team ran a thorough assessment, fed back what they found, and watched Aikido act on it during the PoC, so the call rested on how the product behaved in their environment rather than on a feature list.
The product had to win developers' trust too, not just the security team's. At Raisin, platform engineering holds a green-light on new tooling, so usability was part of the test. For Steeven, the technical draw was consolidation plus reachability.
“Aikido gave us a single pane. With reachability analysis for JavaScript and Python, we triage less and there’s less friction on the SAST side.”
Steeven George, Head of product security, Raisin
Transparency was part of the pull. Steeven found the team open about where the product was heading, which made it easy to raise requirements and talk through the roadmap instead of guessing at it.
How Aikido fits the way Raisin works
Developers see Aikido findings in the editors they already use, and through the MCP integration their AI assistants can pull Aikido context directly. Security sits in the workflow instead of in a separate console developers have to remember to open.
“Aikido sits inside the IDEs our developers already use, like JetBrains and VS Code. With the MCP integration they can query Aikido and see what issues a repository has, without leaving their tools.”
Steeven George, Head of product security, Raisin
Aikido runs Raisin’s SAST, SCA, secret detection and open-source package malware scanning in one place. Developers used to push back on findings by saying a vulnerability was not reachable, and the back-and-forth cost time on both sides. With reachability analysis on JavaScript and Python in the same view, that debate goes away, since the tool already shows whether a finding touches live code.
On remediation, Aikido AutoFix generates around 200 fixes a month. Each fix carries a confidence level, and a developer reviews it before it lands. AutoTriage works alongside it. The team used to review SAST findings one by one to judge what was real. Now Aikido's AI grades them, so engineers and security spend less time deciding whether a finding is a false positive and more on the ones that matter.
“We get around 200 AutoFixes a month. Most SAST tools just hand you a recommendation. Aikido understands the context and gives a fix that’s almost ready to merge, with a confidence level, so the developer can judge it.”
Steeven George, Head of product security, Raisin
Raisin also uses Aikido Safe Chain for developers working in the NPM and PyPI ecosystems. Its CI/CD scanning, once a set of brittle open-source jobs, now runs through Aikido as a single integration.
A vendor that ships at their pace
The clearest test came from a threat that barely existed a month earlier. Raisin’s developers started pulling in external AI skills, and the team worried about malware riding in with them. No tool on the market covered it. Raisin raised it with Aikido, and a rule landed in the code-quality module in about two weeks. The team now scans for it from a central repository. Founder access in a shared Slack channel made the conversation quick, but the part Steeven points to is the turnaround, not the access.
“We were worried because external skills were arriving with malware, and no other tool covered it. Aikido had a rule in the code-quality module within about two weeks.”
Steeven George, Head of product security, Raisin
What made it land was the timing. AI skills had appeared only a month or two earlier, and nothing else on the market scanned them, so Steeven expected a long wait or a workaround. Instead the capability arrived inside the platform, as part of Aikido's own security tooling. The skills rule was just one instance of the same pattern. Steeven says that Aikido keeps shipping against new threats as they surface, Device Protection being a recent example, which is exactly what a fast-moving team like Raisin needs from a security vendor.
Raisin ships fast, and keeps getting faster. Production changes have scaled from around 10 a day to about 50. At that rate security either keeps up or becomes the bottleneck. Nitesh’s aim is to catch issues during development, in the IDE, rather than at a pipeline gate later, and that's exactly what Aikido helps with.
“We can speed the process up rather than blocking the pipeline. Most issues get identified in development, in the IDE, instead of at a pipeline-blocking stage, so we push to main much faster.”
Nitesh Gaikwad, CISO, Raisin
How Raisin is using Aikido today
Already using
- SAST and SCA
- Secrets detection
- Open-source package malware scanning
- Reachability analysis (JavaScript and Python)
- AutoFix
- AutoTriage
- CI/CD security
- Code quality module, including AI skills scanning
- IDE plugins for JetBrains and VS Code
- MCP integration for AI assistants
- Aikido Safe Chain
Planning to adopt
- Aikido Device protection, tested and lined up to roll out
- Aikido Zen Firewall, for shadow AI and prompt-injection defence
- DAST
Evaluating
Final verdict
“One of our biggest wins is that the old friction between security and developers is gone. They trust that when Aikido raises something, it’s worth their time.”
