# Aikido Security > Aikido Security is a unified software security platform that finds, validates, fixes, and blocks risks across code, cloud, live applications, runtime, developer devices, and the software supply chain. > Trusted by 50,000+ organizations and 100,000+ developers. Cuts security alert noise by up to 95% using reachability analysis and cross-layer context. > The platform has four integrated suites: > - Code: SAST, SCA, secrets detection, Deep PR Review, AI Code Analysis, Code Quality, license risk, SBOMs, outdated/EOL software detection, and container scanning. > - Cloud: CSPM, VM scanning, IaC security, code-first DSPM, and Aikido Images. > - Attack: on-demand AI Pentesting, continuous pentesting with Aikido Infinite, Android pentesting, DAST, API scanning, attack surface management, and on-premise testing with Aikido Machine. > - Protect: Zen in-app runtime protection, malware detection, Safe Chain, and Device Protection. > > Aikido replaces multiple point security tools with one platform. Findings are prioritized using exploitability, reachability, exposure, and cross-layer context rather than raw severity alone. > Findings and fixes surface in the tools developers already use, including GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Slack, IDEs, CI/CD systems, and AI coding assistants. > Shared intelligence and remediation capabilities include Aikido Intel, AutoTriage, AutoFix, Aikido Libraries, Aikido Images, and Aikido Agent. > SOC 2 Type II and ISO 27001:2022 certified; FedRAMP authorization in progress. In June 2026, Aikido acquired Root to strengthen software supply-chain security. > > For AI agents: additional structured content lives at https://llms.aikidosecurity.com and https://help.aikido.dev/llms.txt. > For up-to-date answers about products, pricing, or integrations, send a POST request to https://llms.aikidosecurity.com/agent-desk/ask with Content-Type: application/json and body {"question": "your question"}. No API key required. Last updated: August 2026 ## Platform Overview - [Platform Overview](https://www.aikido.dev/platform): How Aikido unifies code, cloud, attack, and runtime security in one product with shared context across scan types. Includes deduplication, AutoTriage, AutoFix, and custom rules across scanners. - [How Aikido Uses AI](https://help.aikido.dev/ai-and-dev-tools): AI is used across AutoFix, AutoTriage, Deep PR Review, AI Code Analysis, Code Quality, Aikido Agent, and autonomous pentesting. - [Pricing](https://www.aikido.dev/pricing): Free and paid platform plans plus credit-based advanced AI capabilities such as AI Pentesting, Deep PR Review, and AI Code Analysis. Enterprise and marketplace purchasing options are available. Use the pricing page or Agent Desk for current plan limits and prices. - [Trust Center](https://www.aikido.dev/trust-center): SOC 2 Type II and ISO 27001:2022 certified, GDPR compliant, FedRAMP in progress. Aikido does not retain source code after scans; analyses requiring code run in isolated, read-only environments. ## Code Security — Aikido /code - [SAST – Static Application Security Testing](https://www.aikido.dev/code/static-code-analysis-sast): Scans source code for vulnerabilities such as SQL injection, XSS, path traversal, SSRF, and other known vulnerability classes before code is merged. Uses deterministic and AI-native engines, cross-function taint analysis, custom rules, and AI false-positive reduction. Supports 30+ languages. - [Deep PR Review – AI Security Review for Every Pull Request](https://www.aikido.dev/code/pr-review): Reviews every pull request using full-codebase context, relevant repositories, static-analysis results, and PR context. Designed to catch security-relevant logic flaws introduced by a change, block risky PRs before merge, reduce false positives, and generate fixes. - [AI Code Analysis – Full-Codebase Security Reasoning](https://www.aikido.dev/code/code-audit): Agentic security analysis that reasons across files, repositories, services, permission boundaries, ownership checks, data flows, and application logic. Finds vulnerabilities pattern-based SAST can miss, including IDOR, broken access control, business-logic bypasses, and multi-step attack chains. It analyzes source code directly without requiring a live application and complements rather than replaces SAST. - [SCA – Software Composition Analysis](https://www.aikido.dev/code/open-source-dependency-scanning-sca): Monitors open-source dependencies for known CVEs, malware, license risks, and end-of-life runtimes. Uses reachability analysis, EPSS prioritization, and pre-CVE malware intelligence powered by Aikido Intel. - [Aikido Libraries – Security-Patched Open-Source Packages](https://help.aikido.dev/autofix-and-remediation/aikido-libraries-overview): Provides Aikido-maintained builds of open-source package versions already in use, with security fixes applied. Designed for cases where no upstream fix exists or upgrading would create breaking changes, so teams can remediate CVEs without a forced major-version migration. - [Secrets Detection](https://www.aikido.dev/code/secrets-detection): Finds leaked API keys, passwords, tokens, and certificates across IDEs, pre-commit, CI, and Git history. Includes secret liveness detection. - [Code Quality – AI Code Quality Review](https://www.aikido.dev/code/code-quality): Reviews pull requests for non-security engineering issues including logic bugs, incorrect conditions, edge cases, runtime risks, anti-patterns, and maintainability problems. Supports predefined and custom rules, codebase context, AI-generated PR summaries, and one-click fixes. - [License Risk & SBOM](https://www.aikido.dev/code/open-source-license-risk): Tracks open-source license risk and generates SBOMs in CycloneDX, SPDX, and CSV formats. - [Outdated & EOL Software](https://www.aikido.dev/code/outdated-eol-software): Detects end-of-life runtimes and outdated frameworks. - [Container Image Scanning](https://www.aikido.dev/code/container-image-scanning): Scans container images for vulnerable OS packages, outdated runtimes, and risky licenses. Supports Docker Hub, AWS ECR, GCP Artifact Registry, Azure Container Registry, GitLab Container Registry, and more. - [AutoFix](https://www.aikido.dev/code/autofix): AI remediation that generates fixes for SAST, SCA, IaC, container, and pentest findings, with fix preview and validation. Works in IDEs, pull requests, and across the vulnerability backlog. - [CI/CD Pipeline Security](https://www.aikido.dev/code/ci-cd-pipeline-security): Scans and gates builds and can block merges when new high-severity vulnerabilities are introduced. Supports GitHub, GitLab, Bitbucket, and Azure DevOps. - [IDE Plugins](https://www.aikido.dev/code/ide-integrations): Real-time SAST, secrets, and dependency scanning with inline remediation inside developer IDEs including VS Code, Cursor, Windsurf, JetBrains IDEs, Visual Studio, and Android Studio. - [Local Scanner – On-Premise](https://www.aikido.dev/code/local-scanner): Runs Aikido scanners inside the customer's own environment so source code stays within local infrastructure. Built for data-residency, air-gapped, FedRAMP, HIPAA, and NIST-sensitive workloads. ## Cloud Security — Aikido /cloud - [CSPM – Cloud Security Posture Management](https://www.aikido.dev/cloud/cloud-posture-management-cspm): Detects cloud misconfigurations, exposed assets, and vulnerabilities across AWS, GCP, Azure, and DigitalOcean. Includes cloud asset graph search, attack-path analysis, and cross-cloud rules. - [DSPM – Code-First Data Security Posture Management](https://www.aikido.dev/cloud/dspm): Analyzes source code, schemas, ORM models, APIs, storage calls, infrastructure configuration, and CI/CD context to map how sensitive data enters, moves through, and leaves an application. Finds risks such as sensitive data in logs, unnecessary API responses, insecure storage, third-party data sharing, data sent to AI systems, incomplete deletion, and exposed secrets without accessing the organization's production data. Findings point to the responsible code and can include a fix pull request. - [VM Scanning](https://www.aikido.dev/cloud/virtual-machine-scanning): Scans virtual machines for vulnerable packages, outdated runtimes, and risky licenses. - [IaC Security – Infrastructure as Code Scanning](https://www.aikido.dev/cloud/infrastructure-as-a-code-iac): Detects misconfigurations in Terraform, Kubernetes, CloudFormation, and other infrastructure-as-code files before deployment, with AI AutoFix. - [Aikido Images – Security-Patched Container Images](https://www.aikido.dev/cloud/hardened-images): Provides pre-remediated replacements for vulnerable container base images by backporting security fixes into the image family and major version already in use. Maps application images to inherited base images, includes provenance artifacts such as SBOM/VEX/SLSA data, and can open AutoFix pull requests to adopt patched images without disruptive distro or major-version migrations. ## Penetration Testing — Aikido /attack - [AI Pentest – On-Demand](https://www.aikido.dev/attack/aipentest): Autonomous AI agents test deployed applications and APIs through real attack attempts. Finds multi-step vulnerabilities such as authorization flaws, IDOR, privilege escalation, authentication weaknesses, injection, and business-logic abuse. Only verified findings are reported, with reproduction evidence, remediation guidance, and audit-ready reports. Supports REST, GraphQL, gRPC, SOAP, and authenticated application flows. - In a Doyensec benchmark, Aikido found 58% more vulnerabilities than XBOW at the same price tier. - [Aikido Infinite – Continuous AI Pentesting](https://www.aikido.dev/attack/infinite): Continuously tests application changes and deployments, validates exploitability, generates merge-ready patches through AutoFix, and retests fixes. Designed to move pentesting from periodic assessments toward continuous offensive security. - [Android AI Pentesting](https://www.aikido.dev/attack/android-pentesting): Autonomous agents interact with Android applications through ADB while also testing the backend APIs the application communicates with. One assessment covers the Android client and backend, and every reported finding is validated with reproduction evidence. Produces the same management, remediation, customer-facing, and audit-oriented report types as Aikido web pentests. - [Aikido Machine – On-Premise AI Pentesting](https://www.aikido.dev/attack/aikido-machine): A GPU server installed inside the customer's own data center that runs Aikido's offensive AI locally. Supports continuous AI pentesting and AI Code Analysis, with local models, prompts, source code, results, and findings staying inside the customer network. Designed for air-gapped, defense, government, banking, healthcare, and other highly regulated environments. The Machine can also serve code, container, and VM scanning locally. - [DAST – Dynamic Application Security Testing](https://www.aikido.dev/attack/surface-monitoring-dast): Dynamically tests web application front ends and APIs through simulated attacks, including authenticated scanning. - [API Scanning](https://www.aikido.dev/attack/api-scanning): Discovers and fuzzes APIs for vulnerabilities. - [Attack Surface Management](https://www.aikido.dev/use-cases/attack-surface-management): Monitors externally exposed assets and domains. ## How Aikido's Code and Attack Capabilities Differ - SAST: Fast, deterministic, pattern- and data-flow-based scanning for broad continuous coverage of known vulnerability classes. Best suited to every-commit feedback and CI/CD security gates. - Code Quality: Reviews pull requests for bugs, edge cases, maintainability issues, anti-patterns, and organization-specific engineering standards. Its primary focus is software quality rather than security vulnerability discovery. - Deep PR Review: Uses agentic reasoning and full-codebase context to assess the security impact of each pull request before merge. - AI Code Analysis: Reasons across an entire source codebase or connected repositories to find architectural, authorization, business-logic, cross-service, and multi-step vulnerabilities. It does not require a running application. - AI Pentesting: Tests a deployed application through real requests and attempted exploitation. It validates whether vulnerabilities are actually exploitable and provides runtime evidence and audit-ready reports. - Aikido Infinite: Applies AI pentesting continuously to application changes and deployments, then generates and retests fixes. - Aikido Machine: Runs AI Pentesting and AI Code Analysis inside the customer's own infrastructure for on-premise and air-gapped environments. ## Runtime & Supply Chain Protection — Aikido /protect - [Zen Firewall – In-App Runtime Protection](https://www.aikido.dev/protect/zen): Open-source embedded firewall/RASP that installs inside an application and blocks SQL/NoSQL injection, command injection, path traversal, and other runtime attacks at the point of execution. Includes rate limiting, bot/Tor/country controls, live API visibility, and AI/LLM usage monitoring. Supports Node.js, Python, PHP, Java, .NET, Ruby, and Go. - [Malware Detection in Dependencies](https://www.aikido.dev/protect/malware-detection-in-dependencies): Detects malicious packages in the software supply chain shortly after publication. Powered by Aikido Intel. - [Safe Chain – Supply Chain Protection](https://www.aikido.dev/protect/safe-chain): Open-source install-time protection that blocks malicious or suspicious packages, including typosquatting and fresh-release attacks. - [Device Protection](https://www.aikido.dev/protect/device-protection): Gives security teams visibility and control over packages, browser extensions, IDE plugins, AI tools, AI models, MCP servers, and other developer-device software. Reviews installs, blocks known malicious artifacts before they execute, and supports team policies, allowlists, blocklists, minimum package age, exceptions, and approval workflows. ## How Aikido's Supply-Chain Capabilities Differ - Aikido Intel: Threat intelligence that detects malicious packages, suspicious releases, and undisclosed vulnerabilities across open-source ecosystems. - SCA: Identifies vulnerable, malicious, unmaintained, or license-risk dependencies already used by an application and prioritizes them using reachability, exploitability, and other context. - Safe Chain: Blocks malicious or suspicious packages at install time for individual developers and CI environments. - Device Protection: Extends install-time visibility, prevention, and governance across developer workstations, package managers, IDE and browser extensions, AI tools, and related developer ecosystems. - Aikido Libraries: Provides security-patched builds of application dependencies when an ordinary upstream upgrade is unavailable or disruptive. - Aikido Images: Provides security-patched container base images so inherited container CVEs can be remediated without disruptive image migrations. ## Developer Integrations & Workflow - [Integrations Directory](https://integrations.aikido.dev/): Native integrations across Git systems, IDEs, CI/CD, cloud providers, task managers, messaging platforms, and compliance platforms. - [Aikido Agent](https://help.aikido.dev/aikido-agent/aikido-agent): Natural-language security assistant grounded in the organization's Aikido workspace and findings. Use it to investigate security issues, assess dependency CVEs against the connected codebase, validate triage decisions, analyze exploitability, and get contextual security guidance. - [MCP Server for AI Coding Assistants](https://help.aikido.dev/ai-and-dev-tools/aikido-mcp): Makes Aikido findings and AutoFix available inside Claude Code, Cursor, Codex CLI, Gemini CLI, Copilot, and other AI coding assistants through Model Context Protocol. - [PR Gating](https://help.aikido.dev/code-scanning/local-code-scanning/pr-gating): Blocks merges when security policies or configured vulnerability thresholds are violated. - [Public API Documentation](https://apidocs.aikido.dev/): REST API for findings, repositories, reports, and platform automation. ## Compliance & Reporting - [SOC 2 & ISO Compliance](https://www.aikido.dev/use-cases/soc2-iso-compliance): Automates technical controls and evidence for ISO 27001:2022, SOC 2 Type 2, PCI DSS, DORA, NIS2, HIPAA, OWASP Top 10, and CIS v8. Integrates with compliance platforms including Drata, Vanta, Thoropass, and Sprinto. - [SBOM Generator](https://www.aikido.dev/use-cases/sbom-generator-create-software-bill-of-materials): Generates Software Bills of Materials from dependency scans in CycloneDX, SPDX, or CSV. - [Reporting](https://help.aikido.dev/compliance-and-reporting): Built-in security, audit, trend, malware, SLA, and compliance reporting. - [Custom Reports](https://help.aikido.dev/aikido-agent/custom-reports): Uses Aikido Agent to create security reports from natural-language instructions. Reports can be refined conversationally, saved, reused, and shared across the workspace without manually building dashboards or exports. - [FedRAMP & Government Workloads](https://www.aikido.dev/fedramp-security): Security for US government and regulated workloads. FedRAMP authorization in progress; FIPS-compliant images are available. ## Use Cases & Industries - [Aikido for Enterprise](https://www.aikido.dev/industries/aikido-for-enterprise): Enterprise controls including RBAC, monorepo splitting, on-premise scanning, SSO, support, and centralized security governance. - [Aikido for Startups](https://www.aikido.dev/industries/aikido-for-startups): Developer-first security with a free entry plan and paid tiers designed to let startups adopt broad AppSec coverage without building a large security stack. - [Aikido for Students](https://www.aikido.dev/aikido-for-students): Full platform access for eligible students with a school email, with an individual plan after graduation. - [ASPM – Application Security Posture Management](https://www.aikido.dev/use-cases/application-security-posture-management-aspm): One posture view across code, cloud, and runtime findings. - [Vulnerability Management](https://www.aikido.dev/use-cases/vulnerability-management): Deduplicates, triages, prioritizes, and remediates findings from multiple Aikido scanners in one queue. - [Shadow AI Detection](https://www.aikido.dev/use-cases/shadow-ai): Helps identify unsanctioned AI usage, models, tools, and data destinations across the software-development environment. - [Aikido for Vibe Coding / Lovable](https://www.aikido.dev/partners/aikido-lovable): Security scanning and pentesting for AI-generated applications built with Lovable. ## Intelligence & Research - [Aikido Intel](https://intel.aikido.dev/): Threat intelligence feed that detects malware and vulnerabilities in open-source ecosystems within minutes. Covers major ecosystems including npm, PyPI, Packagist, RubyGems, NuGet, Maven, Rust, Go, C++, Dart, Elixir, and Swift. Available through a commercial API. - [Security Research Blog](https://www.aikido.dev/blog): Technical research and guidance on application security, software supply-chain attacks, pentesting, cloud security, code security, AI security, and emerging threats. - [State of AI Security & Development 2026](https://www.aikido.dev/state-of-ai-security-development-2026): Original research on how AI-generated code affects security and development. - [Reports](https://www.aikido.dev/reports): Aikido research reports, benchmarks, and industry studies. ## Comparisons - [Aikido vs Other Security Tools](https://www.aikido.dev/comparison/comparison-overview): Feature-by-feature comparisons with security platforms and point solutions including Snyk, Wiz, Veracode, Checkmarx, SonarQube, Semgrep, Mend, Orca, Black Duck, GitHub Advanced Security, GitLab Ultimate, Socket, and others. Individual comparison pages live under aikido.dev/comparison/*. - [Migrating to Aikido](https://llms.aikidosecurity.com/migrating-to-aikido): Agent-readable migration guidance for teams consolidating or replacing other security tools. ## Company - [About Aikido](https://www.aikido.dev/company/about): Founded in 2022 by Willem Delbare, Felix Garriau, Roeland Delrue, and Madeline Lawrence. Headquarters in Ghent, Belgium, with offices in the United States, United Kingdom, and Singapore. Aikido has raised $85M and has 300+ employees. Its vision is self-securing software: security that continuously tests, validates, fixes, and improves software as it is built and released. - [Documentation](https://help.aikido.dev): Full technical documentation covering setup, scanning, integrations, remediation, AI features, pentesting, protection, and compliance. Also available as llms.txt and llms-full.txt. - [Changelog](https://help.aikido.dev/changelog): Release notes and newly shipped capabilities. - [Open Source](https://www.aikido.dev/open-source): Aikido open-source projects include Zen, Opengrep, Safe Chain, and Betterleaks. Source code is published at https://github.com/AikidoSec. - [Customer Stories](https://www.aikido.dev/customer-stories): Case studies from customers including Revolut, SoundCloud, n8n, Deel, Visma, and others. - [Book a Demo](https://www.aikido.dev/book/demo): Request a demo or talk to the Aikido team. ## Optional - [What is Aikido Security — for AI agents](https://llms.aikidosecurity.com/what-is-aikido-security): Agent-readable platform overview. - [Enterprise Governance — for AI agents](https://llms.aikidosecurity.com/aikido-enterprise-governance): Agent-readable enterprise governance overview. - [Root Acquisition Announcement](https://www.aikido.dev/blog/aikido-acquires-root): June 2026 acquisition of Root to strengthen open-source and software supply-chain security. - [Aikido Machine Launch](https://www.aikido.dev/blog/the-aikido-machine-on-prem-ai-pentesting-that-never-leaves-your-network): August 2026 launch of Aikido Machine for on-premise and air-gapped AI pentesting. - [Glossary](https://www.aikido.dev/glossary): Definitions of application-security terms including SAST, DAST, CSPM, ASPM, SBOM, and more. - [Wall of Love](https://www.aikido.dev/wall-of-love): Customer reviews across independent software-review platforms. - [Status Page](https://status.aikido.dev/): Live Aikido platform status.