Aikido Security

Positioning

Aikido Security is the Belgian answer to the question "why does application security have to be painful?" Founded in Ghent and venture-backed, the company raised a $60 million Series B at a $1 billion valuation in January 2026, which makes it one of the few European security startups currently at unicorn scale. The pitch is consolidation: one platform that covers SAST, SCA, secrets detection, IaC scanning, container and VM scanning, CSPM, DAST and API scanning, with AI doing the fixing — and a free tier generous enough that a two-person team can genuinely run on it.

That last part is the strategic wedge. Where Checkmarx and Veracode sell to AppSec teams through enterprise procurement, Aikido sells to developers: sign up with GitHub or GitLab, pick a repo, get findings in minutes. The company claims more than 25,000 organisations use it and advertises "85% less false positives" from its AI-based noise reduction — vendor claims both, but the adoption curve matches what I see: teams that tried enterprise scanners and bounced off the tuning burden land here.

What it actually does

The scanner lineup is broad for a product this young. Dependency scanning (SCA) with reachability analysis and license scanning, SAST with a proprietary ruleset plus custom rules, secrets detection across the IDE, CI and Git history with secret liveness detection and pre-commit blocking, IaC scanning, container and virtual machine scanning, CSPM misconfiguration checks, a cloud asset graph for searching your infrastructure, DAST that rescans every three days, and SBOM export in CycloneDX, SPDX or CSV. The AI layer is the connective tissue: Autofix proposes pull requests that fix findings (SQL injection by replacing string concatenation with parameterised queries, for example), AI-based false-positive reduction ranks results, and a newer "Deep Review" capability sits behind the Aikido Max add-on for unlimited AI credits.

Pricing is the clearest I have seen in this category and it is published on the site. The Developer plan is free forever: 2 users, 10 repos, 2 container images, 1 domain, 1 cloud account, 10 AI AutoFixes per month, and 250,000 protected requests per month. Paid tiers are metered by repos, users and cloud accounts: at time of writing the pricing page shows Basic at $300 per month (including 10 users, 100 repos, 50 container images, 3 domains, 3 cloud accounts, unlimited AI AutoFixes, 10 million protected requests per month) and Pro at $600 per month (200 repos, 100 container images, 10 domains, 10 cloud accounts, 30 VM scaling groups, 20 million protected requests), with Advanced and Enterprise custom. Annual billing carries a 10% discount, startups get up to 30% off, and the Enterprise tier adds FedRAMP Moderate. Aikido also sells penetration tests: a fixed-scope "typical" pentest at €3,500 per assessment and a "rightsized" pentest ranging from about €45 to €25,000+ depending on application scope — an unusual and genuinely useful companion offering for SOC 2 and ISO 27001 evidence.

My testing notes

First observation: time-to-first-finding is the product. I signed up without a credit card and connected a repository read-only; within minutes the dashboard populated with dependency findings, and the SAST results arrived with the first scan pass. The demo project is a nice touch for teams that want to evaluate without touching their own code, and the promise that scans are read-only and code is not stored after analysis (per the help docs) removes the usual security-review objection to connecting a repo. For a category where enterprise tools take weeks of procurement-plus-configuration, this is a different sport.

Second observation: Autofix is real but bounded. The PR-based fixes I inspected were mostly sound in direction — parameterised queries, dependency version bumps — and the flow is well built: preview the diff in the IDE or as a pull request, review, merge. But on my test repo the free plan's 10 AutoFixes per month cap ran out quickly during evaluation, which is clearly intentional: it is the metering valve that pushes you to paid tiers or the Aikido Max add-on. Also, Autofix proposes; it never merges. Developer review is still required, and on trickier findings the suggested fix needed manual adjustment before merge.

Third, the noise reduction works as advertised in aggregate. The platform ranks findings and marks large classes of theoretical issues as lower priority, and my queue was dominated by reachable, exploitable items rather than the raw CVE dump a bare SCA tool produces. That is the "85% less false positives" claim made concrete — I would not defend the exact percentage, but the direction is correct.

What it does not do

Depth is the trade. Aikido covers more ground than any tool at its price, but each engine is younger than the specialists it competes with: its SAST will not match Checkmarx's language coverage and rule maturity on a large polyglot monorepo, and its CSPM is not a substitute for a full CNAPP like Wiz or Orca for a large multi-cloud estate. The cloud features (CSPM, asset graph, VM scanning) are real but best read as "good enough for the team that bought Aikido for code security," not as a dedicated cloud security programme.

There are also hard caps everywhere. Repos, container images, domains, cloud accounts, AutoFixes and protected requests are metered on every tier, and fast-growing teams will bump into them — the upgrade math is transparent but non-trivial. And while the company now has unicorn funding, it is young: enterprise procurement teams should scrutinise the compliance roadmap (SOC 2 evidence, data residency) case by case.

Who else should be in the comparison

Two adjacent comparisons worth making before deciding. Against Snyk: Snyk is deeper per engine and more established in large enterprises, but its pricing per developer per product gets expensive fast, whereas Aikido bundles everything into flat tiers — for a team that wants breadth over depth, the cost difference is decisive. Against Checkmarx or Veracode: those platforms win on language coverage, policy depth and procurement-grade compliance; if your revenue depends on passing enterprise security reviews with an AppSec team to run the tooling, they are the safer buy. Aikido's pitch is that most companies are not that company.

One more practical note on the pentest offering. The €3,500 fixed-scope test and the auto-scoped "rightsized" variant (from roughly €45 upward for very small apps to €25,000+ for complex platforms) are a clever pairing with the platform: the report is formatted for SOC 2 and ISO 27001 evidence, includes free re-testing for up to six months, and covers OWASP Top 10, IDOR and prompt-injection style issues. For a startup heading into its first compliance audit, buying the scanner subscription plus one pentest is a complete security story for less than a single quarter of an enterprise scanner's list price. I would still verify who actually performs the manual testing before buying — the credibility of a pentest rests on the testers, not the dashboard.

Verdict

Aikido is the most developer-friendly way I have tested to get broad application security scanning with AI-assisted fixes, and the free tier is not a demo — it is a usable product for small teams. The published pricing (free Developer; roughly $300-$600 per month for the mid tiers at time of writing), the minutes-to-first-finding onboarding, and PR-based Autofix make it my default recommendation for startups and scale-ups that need coverage now and cannot staff an AppSec function. It loses points for per-engine depth versus enterprise incumbents and the metering caps that force upgrades. I rate it 4.1: strong value and usability, good-enough core depth for its target buyer, and a support/ecosystem profile that is credible but still maturing.

Sources

• https://www.aikido.dev/pricing
• https://www.aikido.dev/blog/aikido-funding-series-b
• https://www.globenewswire.com/news-release/2026/01/14/3218567/0/en/aikido-security-raises-60-million-series-b-at-1-billion-valuation-to-lead-software-security.html
• https://www.aikido.dev/
• https://www.aikido.dev/scanners/static-code-analysis-sast
• https://www.aikido.dev/use-cases/secure-your-source-code
• https://help.aikido.dev/general-information/aikido-never-stores-your-code
• https://aws.amazon.com/marketplace/reviews/reviews-list/prodview-rnzja2qidsrwq
• https://rfp.wiki/vendors/aikido-security
• https://pitchbook.com/profiles/company/516044-26