Aikido Security is an ASPM platform used by over 50,000 organizations and 100,000+ teams. The Belgian company bundles SAST, DAST, SCA, container scanning, secrets detection, CSPM, IaC scanning, and runtime protection into one platform. AutoTriage cuts alert noise by 95%.
Founded in 2022 in Ghent, Belgium, with a San Francisco office, Aikido is SOC 2 Type II and ISO 27001:2022 certified. Customers include Revolut, Niantic, Premier League, SoundCloud, Kong, Visma, Pendo, and n8n.
What is Aikido Security?
The platform splits into four areas, each covering a different part of the security problem:
Aikido uses read-only repository access and runs analysis in temporary Docker containers that get deleted after each scan. Setup takes minutes — connect your repositories and scanning starts with sensible defaults.
Key features
Noise reduction
The noise reduction works through several layers. Deduplication catches the same vulnerability found by multiple scanners and reports it once. Reachability analysis filters SCA vulnerabilities by actual code usage. Context correlation groups related findings into single actionable issues.
Aikido reports 95% fewer alerts compared to running equivalent standalone scanners.
Malicious package detection
Beyond known CVEs, Aikido catches packages with malicious behavior:
| Threat type | What Aikido detects |
|---|---|
| Typosquatting | Packages mimicking popular library names |
| Dependency confusion | Private package name collisions with public registries |
| Supply chain compromise | Legitimate packages with injected malicious code |
| Suspicious scripts | Installation scripts with unexpected network calls or file access |
AutoFix remediation
AutoFix generates pull requests with remediation code. It handles SAST findings, dependency upgrades, IaC misconfigurations, and secrets rotation — all without leaving the Aikido dashboard.
Runtime protection with Zen
Zen, Aikido’s in-app firewall, adds runtime defense in production. It blocks attacks, detects bots, monitors LLM usage, and works without code changes.
Integrations
GitHub
GitLab
Bitbucket
Azure DevOps
GitHub Actions
GitLab CI
Azure Pipelines
Jira
Monday
ClickUp
Asana
Vanta
Drata
Slack
Microsoft TeamsGetting started
CI/CD integration
GitHub Actions:
name: Aikido Security Scan
on: [push, pull_request]
jobs:
aikido:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run Aikido Scan
uses: AikidoSec/github-actions-workflow@v1.0.13
with:
secret-key: ${{ secrets.AIKIDO_SECRET_KEY }}
minimum-severity: critical
Local scanning
# Pull the local scanner Docker image
docker pull aikidosecurity/local-scanner:latest
# Run a local code scan
docker run --rm -v $(pwd):/code aikidosecurity/local-scanner:latest \
aikido-local-scanner scan /code
When to use Aikido Security
Aikido works best for teams that want broad security coverage without enterprise overhead. Startups and mid-market companies building security programs from scratch get the most out of it, especially developer-led teams that want scanning running in minutes. The free tier covers smaller teams; flat-rate enterprise pricing with unlimited users handles growth.
Teams with large existing tool investments or those that need the deepest possible analysis in a single category may prefer dedicated vendors. Apiiro or ArmorCode are better fits for enterprises that want to aggregate findings from existing scanners rather than replace them.
