At a glance
- No gap in scanning coverage during the switch from previous providers and tools
- Used reachability analysis to narrow tens of thousands of findings to the few that matter
- Rated Aikido's accuracy higher than the previous tool during the proof of concept
- Kept a bulletproof audit trail for auditors and regulators through the migration
- Put a single, clear ticket in front of each developer instead of a queue of raw findings
- Works with the Aikido team directly over Slack, with same-day fixes and fast responses
Cutting through a floodgate of findings
Revolut is a global fintech, founded in 2015 and headquartered in London, that now operates in 40 countries and adds new products every quarter. Its engineering organisation runs to more than 2,500 developers, and securing something that moves that fast, across the application layer, cloud, network and AI, is a moving target.
Arsalan Ghazi is Head of Application Security at Revolut, where the job is to protect customer data across all of it. He describes the core problem in software composition analysis in one line.
"SCA is a floodgate of findings. There are hundreds of thousands every day, every week, and with AI helping researchers find more in open source, the numbers are multiplying like they never have before."
The hard part is not finding vulnerabilities. It is knowing which ones matter.
The challenge
A floodgate that keeps widening
SCA produces findings at a volume no team can triage by hand, and AI is accelerating it as researchers surface more issues in open source. Without a way to separate the exploitable from the noise, a security team spends its time sorting rather than fixing.
A migration a regulated bank cannot get wrong
Revolut was already running an SCA tool, so moving to Aikido meant a full vendor switch, not a greenfield setup. For a regulated fintech that means rebuilding in-house automations, updating documentation, and proving to auditors and regulators that scanning coverage never lapsed.
Why Revolut chose Aikido
Reachability that points to the real work
What stood out in the proof of concept was reachability analysis: finding the vulnerabilities that actually reach into Revolut's transitive libraries, so the team knows which findings to prioritise.
"Reachability analysis finds the actual vulnerabilities in the transitive libraries. Out of something like 10,000 issues, we know which ones to prioritise and which ones the business needs to focus on and fix."
Better accuracy than the previous tool
Running the proof of concept against real repositories, the team rated Aikido's accuracy higher than the tool they were already using.
"In the proof of concept, the accuracy was better than the tool we were already using."
A team that works like part of yours
The support relationship stood out as much as the product.
"There are cases where we raise an issue and they fix it the same day. It is direct communication over Slack, someone acknowledges and responds within 15 minutes. We don't see Aikido as a third party, we see them as part of our own team."
How developers see only what matters
Revolut does not leave adoption to individual developers. Application security owns the rollout across every service, does the triage, and decides which issues out of the thousands surfaced actually need fixing. Developers never log into a queue to hunt for their work. They receive a single ticket in Revolut's vulnerability management system, with a link to Aikido, the relevant CVE, and the version they need to move to.
"Our developers only receive a ticket assigned to them, with a link to Aikido, the CVE information, and which version they need to update. The feedback is positive. They find what they need on the ticket and just get on with fixing it."
That control extends to how Revolut handles new package versions. As a hedge against a fresh release turning out to be compromised, the team's own policy tells developers to wait five days before moving a recommended version into production.
Moving off previous vendors without a gap
The difference the switch had to protect was continuity: a consistent scope of SCA scanning across the repositories, with no window where the team could not find issues.
"Replacing a vendor is not easy. You have to rebuild automations, update documentation, and give your auditors and regulators a full audit trail. Once we signed, onboarding Aikido was straightforward and quick."
The migration was not the only consolidation. Revolut had built its own DAST tool in-house, in keeping with a preference for building where they can, but it carried a heavy maintenance and manual load. They replaced it with Aikido once they saw it worked without that overhead.
"At Revolut we build things in-house wherever we can, so we had our own DAST tool. It needed a lot of maintenance and manual effort. We replaced it with Aikido because it just worked out of the box."
Where Revolut goes next
Revolut currently uses Aikido for software composition analysis with reachability analysis, and for dynamic application security testing (DAST).
The team is looking at runtime protection with Zen to close a gap Arsalan describes plainly.
"We follow shift left, but there is nothing protecting on the right side. We want something protecting at runtime for things like zero-days, where updating a library takes time."
Device protection is being trialled to address supply-chain risk on developer machines, where compromised packages and workstations are a growing concern. AI pentesting is on the roadmap for a future quarter, with an early trial run still being validated. The goal Arsalan set his team is to find more issues internally than external programs do, shifting the balance further in-house and catching problems earlier in the development cycle.
On static analysis, Revolut built its own capability in-house. A third-party SAST tool it tried years ago struggled to surface real critical vulnerabilities, so the team wrote its own rules, seeded from bug bounty and pentest findings, to scan the full codebase and every new pull request. What they are watching now is whether Aikido's analysis catches issues their rule-based system does not.
"We are keeping an eye on what Aikido finds. A few recent findings were not simple rule-based ones, they use an LLM for SAST, and that is currently what we are missing."
Final verdict
Arsalan's read on the partnership is what he returns to.
"They are helping us protect our code and our data, and helping us mature the tool based on what we're seeing and what we think would work. That is the best point for me."
