Review Summary
Users appreciate Aikido Security for its clean, focused interface, comprehensive all-in-one security platform, and r ...
Users appreciate Aikido Security for its clean, focused interface, comprehensive all-in-one security platform, and r ...



Aikido is a developer-centric security platform that gives developers and security teams an instant overview of all code-to-cloud security issues and guides teams to fix vulnerabilities fast. Aikido supports security teams execute by aggressively reducing false-positives, automatic triage and risk bundling, and translating Common Vulnerabilities and Exposures (CVEs) into easy step-by-step explanations to resolve. Described as an "all-in-one" application security platform, Aikido's covers the entire Software Development Lifecycle (SDLC), including: static application security testing (SAST), dynamic application security testing (DAST), infrastructure-as-code (IaC), container scanning, secrets detection, open source lisence scanning, cloud posture management (CSPM), runtime protection, and more.
Do You Manage Peer Insights at Aikido Security?
Access Vendor Portal to update and manage your profile.
Aikido delivers several standout strengths that materially enhance the effectiveness and efficiency of our application security programme. The following provide the most value: - Seamless GitHub integration and large scale onboarding. The App pattern makes it exceptionally easy to onboard repositories in bulk, while the native integration ensures that users and teams are imported cleanly and kept aligned with our existing developer workflows. - Comprehensive and effective security scanning coverage. The platform brings together a broad suite of embedded scanners, including SCA, SAST, secrets detection and IAC analysis. The inclusion of DAST with support for both GraphQL and REST API scanning further strengthens its technical depth. - Strong developer-centric experience that accelerates remediation. The portal offers a clear and intuitive user interface and places a real emphasis on helping developers prioritise and resolve issues. Explanations are accessible, suggested auto-fixes are helpful and the ability to open pull requests directly supports rapid action. Additional aspects that consistently add value include noise reduction and transparent prioritisation, industry-leading supply chain and malware monitoring, and the robust set of search and filtering options. These strengths combine to create a platform that is powerful and highly usable, enabling engineers to adopt security practises with confidence and velocity.
One product to cover most of our needs. It's easy to use and the detection seems to be on par with the competition. - One platform covers a lot of tools (CSA, SATS, License, Malware protection, ...). - Integration into existing tools/flows. - Easy to understand pricing model.
The auto triaging and auto ignoring of findings has been one of the highlights, enabling appsec team to focus on what really matters. Very easy and straightforward layout and user experience. Enabling quick analysis and remediation. The AI features are well embedded into the platform and into IDE plugins.
There are a few areas, which are admittedly challenging across the industry, where we still experience friction at scale. The secret scanning capability offers limited visibility into the underlying rules, which makes it more difficult to tune for repeated false positives across large environments. To their credit, Aikido does offer multiple ways to manage this, although in practise it is not yet as polished as their stronger features. The license scanning can also generate false positives that can be presented as critical legal risks, which at times can undermine confidence in the severity model when viewed alongside genuine critical AppSec vulnerabilities. Although this capability can be disabled, it would be far better if it would be more accurate by default, or could be more finely tuned. The reporting and trends presented in the UI are strong, but exposing this data through API access would significantly improve our ability to integrate with internal business analytics. Pull request scanning would be even better with more conversational, in-line guidance, so that developers can review issues, apply suggested fixes, and manage exceptions without switching context to the Aikido portal.
When setting up initially, it would be great to be able to only gradually get old issues highlighted instead of being flooded with everything at once. This is a common issue with any kind of scanning/detection tool, but there must be a better way to get started, rather than over-whelming your teams. - Initial findings can flood the team - even if the findings are less critical. - Two way sync for ticket/finding status/level. - Some features are so new that they are not mentioned in which plan they are included.
It could provide more information on some of the listed vulnerabilities. Filtering options can be improved, to allow filtering for specific use cases.