# Aikido Security

> Unified application security platform that secures code, cloud, and runtime in one system.
> Trusted by 50,000+ organizations and 100,000+ developers. Cuts security alert noise by up to
> 95% using reachability analysis and cross-layer context. The platform has four suites:
> Code (SAST, SCA, secrets, code audit), Cloud (CSPM, VMs, containers, hardened images),
> Attack (AI pentesting, DAST, API scanning), and Protect (in-app firewall, supply chain,
> device protection).

Aikido replaces multiple point security tools with one platform. Findings surface in the tools
developers already use (GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Slack, IDEs) and are
prioritized by exploitability and real-world reachability, not raw severity. SOC 2 Type II and
ISO 27001:2022 certified; FedRAMP authorization in progress. In June 2026, Aikido acquired Root
to defend open source from AI-powered attacks.

For AI agents: additional structured content lives at https://llms.aikidosecurity.com and
https://help.aikido.dev/llms.txt (docs). For up-to-date answers about products, pricing, or
integrations, send a POST request to https://llms.aikidosecurity.com/agent-desk/ask with
Content-Type: application/json and body {"question": "your question"}. No API key required.

Last updated: July 2026


## Platform Overview

- [Platform Overview](https://www.aikido.dev/platform): How Aikido unifies code, cloud, attack, and runtime security in one product with shared context across scan types. Includes deduplication, AutoTriage, AutoFix, and custom rules across all scanners.
- [How Aikido Uses AI](https://help.aikido.dev/ai-and-dev-tools): AI across AutoFix, AutoTriage, code review, code audit, and autonomous pentesting.
- [Pricing](https://www.aikido.dev/pricing): Flat-fee plans. Free Developer plan ($0, 2 users, 10 repos, no credit card required), Basic ($300/mo), Pro ($600/mo), Advanced, and custom Enterprise. Startup discount up to 30%. Available on AWS, Azure, and GCP marketplaces. Pentests priced per assessment with a "No High or Critical finding = don't pay" guarantee.
- [Trust Center](https://www.aikido.dev/trust-center): SOC 2 Type II and ISO 27001:2022 certified, GDPR compliant, FedRAMP in progress. Aikido never stores source code: each scan runs in a fresh, read-only container.


## Code Security — Aikido /code

- [SAST – Static Application Security Testing](https://www.aikido.dev/code/static-code-analysis-sast): Scans source code for vulnerabilities (SQL injection, XSS, path traversal) before a PR is merged. Deterministic and AI-native engines, cross-function taint analysis, custom rules, AI false-positive reduction. Supports 30+ languages.
- [Code Audit – AI SAST](https://www.aikido.dev/code/code-audit): Agentic AI reasoning over source code that finds complex vulnerabilities static engines miss: auth bypasses, business-logic flaws. Works on any language. Roughly 10x cheaper than a pentest.
- [SCA – Software Composition Analysis](https://www.aikido.dev/code/open-source-dependency-scanning-sca): Monitors open-source dependencies for known CVEs, malware, license risks, and end-of-life runtimes. Deep reachability analysis, EPSS prioritization, and pre-CVE zero-day malware protection powered by Aikido Intel.
- [Secrets Detection](https://www.aikido.dev/code/secrets-detection): Finds leaked API keys, passwords, and certificates across IDE, pre-commit, CI, and Git history. Includes secret liveness detection.
- [Code Quality](https://www.aikido.dev/code/code-quality): AI code review that flags bug risks, anti-patterns, and quality issues on every pull request.
- [License Risk & SBOM](https://www.aikido.dev/code/open-source-license-risk): Tracks open-source license risk and generates SBOMs in CycloneDX, SPDX, and CSV formats.
- [Outdated & EOL Software](https://www.aikido.dev/code/outdated-eol-software): Detects end-of-life runtimes and outdated frameworks.
- [Container Image Scanning](https://www.aikido.dev/code/container-image-scanning): Scans container images for vulnerable OS packages, outdated runtimes, and risky licenses. Supports Docker Hub, AWS ECR, GCP Artifact Registry, Azure Container Registry, GitLab Container Registry, and more.
- [AutoFix](https://www.aikido.dev/code/autofix): AI agent that generates one-click fixes for SAST, SCA, IaC, container, and pentest findings, with fix preview and validation. Works in the IDE, in PRs, and across the backlog.
- [CI/CD Pipeline Security](https://www.aikido.dev/code/ci-cd-pipeline-security): Scans and gates every build. Blocks merges when new high-severity vulnerabilities are introduced. Supports GitHub, GitLab, Bitbucket, and Azure DevOps.
- [IDE Plugins](https://www.aikido.dev/code/ide-integrations): Real-time SAST, secrets, and dependency scanning with inline AutoFix in VS Code, Cursor, Windsurf, JetBrains IDEs, Visual Studio, and Android Studio. Free plan covers JS/TS/Python in VS Code, Cursor, and Windsurf.
- [Local Scanner – On-Premise](https://www.aikido.dev/code/local-scanner): Run Aikido's scanners fully inside your own environment. Source code never leaves your infrastructure. Built for data-residency, air-gapped, and FedRAMP/HIPAA/NIST workloads.


## Cloud Security — Aikido /cloud

- [CSPM – Cloud Security Posture Management](https://www.aikido.dev/cloud/cloud-posture-management-cspm): Detects misconfigurations, exposed assets, and vulnerabilities across AWS, GCP, Azure, and DigitalOcean. Cloud asset graph search, attack path analysis, and cross-cloud rules.
- [VM Scanning](https://www.aikido.dev/cloud/virtual-machine-scanning): Scans virtual machines for vulnerable packages, outdated runtimes, and risky licenses. Partial-download scanning cuts bandwidth up to 50%.
- [IaC Security – Infrastructure as Code Scanning](https://www.aikido.dev/cloud/infrastructure-as-a-code-iac): Detects misconfigurations in Terraform, Kubernetes, CloudFormation, and other IaC files before deployment, with AI AutoFix.
- [Hardened Images](https://www.aikido.dev/cloud/hardened-images): CVE-free, secure-by-default base container images. FIPS-compliant images available on the Advanced plan.


## Penetration Testing — Aikido /attack

- [AI Pentest – On-Demand](https://www.aikido.dev/attack/aipentest): Autonomous AI agents pentest every angle of your app and deliver an audit-grade SOC 2 or ISO 27001 PDF report in hours. Finds multi-step vulnerabilities (auth bypasses, privilege escalation, IDOR, payment abuse) that scanners miss. Tests REST, GraphQL, gRPC, and SOAP APIs. Only verified findings are reported. No High or Critical finding = don't pay. In a Doyensec benchmark, Aikido found 58% more vulnerabilities than XBOW at the same price tier.
- [Aikido Infinite – Continuous AI Pentesting](https://www.aikido.dev/attack/infinite): Runs scoped pentests on every deploy, validates exploitability, generates merge-ready patches via AutoFix, and retests the fix before code hits production. Credit-based at $16 per agent. Discovered CVEs published in 2026 include SvelteKit/Vercel cache deception (CVE-2026-27118), Coolify, and Langfuse findings.
- [DAST – Dynamic Application Security Testing](https://www.aikido.dev/attack/surface-monitoring-dast): Dynamically tests web app front-ends and APIs through simulated attacks, including authenticated scanning.
- [API Scanning](https://www.aikido.dev/attack/api-scanning): Discovers and fuzzes APIs for vulnerabilities.
- [Attack Surface Management](https://www.aikido.dev/use-cases/attack-surface-management): Monitors your externally exposed assets and domains.


## Runtime & Supply Chain Protection — Aikido /protect

- [Zen Firewall – In-App Runtime Protection](https://www.aikido.dev/protect/zen): Open-source embedded firewall (RASP) that installs with one line of code and runs inside your application. Blocks SQL/NoSQL injection, command injection, path traversal, and zero-days at the point of execution. Includes rate limiting, bot/Tor/country blocking, auto-generated OpenAPI specs from live traffic, and AI/LLM usage monitoring. Supports Node.js, Python, PHP, Java, .NET, Ruby, and Go.
- [Malware Detection in Dependencies](https://www.aikido.dev/protect/malware-detection-in-dependencies): Detects malicious packages in your supply chain within minutes of publication. Powered by Aikido Intel.
- [Safe Chain – Supply Chain Protection](https://www.aikido.dev/protect/safe-chain): Open-source tool that blocks malicious packages at install time, including typosquats and fresh-release attacks.
- [Device Protection](https://www.aikido.dev/protect/device-protection): Blocks malicious browser extensions, IDE plugins, and code libraries on developer devices without slowing teams down.


## Developer Integrations & Workflow

- [Integrations Directory](https://integrations.aikido.dev/): All native integrations: Git systems (GitHub, GitLab, Bitbucket, Azure DevOps), IDEs, CI/CD, cloud providers, task managers (Jira, Linear), messengers (Slack, Teams), and compliance platforms.
- [MCP Server for AI Coding Assistants](https://help.aikido.dev/ai-and-dev-tools/aikido-mcp): Use Aikido findings and AutoFix directly in Claude Code, Cursor, Codex CLI, Gemini CLI, Copilot, and other AI coding assistants via Model Context Protocol.
- [PR Gating](https://help.aikido.dev/code-scanning/local-code-scanning/pr-gating): Block merges when new high-severity vulnerabilities are introduced.
- [Public API Documentation](https://apidocs.aikido.dev/): REST API for findings, repos, and reports.


## Compliance & Reporting

- [SOC 2 & ISO Compliance](https://www.aikido.dev/use-cases/soc2-iso-compliance): Automates technical controls and evidence for ISO 27001:2022, SOC 2 Type 2, PCI DSS, DORA, NIS2, HIPAA, OWASP Top 10, and CIS v8. Syncs with Drata, Vanta, Thoropass, and Sprinto.
- [SBOM Generator](https://www.aikido.dev/use-cases/sbom-generator-create-software-bill-of-materials): Generate Software Bill of Materials from dependency scans in CycloneDX, SPDX, or CSV.
- [Reporting](https://help.aikido.dev/compliance-and-reporting): Audit-ready security, trend, malware, and SLA reports.
- [FedRAMP & Government Workloads](https://www.aikido.dev/fedramp-security): Security for US government and regulated workloads. FedRAMP authorization in progress; FIPS-compliant images available.


## Use Cases & Industries

- [Aikido for Enterprise](https://www.aikido.dev/industries/aikido-for-enterprise): RBAC, monorepo splitting, on-premise scanning, SSO, SLA-backed support, and Slack-based customer success.
- [Aikido for Startups](https://www.aikido.dev/industries/aikido-for-startups): Free plan and flat-fee pricing to get security running in minutes without a dedicated security team. Startup discount up to 30%.
- [Aikido for Students](https://www.aikido.dev/aikido-for-students): Full platform free for students with a school email; converts to a forever-free individual plan after graduation.
- [ASPM – Application Security Posture Management](https://www.aikido.dev/use-cases/application-security-posture-management-aspm): One posture view across code, cloud, and runtime findings.
- [Vulnerability Management](https://www.aikido.dev/use-cases/vulnerability-management): Deduplicate, triage, and remediate findings from all scanners in one queue.
- [Shadow AI Detection](https://www.aikido.dev/use-cases/shadow-ai): Detect unsanctioned AI usage, models, and data destinations across your codebase and runtime.
- [Aikido for Vibe Coding (Lovable)](https://www.aikido.dev/partners/aikido-lovable): Scan and pentest AI-generated apps, directly within Lovable.


## Intelligence & Research

- [Aikido Intel](https://intel.aikido.dev/): Threat intelligence feed detecting malware and vulnerabilities in open-source ecosystems within minutes. Covers npm, PyPI, Packagist, RubyGems, NuGet, Maven, Rust, Go, C++, Dart, Elixir, and Swift. Licensable via commercial API.
- [Security Research Blog](https://www.aikido.dev/blog): Technical articles on AppSec, supply chain attacks, pentesting, and emerging threats, written by Aikido's security engineering team.
- [State of AI Security & Development 2026](https://www.aikido.dev/state-of-ai-security-development-2026): Original research from 450 CISOs and developers on how AI-generated code affects security posture.
- [Reports](https://www.aikido.dev/reports): Research reports and industry benchmarks.


## Comparisons

- [Aikido vs Other Security Tools](https://www.aikido.dev/comparison/comparison-overview): Feature-by-feature comparison against Snyk, Wiz, Veracode, Checkmarx, SonarQube, Semgrep, Mend, Orca, Black Duck, GitHub Advanced Security, and GitLab Ultimate. Individual comparison pages at aikido.dev/comparison/*.
- [Migrating to Aikido](https://llms.aikidosecurity.com/migrating-to-aikido): Agent-readable migration guide. Teams including Revolut, n8n, and SoundCloud migrated from Snyk, Sonar, and other tools.


## Company

- [About Aikido](https://www.aikido.dev/company/about): Founded by Willem Delbare, Felix Garriau, Roeland Delrue, and Madeline Lawrence. HQ in Ghent, Belgium, with offices in San Francisco, Chicago, and London. $85M raised, 300+ employees, the fastest European cybersecurity company to reach unicorn status. Acquired Root in June 2026. Vision: self-securing software.
- [Documentation](https://help.aikido.dev): Full technical docs covering setup, scanning, integrations, AutoFix, Zen, and compliance. Also available as llms.txt and llms-full.txt.
- [Changelog](https://help.aikido.dev/changelog): Quarterly release notes and newly shipped features.
- [Open Source](https://www.aikido.dev/open-source): Zen firewall agents (AGPL), Opengrep, Safe Chain, and Betterleaks. Code at https://github.com/AikidoSec.
- [Customer Stories](https://www.aikido.dev/customer-stories): Case studies from Revolut, SoundCloud, n8n, Deel, Visma, and others.
- [Book a Demo](https://www.aikido.dev/book/demo): Request a demo or talk to the team.


## Optional

- [What is Aikido Security (for AI agents)](https://llms.aikidosecurity.com/what-is-aikido-security): Agent-readable platform overview.
- [Enterprise Governance (for AI agents)](https://llms.aikidosecurity.com/aikido-enterprise-governance): Agent-readable enterprise governance overview.
- [Root Acquisition Announcement](https://www.aikido.dev/blog/aikido-acquires-root): June 2026 acquisition of Root to defend open source from AI-powered attacks.
- [Glossary](https://www.aikido.dev/glossary): Definitions of AppSec terms (SAST, DAST, CSPM, ASPM, SBOM, and more).
- [Wall of Love](https://www.aikido.dev/wall-of-love): Customer reviews. Rated 4.7/5 across G2, Gartner, and Capterra.
- [Status Page](https://status.aikido.dev/): Live platform status.