# Aikido Security Aikido Security is a security platform for developers, engineering teams, and security teams that covers application code, cloud environments, and runtime protection. It combines scanning, risk prioritization, and automated remediation workflows in one system. - Findings24: - Website: - Pricing: Freemium - Categories: Developer Tools ## What is Aikido Security? Aikido Security is a unified application and cloud security platform for development, engineering, and security teams. It covers security work across code, cloud infrastructure, running applications, and devices or runtime environments. The platform combines dependency scanning, SAST, secrets detection, AI-assisted code analysis, cloud posture management, infrastructure-as-code checks, container and virtual-machine scanning, and application testing. It emphasizes context-based prioritization so teams can focus on risks associated with exposure, environment, and exploitability rather than treating every finding equally. Aikido's documented workflow can move from detection to remediation: an agent identifies a vulnerability, creates a pull request, deploys the change to staging, and verifies the fix with a smoke test. Cloud connections can use a secure, read-only API, while findings can be surfaced through existing development workflows. The product is offered as a free Developer tier, paid platform plans, and separately scoped pentesting services. ## What can Aikido Security do? ### Application and code security Scans dependencies, source code, secrets, licenses, outdated software, container images, and code quality issues. The code platform also includes AI SAST, deep pull-request review, SBOMs, malware detection, and AI-assisted autofix capabilities. ### Cloud posture and workload scanning Provides CSPM checks plus scanning for virtual machines, container images, Kubernetes environments, and infrastructure as code including Terraform, CloudFormation, and Kubernetes configurations. ### Context-based cloud visibility Cloud Search lets teams query cloud resources, misconfigurations, and relationships, while the unified view connects workloads, exposures, and findings without requiring a separate tool for each scanner. ### Application testing and attack simulation Aikido Attack includes AI pentesting, continuous pentesting, authenticated DAST, API discovery and fuzzing, attack-surface monitoring, and on-premises pentesting for assessing running applications and APIs. ### Automated remediation workflow The documented agent flow can detect a vulnerability, create a pull request, deploy the fix to staging, and run a smoke test to verify the result. Container findings can also be autofixed through the cloud product. ### Development and governance workflows The platform is designed to surface important findings in existing development workflows and supports issue synchronization, reports and analytics, and compliance mapping to standards such as SOC 2 and ISO. ## Use Cases ### Reduce application vulnerability backlog Development and application-security teams can scan repositories for dependency, SAST, secret, license, malware, and code-quality issues, then use pull-request-based remediation to move selected findings toward release. ### Prioritize cloud exposure Cloud and security teams can connect environments through a read-only API, review workloads and relationships in one view, and prioritize misconfigurations or vulnerable assets using environment, exposure, and exploitability context. ### Secure infrastructure changes before deployment Engineering teams can check Terraform, CloudFormation, and Kubernetes infrastructure as code for misconfigurations before changes reach cloud environments, reducing the chance that insecure configuration is deployed. ### Test running applications and APIs Security teams can use authenticated DAST, API discovery and fuzzing, AI pentesting, or continuous pentesting to assess live applications, APIs, and infrastructure rather than relying only on pre-release code scans. ### Support audit and remediation programs Teams that need documented security work can use reports and analytics, compliance mapping, and pentesting reports described as suitable for standards including SOC 2 and ISO 27001. ## Frequently Asked Questions ### What does Aikido Security cover? It covers application code and dependencies, secrets, software licenses, cloud misconfigurations, infrastructure as code, container images, virtual machines, Kubernetes, running applications and APIs, and selected device or runtime protections. ### How is Aikido connected to a cloud environment? The cloud product describes an agentless setup using a secure, read-only API connection with minimal permissions and no performance impact from installed agents. ### Can Aikido fix findings automatically? The site describes AI-assisted autofixes, pull requests for vulnerability remediation, deployment of fixes to staging, and smoke-test verification. Container findings can also be fixed through the cloud product. Exact availability depends on the plan and feature. ### Does Aikido provide penetration testing? Yes. The site offers pentesting services and platform capabilities including AI pentesting, continuous pentesting, authenticated DAST, API discovery and fuzzing, and on-premises pentesting. Pentest scope and pricing are handled separately from the standard platform tiers. ### Is there a free version? Yes. The Developer plan is listed as free forever, includes two users, and requires no credit card. It has stated usage limits, while paid Basic, Pro, and Advanced plans provide broader coverage and capacity. ## Quick Facts - **Category**: Application, cloud, and developer security platform - **Primary users**: Developers, engineering teams, security teams, and CISOs - **Core coverage**: Code, dependencies, secrets, cloud infrastructure, containers, VMs, APIs, and runtime protection - **Cloud setup**: Agentless connection through a secure, read-only API - **Free tier**: Developer plan; free forever, two users, no credit card required - **Commercial options**: Paid Basic, Pro, and Advanced plans, plus separately scoped pentesting services