Introducing Zen: The In-App Firewall for Real-Time Protection
Security threats evolve faster than ever, and traditional defenses struggle to keep up. Web Application Firewalls (WAFs) rely on outdated blocklists and require constant rule updates, often leading to false positives and missed threats.
Enter Zen, the new product within Aikido Security—a fully embedded in-app firewall that stops attacks in real-time, right inside your application.
Enter Zen, the new product within Aikido Security—a fully embedded in-app firewall that stops attacks in real-time, right inside your application.
Get Peace of Mind at Runtime
Zen provides always-on security for your app, blocking critical injection attacks, implementing rate limiting for APIs, and giving you granular traffic control—without the overhead of traditional WAFs.
Zen is More Than a Firewall—It’s Runtime Protection
Other tools monitor from the outside, but Zen watches from within. This means:
Precision security
Detects unknown vulnerabilities based on logic execution, not just attack patterns.
No downtime fixes
Instead of taking applications offline, Zen provides actionable insights so developers can fix vulnerabilities without disrupting service.
Full developer context
Know exactly where threats occur, what’s impacted, and how to fix them within Aikido.
Stop zero-days in real-time
Zen prevents OWASP Top 10 and zero-day threats before they reach your database.
Minimal setup
Install in seconds. No manual configurations.
No maintenance
No constant rule updates, no follow-ups, no babysitting.
Privacy-first
Unlike cloud-based WAFs, Zen never sends your sensitive data to third parties
Deeper insights & control
Understand threats inside your application and take targeted actions, unlike external-only defenses.
Block the Biggest Threats, Automatically
With Zen, security is proactive, not reactive. It continuously analyzes incoming requests, stopping attacks before they cause damage.
Prevent Critical Injection Attacks
Zen automatically blocks malicious attacks, including:
SQL & NoSQL Injection
Prevents database manipulation attempts (supports MySQL, MongoDB, Postgres & more).
Command Injection
Stops attackers from executing unauthorized system commands.
Path Traversal
Prevents unauthorized access to sensitive files and directories.
Mitigate API Abuse & Traffic Flooding
User-aware rate limiting
Stops brute-force attacks and bot-driven API abuse.
Granular blocking
Control access by IP, bot type, country, or Tor traffic.
Blacklist Known Threats
via partnership with CrowdSec, instantly block known malicious threat actors
Zen is Integrated into the Aikido Platform
Zen is not just an add-on; it's a core component of Aikido Security's central platform,
How Zen Works with Aikido
Developers start by connecting Aikido to their application, where the platform scans for vulnerabilities across their codebase. Zen is then installed directly into the application, providing immediate runtime protection. While developers continue coding and fixing vulnerabilities at their own pace, Zen remains active, blocking potential exploits in real-time.
The integration ensures a continuous feedback loop:
The integration ensures a continuous feedback loop:
Aikido scans the codebase and detects vulnerabilities.
Zen defends the app against any attempts to exploit those vulnerabilities while fixes are in progress.
Aikido monitors fixes as developers deploy patches, reducing security risks over time.
Aikido tests the application for vulnerabilities, with dynamic surfacing monitoring (DAST), simulated real-world attacks, and API fuzzing– enhanced by Zen’s API discovery and monitoring.
Zen in Aikido’s Workflow
Zen is embedded into the Aikido platform, integrating defense within the wider context of application security. The connection between scan, test, defend, and fix is
Full developer context
Know exactly where threats occur, what’s impacted, and how to fix them within Aikido.
Issue mitigation in the Aikido feed
When an exploitable issue is detected, Zen can instantly mitigate the risk, reducing its severity in real time.
Real-time severity updates
Developers can see when an issue's severity decreases because Zen is actively blocking threats.
Insightful logs
Developers can view detailed records of blocked attacks, their sources, and their patterns.
Smart rate limiting (coming soon)
Zen will adapt to malicious behavior, automatically fine-tuning security controls.
DAST-enhanced scanning
By analyzing legitimate traffic, Zen informs Aikido’s DAST engine for more accurate security testing, eliminating guesswork in identifying vulnerabilities.
Why Zen? It’s a Game Changer for Security
Unlike traditional WAFs, Zen runs inside your application. This gives it deep context awareness, bridging the gap between shift left and shift right security.
Zen vs. Other Solutions
Traditional security tools like WAFs and perimeter-based solutions provide limited visibility into what actually happens inside an application. They detect threats at the infrastructure level but lack the runtime insights needed to fully prevent sophisticated attacks. Zen changes the game by embedding protection directly inside your application.
Privacy
False Positives/Negatives
Rate Limiting
Performance Impact
Setup Complexity
Maintenance
Cost
API Security
Runtime Insights
Zen
No third-party key access
Minimal false positives/negatives
Minimal
Minimal false positives/negatives
User-aware
Minimal false positives/negatives
Negligible
Minimal false positives/negatives
One command, instant
Minimal false positives/negatives
No updates required
Minimal false positives/negatives
Open source, included in Aikido
Minimal false positives/negatives
Auto-generates Swagger docs
Minimal false positives/negatives
Full application context
Minimal false positives/negatives
Cloudflare WAF
Requires access to private keys
Minimal false positives/negatives
Higher risk
Minimal false positives/negatives
IP-based only
Minimal false positives/negatives
Adds ~100ms latency
Minimal false positives/negatives
Complex initial setup
Minimal false positives/negatives
Constant rule updates needed
Minimal false positives/negatives
Closed source, costs increase fast
Minimal false positives/negatives
No built-in API security
Minimal false positives/negatives
Perimeter only
Minimal false positives/negatives
Auto-generateSwagger API Docs
Swagger API Docs
Zen doesn’t just protect your APIs—it discovers them all, including undocumented or forgotten endpoints. Our context-aware DAST scans for vulnerabilities, simulating real-world attacks to keep your APIs secure.
Auto-gen API docs
To supercharge API security testing
Built for Developers: Simple, Fast, and Effective
Zen is lightweight, easy to install, and works out of the box. You can test it in dry mode before deploying, ensuring it fits seamlessly into your application. You can use Zen in ‘detection’ only mode to monitor events before turning on block mode.
Supported Platforms:
Coming Soon
Select your setup
Zen for Node.js is compatible with :
✓ Express
✓ Hono
✓ Hapi
✓ Micro
✓ Next.js
Fastify
Coming Soon!
Zen for Python 3 is compatible with :
✓ Django
✓ Flask
✓ Quart
✓ Starlette
Zen for Python 3 is compatible with :
Django
Flask
Quart
Try Zen Now – Peace of Mind at Runtime
Zen is lightweight, easy to install, and works out of the box. You can test it in dry mode before deploying, ensuring it fits seamlessly into your application. You can use Zen in ‘detection’ only mode to monitor events before turning on block mode.
Get Zen now and stop attacks in real-time.