Aikido Security
by Aikido Security • • Static Code Analysis Tools
Aikido Security is a developer security platform for static analysis, dependency, secret and cloud scanning, sold to engineering teams at a flat team fee.
Aikido Security finds and fixes vulnerabilities across a team's code, open-source packages, containers, cloud accounts and running applications from one dashboard. It is built in Ghent, Belgium, by Aikido Security BV, which also has an office in San Francisco. The idea is one account and one list of findings in place of a separate tool for each kind of check. Static analysis is one part of that platform, next to dependency, secret, infrastructure and runtime scanning. Code scanning runs AI SAST across the common programming languages, and teams add their own rules written in Opengrep beside the built-in set. Open-source dependency scanning reports CVEs, malware, license risk and end-of-life packages. Secret detection flags exposed API keys, passwords and tokens, while infrastructure-as-code checks read Terraform, CloudFormation, Docker and Pulumi files. Further scanners cover container images, virtual machines, cloud configuration and the external attack surface. Code Quality scores each repository, AutoFix opens pull requests with the change, AI Pentest sends agents against a running application, and Zen adds an in-app firewall. The platform is written for developers first and for the security staff who review their work. Small and growing engineering teams and startups use it to cover code, dependencies and cloud from a single account. Teams that would rather receive a fix as a pull request than a ticket get the most from AutoFix. Organisations with FedRAMP moderate requirements are served by an enterprise edition, and teams can buy directly or through AWS and Azure. Connecting a repository from GitHub, GitLab, Bitbucket or Azure DevOps starts the first scan. From then on, PR checks comment on new findings inside each pull request and can block one that introduces issues above a chosen threshold. Test coverage uploaded from CI shows which files and lines the tests reach. Findings that need an owner go to Jira or Linear, and compliance evidence flows to Drata or Vanta ahead of an audit. In VS Code and JetBrains editors, the plugins surface a hardcoded secret or a vulnerable package while the code is still being written.
Pricing
View plans-
Developer
Free
- Free forever for 2 users, no credit card required
- Up to 10 repos, 2 container images, 1 domain and 1 cloud account
- 10 AI AutoFixes a month and 250k protected requests a month
- Dependency scanning, SAST and AI SAST with custom rules, secrets detection
- Cloud misconfiguration checks, container scanning and IaC scanning
- License risk, outdated software, DAST and IDE plugins
- Rescans every 3 days
-
Basic
$350 per month
$350 a month billed monthly, or $3,780 a year billed annually (10% off)
- Flat fee including 10 users; the price changes with the user count chosen (10, 15 or 20)
- Up to 100 repos, 50 container images, 3 domains and 3 cloud accounts, with fair-usage limits
- Unlimited AI AutoFixes and 10M protected requests a month
- PR security review, PR code quality checks and code coverage
- Issue sync to Jira and Linear, compliance sync to Drata and Vanta
- Reports and analytics, AI and bot protection, Device Protection, Aikido Libraries
- Can also be bought through AWS and Azure
-
Pro
$700 per month
$700 a month billed monthly, or $7,560 a year billed annually (10% off)
- Flat fee including 10 users; the price changes with the user count chosen, up to 50 or more
- Up to 200 repos, 100 container images, 10 domains, 10 cloud accounts and 30 VM scaling groups
- Unlimited AI AutoFixes and 20M protected requests a month
- On-prem scanning, virtual machine scanning, attack surface monitoring, malware detection
- Aikido Images (CVE-free) and same-day support
- 100 AI credits a month for AI pentesting, Deep PR Reviews and AI code analysis
-
Advanced
$1,050 per month
$1,050 a month billed monthly, or $11,340 a year billed annually (10% off)
- Flat fee including 10 users; the price changes with the user count chosen (10, 20 or 30)
- Up to 500 repos, 200 container images, 20 domains, 20 cloud accounts and 100 VM scaling groups
- Unlimited AI AutoFixes and 50M protected requests a month
- Broker for internal apps, private registry proxy, FIPS base images, SIEM integration
- Higher API rate limits and priority support in Slack or MS Teams
- 200 AI credits a month for advanced AI features
Features
- Included: Quality gate that fails the build
- Included: Pull request decoration with findings
- Included: New-code-only analysis against a baseline
- Included: Custom rule authoring
- Not included: Rule set configuration per project
- Included: SAST security vulnerability rules
- Included: Hardcoded secrets detection
- Included: Software composition analysis of dependencies
- Not included: Code duplication detection
- Not included: Complexity and maintainability metrics
- Included: Test coverage import and tracking
- Included: IDE plugin with live findings
- Included: Analysis for 20 or more languages
- Included: Infrastructure-as-code scanning
- Included: Automated fix suggestions for findings
- Included: Portfolio-level quality dashboards
- Not included: Self-hosted analysis server
- Not included: Free analysis for open source projects
Additional Features
- AI SAST with built-in security rules
- Custom rules written in Opengrep
- Open-source dependency scanning for CVEs and malware
- License risk and end-of-life package checks
- Live secret detection for keys, passwords and tokens
- Infrastructure-as-code scanning for Terraform, CloudFormation, Docker and Pulumi
- Container image scanning
- Cloud misconfiguration checks
Best for
- Small and growing engineering teams that want code, cloud and runtime checks in one account
- Startups setting up security for the first time
- Developers who want fixes delivered as pull requests
- Teams on GitHub, GitLab, Bitbucket or Azure DevOps
- Companies collecting audit evidence in Drata or Vanta
- Security staff who need one view across many repositories
- Organisations that require FedRAMP moderate
Use cases
- Blocking pull requests that introduce new security issues
- Scanning open-source dependencies for CVEs, malware and license problems
- Catching API keys and tokens committed to a repository
- Checking cloud accounts for misconfigurations
- Scanning container images before deployment
- Running an AI pentest against a web application
- Failing a GitHub pull request when test coverage drops below a minimum
- Writing in-house detection rules in Opengrep
- Sending findings to Jira or Linear for tracking
- Scoring code quality across every connected repository
- Fixing vulnerable code through AutoFix pull requests
Screenshots & Videos
Explore Aikido Security in action
User Reviews
Compare with Similar Software
Click to compare side by side with Aikido Security
