Stay audit-ready, without slowing your dev team.
Aikido finds and fixes the code and cloud vulnerabilities your auditor checks for and syncs them into Drata.
Exclusive Drata customer offer
Each Drata tier comes with an Aikido AI Pentest, worth up to $4,000. Redeemable within the first 3 months of your Drata plan start date or for Drata deals currently in progress. Existing Aikido customers aren't eligible.
Combine the power of Aikido & Drata.
Automate your technical controls
Aikido runs the checks and generates the evidence for the technical controls behind SOC 2, ISO 27001, PCI, DORA, and HIPAA, so evidence collection stops being manual.
Ten specialist tools. One login.
SCA, SAST, AI SAST, IaC, secrets, container scanning,
DAST, cloud posture, and AI Pentesting in one place,
with the noise AutoTriaged so your team only sees
what matters.
Flows straight into Drata
Aikido syncs your findings and the evidence behind
them into Drata automatically. Fix an issue in Aikido
and it updates on the Drata side, which turns
compliance from a pre-audit scramble into something
that stays current.
Compliance coverage
Aikido performs checks and generates evidence for technical controls for ISO 27001:2022, SOC 2 Type 2, PCI, HIPAA and DORA.
Automating technical controls is a big step-up towards achieving compliance.
ISO 27001:2022
ISO 27001 is particularly relevant for FinTech companies. This globally recognized standard ensures that you have a systematic approach to managing sensitive company information, ensuring its confidentiality, integrity, and availability. Aikido automates a variety of ISO 27001:2022 technical controls.
DORA
The Digital Operational Resilience Act (DORA) is an EU regulation that requires financial institutions to strengthen their defenses against IT-related risks. Aikido helps with DORA compliance by automating the detection, and remediation of security vulnerabilities, enabling continuous monitoring, incident reporting, and management of 3d-party risks as required by the DORA regulation.
PCI
The Payment Card Industry Data Security Standard (PCI DSS) require a set of security standards designed to protect cardholder data during and after financial transactions. Any organization that handles credit card information must comply with these standards to ensure the secure processing, storage, and transmission of cardholder data. Aikido automates many technical controls.
OWASP Top 10
OWASP Top 10 aligns web application security practices with the most critical security risks identified by the Open Web Application Security Project (OWASP). The OWASP Top 10 is a widely recognized list of common vulnerabilities like injection flaws, broken authentication, and cross-site scripting (XSS), and achieving compliance involves addressing these vulnerabilities to secure web applications from common threats.
Pentest Reports
When Aikido Pentest finishes validation, it produces a detailed report that combines an executive overview with developer-first, actionable findings. The report is designed so security, engineering, and compliance teams can act on it immediately. You can also export tailored report types for auditors, management, or external parties in Pentest Reports.
SLA Insights and Issues
SLA Insights gives you visibility into how well your organization meets its remediation targets (MTTR Mean Time to Remediation). It focuses on response time, overdue issues, and overall remediation performance across severities.This report helps you understand whether security issues are being resolved within the timeframes you defined.
GDPR
The General Data Protection Regulation (GDPR) is the EU law that governs how organizations collect and process personal data of people in the EU. Among other requirements, it asks you to protect that data with appropriate technical and organizational measures. Aikido helps with the technical side by flagging security issues that could expose personal data, like leaked secrets or misconfigured cloud storage.
UK Cyber Essentials
Cyber Essentials is a UK government-backed certification, overseen by the National Cyber Security Centre (NCSC). It sets a baseline of protection against common internet attacks, built around five technical controls: firewalls, secure configuration, security update management, user access control, and malware protection. Some UK government contracts require it. Aikido flags code and cloud issues that affect these controls, like outdated packages with known vulnerabilities, so you can fix them before you apply.
SOC 2 Type 2
SOC 2 is a procedure that ensures your service providers securely manage your data to protect the interests of your organization and the privacy of its clients. Show your commitment to safeguarding data by complying with SOC2. Aikido automates all technical controls, making the compliance process much easier.
HIPAA
The Health Insurance Portability and Accountability Act sets national standards for protecting sensitive patient information in the healthcare industry. It mandates safeguards for the privacy and security of health data, ensuring that healthcare providers, insurers, and their business associates implement measures to protect patient information from unauthorized access and breaches.
NIS2
The Network and Information Security Directive (NIS2) is a European Union regulation aimed at improving the cybersecurity of critical infrastructure sectors. A wider range of industries must follow cybersecurity rules and it improves teamwork between EU countries to protect against cyber threats. Organizations in sectors like healthcare, energy, and transportation must meet these standards.
CIS
The Center for Internet Security (CIS) sets best practices and security benchmarks to help organizations improve their cybersecurity defenses by offering specific guidelines for securing systems, networks, and applications. Achieving CIS compliance helps reduce security risks and ensures a standardized level of protection against cyber threats. Aikido reports on CIS Controls v8 compliance progress, based on your connected clouds and code repositories.
NIST
NIST 800-53 is a catalog of security and privacy controls from the US National Institute of Standards and Technology. It's required for US federal information systems, and many government contractors and regulated companies use it as their control baseline. Aikido groups your security findings by NIST 800-53 control family, so you can see which areas need the most work.
HITRUST
The HITRUST Common Security Framework (CSF) is a certifiable framework that brings requirements from standards like HIPAA and ISO 27001 into one set of controls. It's common in US healthcare, where hospitals and insurers often ask vendors for HITRUST certification before sharing patient data. Aikido reports on the HITRUST technical controls it can check automatically, which gives you a head start on the evidence your assessor will ask for.
ENS
The Esquema Nacional de Seguridad (ENS) is Spain's National Security Framework. Spanish public sector bodies must comply with it, and so must the companies that provide them with IT services. ENS scales its security measures to how critical each system is. Aikido shows which ENS technical measures your setup already meets and which need work, ahead of your assessment.
Aikido covers the technical code and cloud security controls
behind SOC 2, ISO 27001, PCI, DORA, HIPAA, FedRAMP, and
generates the evidence to prove them.
SOC 2 Controls
CC3.3: Consider the potential for fraud
CC3.2: Estimate Significance of Risks Identified
CC5.2: The entity selects and develops general control activities over technology to support the achievement of objectives
CC6.1
CC6.6
CC6.7
CC6.8
CC7.1: Monitor infrastructure and software
CC7.1: Implement change detection mechanism
CC7.1: Detect unknown or unauthorized components
CC7.1: Conduct vulnerability scans
CC7.1: Implement filters to analyze anomalies
CC7.1: Restores the affected environments
CC10.3: Tests integrity and completeness of backup data
CC8.1: Protect confidential information
CC8.1: Track system changes
ISO 27001 Controls
A.8.2: Privileged access rights
A.8.3: Information access restriction
A.8.5: Secure authentication
A.8.6: Capacity management
A.8.7: Protection against malware
A.8.8: Management of technical vulnerabilities
A.8.9: Configuration management
A.8.12: Data leakage prevention
A.8.13: Backups
A.8.15: Logging
A.8.16: Monitoring activities
A.8.18: Use of privileged utility programs
A.8.20: Network security
A.8.24: Use of cryptography
A.8.25: Secure development lifecycle
A.8.28: Secure coding
A.8.31: Separation of development, test and production environments
A.8.32: Change management
A.5.15: Access control
A.5.16: Identity management
A.5.28: Collection of evidence
A.5.33: Protection of records
How to connect Drata to Aikido
Create an Aikido account and go to the integrations settings to set up the connection. In just a few clicks you can connect Aikido to Drata.
Aikido automatically syncs vulnerability data between Aikido and Drata. This integration ensures that your vulnerability information is always up to date, enabling accurate risk assessment and efficient remediation. Check out the technical details in our docs
Aikido surfaces the vulnerabilities that matter, hands you a one-click fix with AutoFix, and also keeps Drata updated as you remediate, so nothing slips through.
Get your exclusive Aikido | Drata offer
FAQs about Drata and Aikido
AI Pentesting simulates real-world attacks on your app or API using AI models trained on thousands of real exploits. It finds and validates vulnerabilities automatically - no waiting for a human pentester to start.
The offer is for new and recently closed Drata customers (who signed within the last three months or have a deal in progress). All Drata tiers get a free AI Pentest worth up to $4,000. Existing Aikido customers aren't eligible.
Claim it through the form on this page. Once you submit, we confirm your benefit and an Aikido specialist reaches out to get you started. You can redeem within the first 3 months of your Drata plan start date.
Aikido helps you meet the technical requirements for SOC 2, ISO 27001, PCI, DORA, HIPAA, and FedRAMP. It runs the checks and generates the evidence, then syncs it into Drata for your SOC 2 and ISO 27001 controls. Because Drata maps everything to a centralized control set, that same evidence automatically counts toward any overlapping control in other frameworks, so one sync covers several at once. And where a framework requires a live pentest, like PCI and DORA, the AI Pentest gives you the auditor-ready report.
Yes. It produces an auditor-ready report structured for SOC 2 and ISO 27001, and it's the live penetration test that frameworks like PCI and DORA call for. It supports FedRAMP readiness too. Every finding is proven with a working proof of concept, so there's nothing speculative in the report, and you get a letter of attestation for customer and RFP due diligence.
It only takes about a day. A traditional pentest can take weeks of scoping and scheduling before you get results. Aikido's agents run in parallel and hand back a validated, auditor-ready report in about a business day, so compliance stops being the thing that holds up a deal.