Dynamic Application Security Testing (DAST)
DAST simulates attacks to dynamically test vulnerabilities in your web app's front-end.
Scanners under the hood
ZAP
Nuclei
Custom rules
Importance of DAST
Aikido tests your front-end for common DAST vulnerabilities, but doesn’t do any tests that could break your front-end.
See the checks
Once configured, the DAST scans run daily and will notify you when there are new relevant vulnerabilities discovered. You can consult a detailed list of all the checks performed during the scans.
Advanced Features
In case your app is publicly accessible, authenticated DAST is essential. Aikido's authenticated DAST scans log in as a user, to test as much of the application as possible. Note: It is advised to never run these scans on a production server.
Learn more
When you link domains to your repo’s, Aikido will check for toxic combo’s. Toxic combo’s are known vulnerabilities that, combined, are dangerous and critical to fix.
Our Nuclei-based scanner checks your self-hosted apps for common vulnerabilities. E.g. Wordpress, self-hosted Jira, etc….
Built on reliable open source security scanners, all combined in one platform. Enhanced with our own code to cover any scanning gaps.
Cloud
Detects cloud infrastructure risks across major cloud providers.
CloudSploit
Custom Rules Engine
Code & Containers
Continuously monitors your code for known vulnerabilities, CVEs and other risks.
Trivy
Syft
Grype
Custom Rules Engine
Code
Checks your code for leaked and exposed API keys, passwords, certificates, encryption keys, etc...
Gitleaks
Code
Scans your source code for security risks before an issue can be merged.
Semgrep
Gosec
Brakeman
Custom Rules
Code
Scans Terraform, CloudFormation & Kubernetes infrastructure-as-code for misconfigurations.
Checkov
Containers
Scans your container OS for packages with security issues.
Syft
Grype
AWS Inspector
Custom Scanner
Domain
Dynamically tests your web app’s front-end to find vulnerabilities through simulated attacks. Built on ZAP & Nuclei.
ZAP
Nuclei
Custom Rules
Code & Containers
Monitors your licenses for risks such as dual licensing, restrictive terms, bad reputation, etc..
Syft
Grype
Custom Rules
Code
Prevents malicious packages from infiltrating your software supply chain. Powered by Phylum.
Phylum
Code & Containers
Checks if any frameworks & runtimes you are using are no longer maintained.
endoflife.date
Custom
Imports and auto-triages findings from your current scanner stack.
GitHub Advanced Security
SonarQube
Yes. We run a yearly pentest on our platform and also have an ongoing bug bounty program to ensure the security of Zen is continuously tested by a wide range of security experts.
You can create a CycloneDX SBOM or csv export with one click. Just go to the Licenses & SBOM report where you'll get a full overview of all the packages & licenses you're using.
Aikido does not store your code after analysis has taken place. Some of the analysis jobs such as SAST or Secrets Detection require a git clone operation. More detailed information can be found on docs.aikido.dev.
When you log in with your VCS we don’t get access to any of your repositories. You can manually give access to the repositories you’d like to scan. It’s also possible to test out the platform using sample repositories.
Of course! When you sign up with your git, don’t give access to any repo & select the demo repo instead!
We can’t & won’t, this is guaranteed by read-only access.
Trusted by development teams around the world
.svg){kind=icon}
Review
James B
Cloud Security Researcher
.svg)
