The fully licensed bank and Bitcoin custodian added Aikido and Zen to a mature security stack, cutting vulnerability noise by 95%, reducing security investigations from hours to minutes, and gaining runtime visibility across more than 100 services.
At a glance
- 95% less vulnerability noise, reducing 5,880 initial findings to 275 relevant issues
- Hours → minutes for security investigation and analysis
- 100+ services protected by Zen across staging and production
- Nearly all code repositories scanned with Aikido
- Application-level protection for attacks that pass perimeter defenses
- Safe Chain provides a preventative gate against newly compromised packages
Challenge
For Xapo Bank, security has unusually high stakes. As both a fully licensed bank and Bitcoin custodian, Xapo protects assets where transactions can be irreversible. Members trust the bank with their savings, while institutional customers conduct extensive security due diligence before moving assets onto the platform.
For Fabio Pires, Head of Security Operations and Product Security, that makes security fundamental to the business.
"A security failure for us isn't downtime, it's someone's wealth. That's why security at Xapo isn't a department, it's the foundation the product is built on."
Unlike many organizations adopting a modern AppSec platform, Xapo wasn't starting from an immature security program. The bank had already built its own secure software development lifecycle (SSDLC) pipelines, orchestrating static application security testing (SAST), secrets scanning, software composition analysis (SCA), infrastructure-as-code and runtime analysis across independent tools. Findings were enriched with context from Xapo's vulnerability management and asset inventory, assigned owners and tied to SLAs. A pull request couldn't merge once a vulnerability breached its SLA.
At the edge, Cloudflare protected public-facing infrastructure, while internal services operated behind a zero-trust network. Xapo had even built its own deception traps and automated response systems.
Xapo's controls weren't the issue. Different scanners produced different formats and false positives to reconcile, while severity scores weren't connected to whether a finding was actually exploitable in Xapo's environment, and runtime agents could see hosts and containers, but lacked application context such as routes, payloads, data flows or expected outbound behavior.
That last blind spot became particularly important for supply-chain security.
Xapo's threat models repeatedly surfaced the same scenario: a trusted dependency gets compromised, executes inside a legitimate service and quietly exfiltrates data through a reputable third party.
Traditional perimeter controls are heavily focused on what enters an application. But in a successful supply-chain compromise, the critical signal may be what suddenly starts leaving it.
"Everything in this industry is built to inspect what comes in, but exfiltration is an outbound problem, and the only place with enough context to judge outbound traffic is the application layer itself."
Xapo wanted to address both sides of that scenario: prevent malicious dependencies from entering the environment, then assume prevention could eventually fail and detect malicious behavior at runtime.
Solution
Xapo approached Aikido as another layer in an already mature defense-in-depth strategy. Cloudflare continued protecting the edge. Aikido took over code, dependency, and container security throughout the pipeline, each run as a category-leading capability rather than just added coverage, with nearly all Xapo code repositories now scanned by Aikido tooling.
Aikido Safe Chain added a preventative gate across the organization. If a new package is compromised, Xapo doesn't have to rely exclusively on discovering that compromise after installation.
Zen, Aikido’s in-app firewall, adds the missing runtime layer inside the applications themselves.
The distinction from perimeter security was important: judging a request by what it looks like versus tracing what it actually does inside the application, following data from source to sink to determine whether a vulnerability is genuinely exploitable.
“The perimeter can only judge a request by what it looks like. Aikido’s in-app firewall Zen judges it by what it does.”
Zen also gives Xapo visibility into outbound connections at a per-service level. The team can establish what normal outbound behavior looks like and identify when a service suddenly starts communicating with a new destination, an important signal if a legitimate dependency becomes compromised.
Xapo put Aikido through a demanding proof of concept.
The security team published its own dummy malicious npm packages, sent attack payloads at Zen and documented every gap it found. What stood out wasn't simply what the product could already do, but how quickly Aikido responded when it couldn't.
Xapo had direct access to Aikido engineers through a shared Slack channel. Bugs were addressed in days or weeks, while requested capabilities were turned into contractual commitments with delivery dates.
Outbound traffic visibility and blocking was one of them. It moved from Xapo's wishlist to a contractual commitment and then into the product. Fabio describes that level of vendor responsiveness as rare.
Aikido also integrated with the security infrastructure Xapo had already built rather than forcing the team to replace it. APIs and webhooks feed findings into Xapo's vulnerability management and automation, turning findings into tickets and detections into response playbooks without manual copy-pasting.
Results
The clearest measurable impact is the amount of vulnerability noise Xapo's security team no longer needs to investigate.
Aikido refined 5,880 initial findings down to 275 relevant issues, a 95% reduction in false positives and noise.
Reachability and other contextual factors allow Aikido to determine whether findings represent meaningful risk before they reach the team. Without that context, Xapo says it would need to create its own mechanisms to establish whether affected components were actually being used and posed a risk, then manually validate the false positives those mechanisms generated.
That gives the security team more time to work on actual security problems instead of proving which findings don't matter.
Investigation speed has improved too. Analysis that previously took hours can now take just a few minutes.
Supply-chain incidents are a good example. Previously, the team would need to manually check its asset inventory and captured software bill of materials (SBOM), identify where a library was present and cross-reference whether the affected version exposed Xapo to a newly disclosed compromise.
Today, Aikido notifies the team when a library in its environment is affected, while Safe Chain adds a preventative gate in CI/CD. Xapo's core systems are built around one single programming language, but the team values knowing that Aikido is researching emerging package compromises and matching them against the reality of its own environment.
Zen has now expanded across more than 100 services in staging and production, giving Xapo per-service runtime visibility that previously didn't exist.
That additional layer proved its value during a real scanning attack against one of Xapo's services.
The first wave of malicious requests passed through the perimeter before rate limiting engaged. Zen flagged them immediately, with application context showing which service was targeted, which route was hit, the payload being used and whether the activity was actually exploitable.
What could previously have become an after-the-fact investigation through logs became a real-time, high-confidence detection.
"Aikido’s runtime context turns alerts into answers. We didn't spend hours asking 'is this real?'. We already knew."
Xapo's perimeter defenses keep handling what they always have. Zen adds a layer behind them, strengthening the architecture as a whole.
The edge continues handling volume and broad classes of attack. Zen provides another perspective from inside the application for whatever makes it through. Meanwhile, Aikido's dependency and malware intelligence and Safe Chain help reduce the likelihood of a compromised dependency reaching the application in the first place.
Detection then feeds directly into Xapo's own automation. Findings arrive with exploitability context and can trigger automated response actions. As Fabio explains, blocking a malicious user can now be an API call rather than a war room.
The result is an architecture where the application itself has become another detection layer.
Final verdict
Xapo wasn't looking for another perimeter tool. More perimeter tooling wouldn't have closed that gap. What did was context, the kind Xapo's existing controls couldn't provide.
“Aikido turned our applications from our biggest blind spot into part of our detection surface, and Zen means that anything slipping past the perimeter still has to get past a layer that understands the application itself.”
For a bank where trust is fundamental to the product, that additional layer closes an important gap between prevention and response.
