Aikido
Application security platform spanning code, cloud, container and runtime scanning with AI triage, autofix and automated pentesting.
Deployment
Cloud · Self-Hosted · Air-Gapped
Languages
17+
Pricing model
Per developer seat, Usage-based credits, Quote-based
Free plan
Yes
Partial means the documentation covers only part of a capability, a related capability, or a beta. The description next to it says what is covered.
Workflow coverage
Where in the development lifecycle Aikido operates.
7 yes 1 no
| Feature | Availability | Description |
|---|---|---|
| Real-Time IDE Feedback | Yes | VS Code, JetBrains, Visual Studio, Eclipse, Vim/Neovim plugins give real-time findings |
| AI Agent Guardrails | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Local Analysis (Pre-Commit) | Yes | Local Scanner CLI runs code, secrets, dependency and IaC scans locally; a pre-commit hook checks staged code for secrets. |
| Inline PR Comments | Yes | Pull request scanning and comments on GitHub, GitLab, Bitbucket, Azure DevOps |
| Quality Gates (Merge Blocking) | Yes | Status checks and merge gate enforcement; GitLab merge request approval rules |
| Full Repo Scan | Yes | Six repo scanners: SCA, SAST, secrets, license, IaC, malware |
| Scheduled Rescans | Yes | Continuous monitoring of cloud infra, container registries and deployed front-ends |
| Runtime Monitoring | Yes | Zen Firewall runtime WAF (sidecar, reverse proxy, inline library); Advanced/Enterprise plan only |
Security scanning
11 yes 2 partial
| Feature | Availability | Description |
|---|---|---|
| SAST | Yes | 13 named languages; SQLi, XSS, CSRF, deserialization, crypto, command injection, path traversal, XXE |
| Taint Analysis (Data-Flow) | Yes | Data flow analysis inside AI Deep Review; credit-metered, Pro plan and above |
| Secrets Detection | Yes | 100+ secret patterns: API keys, SSH/PGP keys, AWS, DB creds, OAuth tokens |
| Secrets Validation | Partial | Contextual flagging separates actively used secrets from test values; no provider verification claimed |
| SCA | Yes | Lockfile and dependency-tree scanning across 20+ package managers with chain visualization |
| Reachability Analysis | Partial | AI CVE exploitability analysis prioritizes exploitable over theoretical; no call-path reachability claimed |
| Malicious Package Detection | Yes | Malware in packages, typosquatting, supply chain compromise, suspicious behavior patterns |
| License Compliance | Yes | SPDX identification, permitted/restricted/forbidden policies, org-wide enforcement, compliance reports |
| SBOM Generation | Yes | Exports full SBOM (CycloneDX, SPDX, CSV) from Licenses & SBOM report |
| IaC Scanning | Yes | Terraform, CloudFormation, Kubernetes, Docker, Helm, Ansible, ARM, Bicep, Pulumi, CDK, Serverless |
| Container Scanning | Yes | 15+ registries; base image vulns, layer secrets, malicious packages, misconfigurations |
| CSPM | Yes | 16+ providers; IAM, buckets, security groups, DNS, VPC, encryption, continuous monitoring |
| DAST | Yes | Front-end domain DAST plus REST, GraphQL, gRPC, WebSocket API scanning |
Code quality
2 yes 3 partial 4 no
| Feature | Availability | Description |
|---|---|---|
| Code Smell Detection | Yes | AI quality rules check PRs; credit-paid repository scans rate maintainability, readability, performance and reliability. |
| Complexity Metrics | Partial | AI rules flag long functions and deep nesting; no computed complexity metric. |
| Duplication Detection | Partial | AI rule flags obvious within-file duplication only; no cross-file clone detection or metric. |
| Dead Code Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Test Coverage Tracking | Yes | Uploads LCOV and Cobertura reports from CI; coverage per repository, file and line with trends. |
| Diff Coverage (New Code) | Partial | GitHub PR check fails when total report coverage is below a threshold; no changed-line coverage. |
| Architecture Governance | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Technical Debt Quantification | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Behavioral Code Analysis | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
AI review & fixes
4 yes 1 no
| Feature | Availability | Description |
|---|---|---|
| AI Logic Bug Detection | Yes | Deep Review finds business-logic vulnerabilities; security-scoped, 1 credit per pull request |
| PR Summaries & Walkthroughs | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Autofix Suggestions | Yes | AutoFix suggests dependency, SAST, IaC and secret-rotation fixes; compatibility tested |
| Autofix Pull Requests | Yes | AutoFix opens pull requests with proposed fixes; never auto-merged |
| AI Triage (False-Positive Filtering) | Yes | AutoTriage ranks by exploitability, effort, false-positive probability; Secrets AutoTriage included |
Rules & repo support
1 yes 1 no
| Feature | Availability | Description |
|---|---|---|
| Custom Rule Authoring | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Monorepo Support | Yes | Split monorepo per path (Pro+); GitLab/Azure DevOps only, no secrets scanning |
AI capabilities
4 yes 3 no
| Feature | Availability | Description |
|---|---|---|
| AI Code Review | Yes | Deep Review performs AI contextual code review of business logic and attack paths |
| Bring Your Own Model | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| MCP Server | Yes | Aikido MCP Plugin exposes its own MCP server (scan, list/ignore issues, login tools) for AI agents |
| AI Code Governance | No | No AI-generated-code governance; Device Protection inventories AI tool, model and MCP usage per workstation instead. |
| Conversational Review | Yes | Ask Aikido answers natural-language security questions about code; not a PR review thread |
| Learning From Feedback | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Code Excluded From Training | Yes | "Never use, store, or train on customer data"; AI ops are inference-only, not retained |
Compliance & governance
4 yes
| Feature | Availability | Description |
|---|---|---|
| Audit Logs | Yes | Activity log records issue actions such as snooze, ignore, severity changes and AutoFix PRs; API export needs Basic. |
| SSO (SAML) | Yes | SAML SSO included from the Basic tier, not gated to Enterprise |
| Role-Based Access Control | Yes | Admin, default and team-only roles; default and team-only users can be read-only, with per-user permission toggles. |
| Compliance Reporting & Exports | Yes | AI Custom Reports include compliance-ready documentation (Pro+); license compliance reports on all plans |
Certifications
SOC 2 Type IIISO 27001ISO 42001GDPRFedRAMP Moderate (in process, not yet authorized)
Standards mapping
OWASP Top 10CWE (100+ mappings)PCI DSSGDPRCCPAHIPAASOC 2SPDX license identifiers
Integrations
10 yes
| Git provider | Availability |
|---|---|
| GitHub | Yes |
| GitHub Enterprise Server | Yes |
| GitLab | Yes |
| GitLab Self-Managed | Yes |
| Bitbucket | Yes |
| Bitbucket Data Center | Yes |
| Azure DevOps | Yes |
| API & CLI | Availability |
|---|---|
| REST API | Yes |
| CLI | Yes |
| Webhooks | Yes |
CI/CD systems
GitHub ActionsGitLab CI/CDJenkinsBambooTeamCityAWS CodePipelineAzure PipelinesTravis CICircleCIBitbucket Pipelines
IDEs
VS CodeIntelliJ IDEAWebStormPyCharmGoLandVisual StudioEclipseVimNeovim
Issue trackers
Jira (Cloud and Server)ServiceNowLinearClickUpAzure BoardsGitHub IssuesGitLab IssuesYouTrackAsanaMonday.comShortcut
Chat & notifications
SlackMicrosoft TeamsEmail
Languages
Languages and frameworks named in Aikido's documentation.
JavaScriptTypeScriptJavaC#PHPPythonRubyGoElixirRustCKotlinScalaSwiftObjective-CDartClojure
Pricing & plans
$31.50/user/month billed annually (10-user minimum on Basic); $35/user/month if billed monthly ($315/mo or $350/mo total for 10 users)
Minimum seats: 10 (Basic plan minimum; Free plan includes 2 users)
Free$0Individual developers, open-source projects, small teams evaluating
- SCA dependency scanning, SAST & AI SAST, secrets detection
- Cloud (CSPM-lite), license risk, outdated software & IaC scanning
- IDE plugins, rescans every 3 days
- 10 repos, 2 container images, 1 domain, 1 cloud account, 10 AI AutoFixes/mo, 250k protected requests/mo
- No PR security review, no Jira/Linear/Drata/Vanta sync
- Device Protection limited to npm and PyPI malware blocking; no AI & Bot Protection (Basic+)
- No API scanning, attack surface monitoring, on-prem scanning or dependency malware detection (Pro+)
- Community support only
Basic$350/month for 10 users ($3,780/year billed annually, 10% off)Small teams to cover the basics
- All Free features, plus: PR Security Review
- Sync issues to Jira, Linear & more; sync to Drata, Vanta & more
- Reports & analytics, PR code quality checks
- AI & Bot Protection, Device Protection (AI tools & models detection)
- Aikido Libraries (CVE-free), SSO (SAML), SBOM generation, MCP server, audit log
- 100 repos, 50 container images, 3 domains, 3 cloud accounts, unlimited AI AutoFixes/mo, 10M protected requests/mo
- Full-repository AI analysis is credit-based, not unlimited
- No on-prem scanning, VM scanning, attack surface monitoring or malware detection (Pro+)
- No monorepo splitting (Pro+)
- No broker for internal apps, FIPS images or FedRAMP ATO (Advanced+)
Pro$700/month for 10 users ($7,560/year billed annually, 10% off) — most popularGrowing teams to scale security
- All Basic features, plus: on-prem scanning, virtual machine scanning
- Attack surface monitoring, malware detection
- Same-day support, Aikido Images (CVE-free)
- Monorepo splitting (GitLab/Azure DevOps only, SCA/SAST/IaC only)
- 100 credits/month included for AI Pentesting, Deep PR Reviews, AI Code Analysis
- 200 repos, 100 container images, 10 domains, 10 cloud accounts, 20M protected requests/mo
- No broker for internal apps, private registry proxy, FIPS base images or FedRAMP ATO (Advanced+)
- No multi-tenant portal (Advanced+)
- Credits are metered, not unlimited, for advanced AI features
Advanced$1,050/month for 10 users ($11,340/year billed annually, 10% off)Orgs with advanced needs
- All Pro features, plus: broker for internal apps, private registry proxy
- Higher API rate limits, FIPS base images, FedRAMP ATO
- Priority support in Slack or MS Teams
- Multi-tenant portal
- 200 credits/month included
- 500 repos, 200 container images, 20 domains, 20 cloud accounts, 50M protected requests/mo
- Highest published tier — anything beyond (custom volume, bespoke SLAs) requires Enterprise
- Credits still metered for advanced AI features
EnterpriseCustom (contact sales)Large enterprises and organizations needing bespoke terms beyond Advanced
- Everything in Advanced, with custom limits, contracts and support terms
- Quote-only pricing — no published numbers
Who it's for
Best for teams that want code, cloud, container and runtime security from one vendor, starting on a free plan.
A good fit if
- You want SCA, SAST, secrets, license, IaC and malware scanning on the free plan
- You also need cloud posture, container scanning and runtime protection in the same product
- You want fixes and triage handled for you, with AI AutoFix pull requests and automatic triage
Consider alternatives if
- You need complexity or duplication metrics
- You need fully offline use without an add-on, since that needs the separately priced Aikido Machine
Similar tools
Other Code Security Platform tools in the directory.
Checkmarx OneApplication Security Posture Management platform bundling SAST, SCA, IaC, container, API, secret, and DAST scanners under one risk model.CorgeaAI-native AppSec platform (BLAST SAST) that finds business-logic vulnerabilities across code, dependencies, containers and IaC, and ships AI-generated pull-request fixes.GitHub Advanced SecurityGitHub-native AppSec sold as two add-on SKUs — Secret Protection and Code Security — with CodeQL SAST, Dependabot SCA, secret scanning.SemgrepOpen-source pattern-matching SAST engine plus a commercial AppSec Platform adding SCA, secrets detection, policy governance and AI triage.SnykDeveloper security platform covering SAST, SCA, container, IaC, secrets and DAST scanning with risk scoring and automated fix PRs.VeracodeEnterprise AppSec platform spanning SAST, SCA, DAST, container/IaC scanning, AI auto-remediation, ASPM risk management, and developer training.
FAQ
When should you choose Aikido?
Aikido is best for teams that want code, cloud, container and runtime security from one vendor, starting on a free plan. It's a good fit if:
- You want SCA, SAST, secrets, license, IaC and malware scanning on the free plan
- You also need cloud posture, container scanning and runtime protection in the same product
- You want fixes and triage handled for you, with AI AutoFix pull requests and automatic triage
Consider alternatives if:
- You need complexity or duplication metrics
- You need fully offline use without an add-on, since that needs the separately priced Aikido Machine
What languages does Aikido support?
Aikido supports 17+ languages and frameworks, including JavaScript, TypeScript, Java, C#, PHP, Python, Ruby, Go, Elixir, Rust, and 7 more.
What does Aikido integrate with?
Aikido integrates with:
- Source control: GitHub, GitHub Enterprise Server, GitLab, GitLab Self-Managed, Bitbucket, Bitbucket Data Center and Azure DevOps
- CI systems: GitHub Actions, GitLab CI/CD, Jenkins, Bamboo, TeamCity and 5 more
- IDEs: VS Code, IntelliJ IDEA, WebStorm, PyCharm, GoLand and 4 more
What tools are similar to Aikido?
Other code security platforms tracked here:
What are Aikido's plans and pricing?
Aikido has a free plan, and paid plans start at $31.50/user/mo.
Opens www.aikido.dev in a new tab. Review Radar is not affiliated with Aikido.