Aikido Security

No entries match these filters. Clear filters

1. 🚀External Network Pentesting: test your perimeter before someone else does seen Oct 29, 2026 · issue 124

   Aikido Security adds External Network Pentesting — AI agents map your perimeter and exploit findings from outside, with no code access or credentials required⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Start an external network pentest against your perimeter by supplying your top-level domains through the Aikido console.
   📍1. In the Aikido console, navigate to Pentesting › External Network Pentesting. 2. Add one or more top-level domains to scope. 3. Review the discovered subdomains, IP addresses, open ports and services; remove anything to keep out of scope. 4. Set your maximum requests per second per target and optionally restrict testing to inside or outside business hours. 5. Click Start Pentest — the quoted credit cost is shown before anything runs.
   Enable continuous mode so newly exposed subdomains are automatically tested shortly after they go live, without manually kicking off a new pentest.
   📍1. In the Aikido console, open your External Network Pentest configuration. 2. Under Run mode, select Continuous. 3. Confirm the yearly credit price (based on assets found in your first pentest) and save.
   • Aikido Security now offers an External Network Pentesting capability where AI agents discover subdomains, open ports, and services from a list of top-level domains, then attempt exploitation using known CVEs, misconfigurations, and exposed secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Agents chain findings across hosts — using credentials or access found on one system to pivot to the next — and the report shows the full attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. from entry point to impact.
   • Watch agents work in real time via the Agents tab, which shows each agent's current thinking, tools in use, and findings so far.
   • Run pentests in continuous mode so newly discovered subdomains are tested shortly after they go live.
   • Control test intensity by setting a maximum requests per second per target, or restrict testing to inside or outside business hours.

   +2 more show less

   • A scoping agent checks how much of each subdomain you own and limits testing to the parts you control, with all agent traffic routed through a proxy that blocks out-of-scope connections.
   • External network pentests produce an auditor-ready report in the same format as Aikido's web app and mobile pentests, covering the attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. up to the login page.

   7 details in Everything

2. 🚀External Network Pentesting: test your perimeter before someone else does seen Oct 29, 2026 · issue 018

   Aikido Security adds External Network Pentesting — AI agents map your perimeter and exploit findings from outside, with no code access or credentials required⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Start an external network pentest against your perimeter by supplying your top-level domains through the Aikido console.
   📍1. In the Aikido console, navigate to Pentesting › External Network Pentesting. 2. Add one or more top-level domains to scope. 3. Review the discovered subdomains, IP addresses, open ports and services; remove anything to keep out of scope. 4. Set your maximum requests per second per target and optionally restrict testing to inside or outside business hours. 5. Click Start Pentest — the quoted credit cost is shown before anything runs.
   Enable continuous mode so newly exposed subdomains are automatically tested shortly after they go live, without manually kicking off a new pentest.
   📍1. In the Aikido console, open your External Network Pentest configuration. 2. Under Run mode, select Continuous. 3. Confirm the yearly credit price (based on assets found in your first pentest) and save.
   • Aikido Security now offers an External Network Pentesting capability where AI agents discover subdomains, open ports, and services from a list of top-level domains, then attempt exploitation using known CVEs, misconfigurations, and exposed secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Agents chain findings across hosts — using credentials or access found on one system to pivot to the next — and the report shows the full attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. from entry point to impact.
   • Watch agents work in real time via the Agents tab, which shows each agent's current thinking, tools in use, and findings so far.
   • Run pentests in continuous mode so newly discovered subdomains are tested shortly after they go live.
   • Control test intensity by setting a maximum requests per second per target, or restrict testing to inside or outside business hours.

   +2 more show less

   • A scoping agent checks how much of each subdomain you own and limits testing to the parts you control, with all agent traffic routed through a proxy that blocks out-of-scope connections.
   • External network pentests produce an auditor-ready report in the same format as Aikido's web app and mobile pentests, covering the attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. up to the login page.

   7 details in Everything

3. announced Oct 28, 2026 · issue 127

   Aikido Security adds external network pentesting driven by AI agents that map, attack, and chain findings across your internet-facing perimeter⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Start an external network pentest when you want to see everything attackers can reach under your domain before they do.
   📍In the Aikido product, go to Pentesting › External Network, enter your root domain, verify ownership, review the auto-generated asset list (remove any hosts you do not want tested), confirm the quote, and launch the pentest. Agents begin mapping subdomains and attacking each discovered host immediately.
   • Aikido now runs external network pentests starting from a single domain, where AI agents discover subdomains and internet-facing hosts — websites, APIs, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. gateways, mail servers, self-hosted tools — and attack each one using known CVEs, misconfigurations, and exposed secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Agents chain multi-step findings (for example: exposed .git folder → SSH credentials → Azure admin access) and include the full exploit chain in the report so teams can see what an attacker could actually reach.
   • A continuous pentesting mode re-maps the perimeter on every run and starts testing newly discovered hosts shortly after they go live, rather than waiting for a scheduled engagement.
   • Each finding includes a fix suggestion and a retest agent that checks whether the fix resolved the issue and whether it opened a new weakness elsewhere; retests are available for up to six months.
   • External network pentesting runs inside the same product as Aikido's existing web app and mobile pentests, with a shared findings and retest interface and the same proof-of-exploit standard across all pentest types.

   +1 more show less

   • Every pentest produces an audit-ready report with validated findings, proof of exploit, and remediation guidance suitable for compliance and auditor review.
   • Aikido now runs external network pentests starting from a single domain, where AI agents discover subdomains and internet-facing hosts — websites, APIs, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. gateways, mail servers, self-hosted tools — and attack each one using known CVEs, misconfigurations, and exposed secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Agents chain multi-step findings (for example: exposed .git folder → SSH credentials → Azure admin access) and include the full exploit chain in the report so teams can see what an attacker could actually reach.
   • A continuous pentesting mode re-maps the perimeter on every run and starts testing newly discovered hosts shortly after they go live, rather than waiting for a scheduled engagement.
   • Each finding includes a fix suggestion and a retest agent that checks whether the fix resolved the issue and whether it opened a new weakness elsewhere; retests are available for up to six months.
   • Every pentest produces an audit-ready report with validated findings, proof of exploit, and remediation guidance suitable for compliance and auditor review.

   1 more in Everything

4. #58 - Cloud Security Audits, External Network Pentesting and Aikido is now FedRAMP Moderate seen Oct 23, 2026 · issue 117

   Aikido adds Cloud Security Audits, External Network Pentesting, FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. authorization, Google SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. integration, and new Zen Firewall agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ HOW TO FIND IT
   Forward Aikido Activity logs to Google SecOps for centralized SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. alerting and correlation.
   📍Steps: In Aikido, go to Settings › Integrations › SIEM, enable Transmit Activity logs, and select Google SecOps as the destination.
   • Adds new API endpoints: API - List CWE descriptions to retrieve CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. metadata, API - List pending invites to query outstanding user invitations, API - List AI code analysis assessments to fetch AI code analysis results, API - List pentest assessments to retrieve pentest findings, API - Disable user to deactivate users, and API - Remove attach surface subdomain to remove subdomains from the attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New Google SecOps integration to optionally forward Aikido Activity logs to a SIEM.
   • Adds Zen Firewall agent releases for Dotnet, Python, PHP, Ruby, and Node.
   • Adds Hugging Face to supported malware ecosystems in Aikido Intel.
   • Adds Terraform Container management resources and publishes the Aikido provider to the OpenTofu registry.

   +4 more show less

   • Removes the maximum-rule restriction for Code Quality scans and enables auto-creation of PRs for issues found in full repository scans.
   • New Cloud Security Audit feature: AI agents reason across cloud and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. configurations to surface multi-step attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. and link each finding back to the causative template.
   • New External Network Pentest capability to scan internet-exposed assets — including forgotten subdomains and open admin panels — with evidence-confirmed findings.
   • Aikido for Government achieves FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Moderate authorization and is listed on the FedRAMP Marketplace, allowing federal agencies to adopt Aikido without a full security review.
   • Adds new API endpoints: API - List CWE descriptions to retrieve CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. metadata, API - List pending invites to query outstanding user invitations, API - List AI code analysis assessments to fetch AI code analysis results, API - List pentest assessments to retrieve pentest findings, API - Disable user to deactivate users, and API - Remove attach surface subdomain to remove subdomains from the attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New Google SecOps integration to optionally forward Aikido Activity logs to a SIEM.
   • Adds Zen Firewall agent releases for Dotnet, Python, PHP, Ruby, and Node.
   • New Cloud Security Audit feature: AI agents reason across cloud and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. configurations to surface multi-step attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. and link each finding back to the causative template.
   • New External Network Pentest capability to scan internet-exposed assets — including forgotten subdomains and open admin panels — with evidence-confirmed findings.

   +1 more show less

   • Aikido for Government achieves FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Moderate authorization and is listed on the FedRAMP Marketplace, allowing federal agencies to adopt Aikido without a full security review.

   3 more in Everything

5. #58 - Cloud Security Audits, External Network Pentesting and Aikido is now FedRAMP Moderate seen Oct 23, 2026 · issue 018

   Aikido adds Cloud Security Audits, External Network Pentesting, FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. authorization, Google SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. integration, and new Zen Firewall agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ HOW TO FIND IT
   Forward Aikido Activity logs to Google SecOps for centralized SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. alerting and correlation.
   📍Steps: In Aikido, go to Settings › Integrations › SIEM, enable Transmit Activity logs, and select Google SecOps as the destination.
   • Adds new API endpoints: API - List CWE descriptions to retrieve CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. metadata, API - List pending invites to query outstanding user invitations, API - List AI code analysis assessments to fetch AI code analysis results, API - List pentest assessments to retrieve pentest findings, API - Disable user to deactivate users, and API - Remove attach surface subdomain to remove subdomains from the attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New Google SecOps integration to optionally forward Aikido Activity logs to a SIEM.
   • Adds Zen Firewall agent releases for Dotnet, Python, PHP, Ruby, and Node.
   • Adds Hugging Face to supported malware ecosystems in Aikido Intel.
   • Adds Terraform Container management resources and publishes the Aikido provider to the OpenTofu registry.

   +4 more show less

   • Removes the maximum-rule restriction for Code Quality scans and enables auto-creation of PRs for issues found in full repository scans.
   • New Cloud Security Audit feature: AI agents reason across cloud and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. configurations to surface multi-step attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. and link each finding back to the causative template.
   • New External Network Pentest capability to scan internet-exposed assets — including forgotten subdomains and open admin panels — with evidence-confirmed findings.
   • Aikido for Government achieves FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Moderate authorization and is listed on the FedRAMP Marketplace, allowing federal agencies to adopt Aikido without a full security review.
   • Adds new API endpoints: API - List CWE descriptions to retrieve CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. metadata, API - List pending invites to query outstanding user invitations, API - List AI code analysis assessments to fetch AI code analysis results, API - List pentest assessments to retrieve pentest findings, API - Disable user to deactivate users, and API - Remove attach surface subdomain to remove subdomains from the attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New Google SecOps integration to optionally forward Aikido Activity logs to a SIEM.
   • Adds Zen Firewall agent releases for Dotnet, Python, PHP, Ruby, and Node.
   • New Cloud Security Audit feature: AI agents reason across cloud and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. configurations to surface multi-step attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. and link each finding back to the causative template.
   • New External Network Pentest capability to scan internet-exposed assets — including forgotten subdomains and open admin panels — with evidence-confirmed findings.

   +1 more show less

   • Aikido for Government achieves FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Moderate authorization and is listed on the FedRAMP Marketplace, allowing federal agencies to adopt Aikido without a full security review.

   3 more in Everything

6. announced Oct 20, 2026 · issue 116

   Aikido launches Noon, a new workforce security platform covering email security, device protection, AI governance, and phishing simulations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   • Introduces Noon, a new workforce security platform separate from Aikido's existing developer-focused tooling, combining email security, device protection, AI governance, and phishing training in one product.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Noon's email security module autonomously detects and removes inbox threats and malicious emails that traditional filters miss.
   • Noon's device protection module covers employee devices against malicious packages, installs, extensions, agent skills, AI tools, risky websites, and apps.
   • Noon's training and simulations module delivers realistic phishing, vishing, smishing, and deepfake attack scenarios personalized by role, behavior, and risk, with lessons delivered in Noon or directly in Slack, Teams, or Google Chat.

   4 details in Everything

7. announced Oct 19, 2026 · issue 116

   Aikido AI Pentest findings and fix evidence now sync automatically into Drata, with 6 months of unlimited retesting included.

   • New integrationAikido AI Pentest findings and compliance evidence sync directly into Drata, eliminating manual spreadsheet exports for audit prep.
   • Every Aikido AI Pentest through the Drata offer includes 6 months of unlimited retesting, so fixes can be verified the same week they ship.

   2 details in Everything

8. 🚀Code Coverage: find what your tests miss seen Sep 24, 2026 · issue 084

   Aikido adds Code Coverage: line-level test coverage for every repo, paired with code quality findings, accepting LCOVLCOVAn open-source front end to GCC's gcov coverage tool that collects line and branch hit counts from instrumented C/C++ code and renders them as HTML reports, giving cyber tools a standard way to measure test coverage. and CoberturaCoberturaAn open-source XML format for reporting code-coverage results, originally from a Java tool of the same name; cyber tools adopt it because most CI systems can parse and display it natively. reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Navigate to the per-file line coverage view in Aikido to check what tests already cover before editing a flagged file.
   📍1. In Aikido, go to Code Quality › Code Coverage. 2. Select the repository from the repo list. 3. Open the File List tab to sort files by coverage percentage. 4. Click the file of interest to see line-by-line coverage highlighting.
   • Adds Code Quality > Code Coverage section to the Aikido dashboard, showing per-repository, per-file, and per-line test coverage alongside existing code quality findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Accepts LCOV and Cobertura coverage report formats, with native support for outputs from Jest and pytest-cov.
   • Provides a GitHub Action and a GitLab CI component for uploading coverage reports to Aikido from CI pipelines, requiring no extra token or self-hosted component.
   • Supports merging split coverage reports across multiple services into a single view when multiple report files are passed in a single upload.
   • Integrates natively with GitHub, GitLab, Bitbucket, and Azure DevOps SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. platforms, with a custom integration path for other platforms.

   +2 more show less

   • Offers two file-browsing modes: a Code Tree tab following directory structure and a File List tab ranking files by coverage percentage.
   • Tracks coverage over time with a per-repository trend graph updated on each upload.

   7 details in Everything

9. 🚀Deep Review: the agentic PR review that cuts merge time and bugs shipped seen Sep 24, 2026 · issue 084

   Aikido launches Deep Review, an agentic PR reviewer that traces logic across repos and posts findings with suggested fixes directly on pull requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Enable Deep Review on a repository and link related repos so cross-repo logic tracing covers your full stack before merging a sensitive change.
   📍In Aikido, navigate to your repository settings, enable Deep Review for the target repo, add linked repositories under Related repos, and select the review level that fits your team.
   Cap monthly Deep Review spend to keep costs predictable across active repositories.
   📍In Aikido, go to Aikido Wallet › Deep Review and set a monthly credit cap. Each PR costs 1 credit ($1) with unlimited re-reviews on the same PR.
   • Introduces Deep Review, an agentic pull request reviewer that reasons across your full codebase — including middleware, global config, and linked repositories — not just the diff.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Flags bugs and unintended side effects in addition to security findings on every pull request.
   • Saves accepted-risk and false-positive decisions to memory so future reviews reflect prior feedback.
   • Runs after existing PR checks (SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., dependency checks) to build on their findings rather than repeat them.
   • Enabled per repository with configurable linked repos and a review level setting; billed at 1 credit ($1) per PR with unlimited re-reviews on the same PR and a configurable monthly spend cap.

   5 details in Everything

10. #56 - Cloud Asset Map, Creating fix PRs with Deep Review and Code Coverage on GitLab seen Sep 23, 2026 · issue 083

    Aikido adds Cloud Asset Map, fix PRs from Deep Review comments, GitLab code coverage, on-prem pentest model, and new APIs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds GET List user logins history API endpoint for auditing authentication activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Broker management API for programmatic control of broker configuration.
    • Adds webhook event for when a new issue ignore/snooze request is accepted or denied.
    • Adds webhook event for when a Domain scan finishes.
    • Introduces Cloud Inventory (Cloud Asset Map): see every cloud resource laid out by region and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware., with exposure findings and firewall rules accessible in one click.

    +14 more show less

    • Enables creating fix pull requests directly from Deep Review: reply to a Deep Review comment requesting a fix and Aikido opens a new PR with the fix built on your current PR.
    • Supports Code Coverage upload from GitLab CI with per-file and per-line results visible in Aikido alongside existing GitHub coverage.
    • Launches Altar, Aikido's first open-weight security model built to run frontier-grade pentesting fully on-prem and air-gapped without sending data to third parties.
    • Adds Zen Firewall agent releases for Java, PHP, Golang, and Node.
    • Adds Alpine support for the Zen Firewall PHP agent.
    • Adds new JetBrains IDE plugin release with support for multi-repository scanning.
    • Adds new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools: Get issue details including pentest information, Deep Review, and other SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scanning tool data.
    • Adds support for grouped bar charts in Custom Reports.
    • Extends Container scanning Reachability to include BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. datasets.
    • Makes VM Reachability available for GCP in Cloud scanning.
    • Adds new infrastructure-focused checks to cloud scanning.
    • Supports creating Task Tracker issues for Code Quality findings.
    • Adds Firefox and Homebrew as new ecosystems in Device Protection.
    • Adds Sensitive Data information to DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores..
    • Adds GET List user logins history API endpoint for auditing authentication activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Broker management API for programmatic control of broker configuration.
    • Adds webhook event for when a new issue ignore/snooze request is accepted or denied.
    • Adds webhook event for when a Domain scan finishes.
    • Introduces Cloud Inventory (Cloud Asset Map): see every cloud resource laid out by region and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware., with exposure findings and firewall rules accessible in one click.

    +4 more show less

    • Enables creating fix pull requests directly from Deep Review: reply to a Deep Review comment requesting a fix and Aikido opens a new PR with the fix built on your current PR.
    • Launches Altar, Aikido's first open-weight security model built to run frontier-grade pentesting fully on-prem and air-gapped without sending data to third parties.
    • Adds Zen Firewall agent releases for Java, PHP, Golang, and Node.
    • Adds Firefox and Homebrew as new ecosystems in Device Protection.

    10 more in Everything

11. 🚀 Code Coverage: find what your tests miss Sep 23, 2026 · release notes

    Aikido adds Code Coverage dashboard to show test coverage per repo, file, and line alongside security findings.

    • Adds a Code Coverage view under 'Code Quality > Code Coverage that lists repositories with overall coverage metrics and last update times
    • Displays line-by-line test coverage for individual files within the repository view
    • Shows coverage evolution over time via a trend graph linked to uploaded LCOVLCOVAn open-source front end to GCC's gcov coverage tool that collects line and branch hit counts from instrumented C/C++ code and renders them as HTML reports, giving cyber tools a standard way to measure test coverage. or Cobertura reports

    3 details in Everything

12. #56 - Cloud Asset Map, Creating fix PRs with Deep Review and Code Coverage on GitLab Sep 22, 2026 · release notes

    New Cloud Asset Map view; GitLab Deep Review fix PRs, coverage uploads; new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools and APIs; Zen Firewall agent releases.

    • Adds the Cloud Asset Map view to visualize cloud resources by region/VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. with exposure findings and firewall rules.
    • Enables Creating fix PRs with Deep Review on GitLab by replying to comments to open PRs based on current work.
    • Adds Code Coverage on GitLab to upload CI coverage and display per-file/line results in Aikido.
    • Introduces new MCP tools including Get issue details for pentesting, deep review, and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scanning.
    • Adds API endpoints for user login history (list user logins history), broker management, and webhook triggers for issue ignore/snooze decisions and domain scan completion.

    +1 more show less

    • Releases Zen Firewall agents for Java, PHP, Golang, Node, and Alpine Linux.

    6 details in Everything

13. announced Sep 21, 2026 · issue 081

    Aikido releases Altar, an open-weight AI security model for air-gapped and sovereign deployments inside Aikido Machine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Introduces Altar, an open-weight security AI model (328 GB, W4A16 quantizationquantizationStoring a model's weights at lower numeric precision, such as 8 or 4 bits instead of 16, so it needs less memory and runs faster. It trades a small amount of accuracy for fitting on smaller hardware., 168 of 256 routed experts retained) that powers Aikido Machine's autonomous pentesting entirely inside customer-controlled or air-gapped infrastructure without sending code or findings to a third-party inference service.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Altar is deployable on a 4-H200s node using vLLM, with model weightsmodel weightsThe numerical values a model learns during training. Loading them into the model's architecture restores its learned behavior for inference or further training., a model card, license, serving flags, and deployment instructions available under Aikido's organization.

    2 details in Everything

14. #55 - Code Coverage for Github, SIEM Integrations and Pentest for AI capabilities seen Sep 9, 2026 · issue 069

    Aikido adds code coverage visibility, 11 SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integrations, AI pentesting, new API endpoints, and a TerraformTerraformAn open-source infrastructure-as-code tool by HashiCorp that provisions cloud and on-premises resources through declarative configuration files, letting cyber tools automate and version-control their deployment environments. provider update.

    • Adds new resource to manage default PR checks and new resource to manage PR check settings to the Aikido Terraform provider.
    • Adds API - Manage defaults PR checks for new repos endpoint to control default PR check configuration via the API.
    • Adds API - Report export for PCI and DORA compliance endpoint to export compliance reports programmatically.
    • Adds API - Listing & handling inbox requests endpoint to manage inbox requests via the API.
    • Adds Code Coverage for GitHub to surface which parts of your codebase ship with zero tests, with one-step setup and no secrets to manage.

    +4 more show less

    • Adds SIEM Integrations supporting 11 SIEMsSIEMsSecurity Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point., enabling Aikido issues to be forwarded and correlated with other organizational security data.
    • Adds Pentest for AI Capabilities targeting the OWASP Agentic Top 10OWASP Agentic Top 10A ranked list of the most critical risks specific to AI agent systems, maintained by OWASP, giving cyber tool builders a shared framework for prioritizing threats in autonomous, multi-step AI workflows. (including prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. and memory poisoning) for agents and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. features.
    • Adds a new Firewall to Device Protection to block malicious domains.
    • Adds monthly billing limits and GitLab support to Deep Review.
    • Adds new resource to manage default PR checks and new resource to manage PR check settings to the Aikido Terraform provider.
    • Adds API - Manage defaults PR checks for new repos endpoint to control default PR check configuration via the API.
    • Adds API - Report export for PCI and DORA compliance endpoint to export compliance reports programmatically.
    • Adds API - Listing & handling inbox requests endpoint to manage inbox requests via the API.
    • Adds Code Coverage for GitHub to surface which parts of your codebase ship with zero tests, with one-step setup and no secrets to manage.

    +3 more show less

    • Adds SIEM Integrations supporting 11 SIEMsSIEMsSecurity Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point., enabling Aikido issues to be forwarded and correlated with other organizational security data.
    • Adds Pentest for AI Capabilities targeting the OWASP Agentic Top 10OWASP Agentic Top 10A ranked list of the most critical risks specific to AI agent systems, maintained by OWASP, giving cyber tool builders a shared framework for prioritizing threats in autonomous, multi-step AI workflows. (including prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. and memory poisoning) for agents and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. features.
    • Adds a new Firewall to Device Protection to block malicious domains.

    1 more in Everything

15. #55 - Code Coverage for Github, SIEM Integrations and Pentest for AI capabilities Sep 8, 2026 · release notes

    Aikido v55 adds GitHub code coverage, 11 SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integrations, AI pentesting, and new Terraform/API resources

    • Adds GitHub code coverage to identify untested code paths with one-step setup
    • Adds support for sending issues to 11 supported SIEMsSIEMsSecurity Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point.
    • Adds targeted pentest for AI capabilities covering OWASP Agentic Top 10OWASP Agentic Top 10A ranked list of the most critical risks specific to AI agent systems, maintained by OWASP, giving cyber tool builders a shared framework for prioritizing threats in autonomous, multi-step AI workflows.

    3 details in Everything

16. 🚀Deep Review: the agentic PR review that cuts merge time and bugs shipped seen Sep 5, 2026 · issue 065

    Aikido launches Deep Review, an agentic PR reviewer that traces logic across repos and posts findings with suggested fixes directly on pull requests.

    └──▷ HOW TO FIND IT
    Enable Deep Review on a repository and link a related repo so it reasons across both codebases when reviewing PRs.
    📍In the Aikido console, go to your repository settings, enable Deep Review, link related repositories under Linked repos, and set the review level that fits your team.
    Keep monthly spend predictable by setting a cap on how many credits Deep Review can consume across your repos.
    📍In the Aikido console, open Aikido Wallet settings and set a monthly credit cap to limit Deep Review spend across all enabled repositories.
    • Introduces Deep Review, an agentic pull request reviewer that reasons across your full codebase — including middleware, global config, and linked repositories — to catch deeply nested security issues, broken access control, business logic flaws, and cross-tenant data leaks.
    • Saves accepted-risk and false-positive decisions to memory so future reviews learn from prior feedback on the same repository.
    • Runs after existing PR checks (SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and dependency checks) to build on their findings instead of repeating them, and is enabled and configured per repository with linkable related repos and a configurable review level.
    • Priced at 1 credit ($1) per PR from the Aikido Wallet with unlimited re-reviews on the same PR, and supports a configurable monthly spend cap.

    4 details in Everything

17. 🚀 Deep Review: the agentic PR review that cuts merge time and bugs shipped Sep 4, 2026 · release notes

    Aikido adds Deep Review, an agentic PR reviewer that reasons across repos and posts fixes.

    • Adds the ability to save feedback for accepted risks or false positives so Deep Review learns from them in future reviews.

    1 detail in Everything

18. announced Aug 26, 2026 · issue 058

    Aikido adds agentic Android (APK) pentesting with ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control.-based exploit confirmation, AutoFix, and joint app+backend assessment.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    After merging an AutoFix PR for a confirmed Android finding, retest against the patched build without rescoping.
    📍In the Aikido console, open the original Android assessment, go to the overview tab, upload the rebuilt APK, then click Retest on any finding from the initial pentest.
    • New Android (APK) pentest capability: agents install a real APK on a test device, log in as a user, and attack the app over ADB — findings are exploit-confirmed before appearing in the report.
    • Supports simultaneous assessment of the Android app and its backend API in a single run — API findings appear in the same report as app findings.
    • Reproduction steps for every finding include the exact ADB commands needed to replay the exploit.
    • Coverage includes unsafe WebView usage, deep-link and exported-component abuse, client-side authentication issues, injection flaws, broken access control, weak session handling, unsafe API behavior, IDORs, cross-tenant access, and authentication bypasses.
    • Android pentests are rightsized — Aikido's indexer scales the assessment scope to the actual app size rather than charging a flat fee.

    +3 more show less

    • Each run produces a recon report and attack plan with diagrams, threat scenarios, and the full agent reasoning trace, including vulnerabilities attempted but not confirmed.
    • Currently white-box only: source repository access is required alongside the APK; black-box support is noted as coming soon.
    • APK requirements: certificate pinning, root detection, emulator detection, and RASP must be disabled in the uploaded build.

    8 details in Everything

19. announced Aug 26, 2026 · issue 009

    Aikido adds agentic Android (APK) pentesting with ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control.-based exploit confirmation, AutoFix, and joint app+backend assessment.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    After merging an AutoFix PR for a confirmed Android finding, retest against the patched build without rescoping.
    📍In the Aikido console, open the original Android assessment, go to the overview tab, upload the rebuilt APK, then click Retest on any finding from the initial pentest.
    • New Android (APK) pentest capability: agents install a real APK on a test device, log in as a user, and attack the app over ADB — findings are exploit-confirmed before appearing in the report.
    • Supports simultaneous assessment of the Android app and its backend API in a single run — API findings appear in the same report as app findings.
    • Reproduction steps for every finding include the exact ADB commands needed to replay the exploit.
    • Coverage includes unsafe WebView usage, deep-link and exported-component abuse, client-side authentication issues, injection flaws, broken access control, weak session handling, unsafe API behavior, IDORs, cross-tenant access, and authentication bypasses.
    • Android pentests are rightsized — Aikido's indexer scales the assessment scope to the actual app size rather than charging a flat fee.

    +3 more show less

    • Each run produces a recon report and attack plan with diagrams, threat scenarios, and the full agent reasoning trace, including vulnerabilities attempted but not confirmed.
    • Currently white-box only: source repository access is required alongside the APK; black-box support is noted as coming soon.
    • APK requirements: certificate pinning, root detection, emulator detection, and RASP must be disabled in the uploaded build.

    8 details in Everything

20. 🚀Code Audit: Pentest-grade reasoning on your source code, no environment required. seen Aug 26, 2026 · issue 057
    ⤢
    └──▷ HOW TO FIND IT
    Start a pentest-grade code audit on a repo with no live environment — useful for auditing a smart contract or mobile app codebase.
    📍In the Aikido dashboard, go to Code Audit, connect the target repository, review the upfront credit cost, then click Start Audit.
    • Code Audit surfaces code-based evidence, root cause analysis, and remediation guidance, plus AI-powered AutoFix for creating remediation PRs in a few clicks.
    • Pricing shown upfront in credits before an audit starts, with cost calculated from the size and complexity of selected codebases.
21. 🚀DSPM: Find data exposure risks without connecting your data stores seen Aug 26, 2026 · issue 057
    ⤢
    • New Data Exposure Audit capability uses LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. agents to trace sensitive data from sources (request bodies, uploads, DB reads, config, app logic) into sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — all from already-connected repos.
    • Each Data Exposure Audit consumes credits from the Aikido Wallet.
22. 🚀Extreme Noise Reduction for Secrets and CVEs seen Aug 26, 2026 · issue 057
    ⤢ ⤢ ⤢ ⤢
    • Adds Secrets AutoTriage: an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. agent that runs after entropy detection to assess whether a discovered secret is a real, exposed credential, determine its liveness and scope, and automatically ignore or escalate findings based on defined rules.
    • Adds CVE Exploitability Analysis: an LLM agent that evaluates whether a CVE is practically exploitable given how your codebase uses the affected package, then can automatically upgrade, downgrade, snooze, or ignore the finding.
    • Each AutoTriage and CVE Exploitability Analysis run is logged with a short rationale so teams can review what was analyzed and what actions the agent took.
    • Enables automated remediation actions — upgrading, downgrading, snoozing, or ignoring findings — driven by user-controlled rules and codebase-aware LLM reasoning.
23. 🚀Protect Company Devices From Supply Chain Attacks seen Aug 26, 2026 · issue 057
    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Review and act on a developer's blocked-install exception request from the admin Inbox.
    📍In the Aikido console, go to Inbox, find the pending install request, review the flagged package name and policy reason, then approve or deny the exception.
    • Request-and-approval workflow pauses blocked installs and routes a one-click exception request to the admin Inbox inside Aikido.
    • Group-based policies enable different install rules per team.
24. 🚀Protect Company Devices From Supply Chain Attacks seen Aug 26, 2026 · issue 009
    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Review and act on a developer's blocked-install exception request from the admin Inbox.
    📍In the Aikido console, go to Inbox, find the pending install request, review the flagged package name and policy reason, then approve or deny the exception.
    • Request-and-approval workflow pauses blocked installs and routes a one-click exception request to the admin Inbox inside Aikido.
    • Group-based policies enable different install rules per team.
25. 🚀Extreme Noise Reduction for Secrets and CVEs seen Aug 26, 2026 · issue 009
    ⤢ ⤢ ⤢ ⤢
    • Adds Secrets AutoTriage: an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. agent that runs after entropy detection to assess whether a discovered secret is a real, exposed credential, determine its liveness and scope, and automatically ignore or escalate findings based on defined rules.
    • Adds CVE Exploitability Analysis: an LLM agent that evaluates whether a CVE is practically exploitable given how your codebase uses the affected package, then can automatically upgrade, downgrade, snooze, or ignore the finding.
    • Each AutoTriage and CVE Exploitability Analysis run is logged with a short rationale so teams can review what was analyzed and what actions the agent took.
    • Enables automated remediation actions — upgrading, downgrading, snoozing, or ignoring findings — driven by user-controlled rules and codebase-aware LLM reasoning.
26. 🚀DSPM: Find data exposure risks without connecting your data stores seen Aug 26, 2026 · issue 009
    ⤢
    • New Data Exposure Audit capability uses LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. agents to trace sensitive data from sources (request bodies, uploads, DB reads, config, app logic) into sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — all from already-connected repos.
    • Each Data Exposure Audit consumes credits from the Aikido Wallet.
27. 🚀Code Audit: Pentest-grade reasoning on your source code, no environment required. seen Aug 26, 2026 · issue 009
    ⤢
    └──▷ HOW TO FIND IT
    Start a pentest-grade code audit on a repo with no live environment — useful for auditing a smart contract or mobile app codebase.
    📍In the Aikido dashboard, go to Code Audit, connect the target repository, review the upfront credit cost, then click Start Audit.
    • Code Audit surfaces code-based evidence, root cause analysis, and remediation guidance, plus AI-powered AutoFix for creating remediation PRs in a few clicks.
    • Pricing shown upfront in credits before an audit starts, with cost calculated from the size and complexity of selected codebases.
28. #54 - Device Protection for Linux and VM Scanning for Google Cloud seen Aug 25, 2026 · issue 056

    Aikido adds Linux device protection (.deb/.rpm), agentless GCP VM scanning, OSCAL FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. reports, and new bulk-configuration APIs.

    • New API to bulk update GitHub PR configuration across repositories.
    • New API to request a hardened container image.
    • Device Protection for Linux (beta): blocks malware at install time on Linux desktops and servers, distributed as .deb and .rpm packages.
    • GCP VM Scanning is now generally available — agentless setup with no SSH keys or agents required, completing coverage across AWS, Azure, and GCP.
    • Adds OSCAL FedRAMP DAST report format under Reports.

    +6 more show less

    • Zen Firewall agent releases now available for Dotnet, Java, PHP, Ruby, Golang, and Node.
    • CVE Exploitability assessment now supports containers.
    • Package Health adds support for NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. and JetBrains packages.
    • Adds ability to request ignore of an issue on a PR/MR with admin approval.
    • Adds ability to ignore license issues by path.
    • New VSCode IDE extension release.

    11 details in Everything

29. 🚀 Code Audit: Pentest-grade reasoning on your source code, no environment required. seen Aug 25, 2026 · issue 056

    Aikido adds Code Audit: agentic, pentest-grade source code reasoning with AutoFix PR generation, no live environment needed.

    ⤢
    • New Code Audit feature runs agentic, pentest-grade security reasoning directly on source code to find logic flaws (e.g. cross-tenant data leakage) that pattern-based scanners miss — no staging URL, traffic replay, or agent deployment required.
    • AutoFix generates remediation PRs from Code Audit findings with a few clicks, alongside root cause analysis and remediation guidance.
    • Code Audit is priced in credits shown upfront before the audit starts, with cost based on codebase size and complexity.
    • Supports hard-to-test-by-URL codebases including mobile apps, smart contracts, desktop apps, embedded software, and libraries.

    4 details in Everything

30. 🚀 DSPM: Find data exposure risks without connecting your data stores seen Aug 25, 2026 · issue 056

    Aikido adds code-based DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores.: Data Exposure Audit maps sensitive data flows through source code without connecting production data stores.

    ⤢
    • New Data Exposure Audit feature performs code-based DSPM using LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. agents to trace sensitive fields from sources (request bodies, DB reads, config) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — no production data store access required.
    • Detects credentials in URLs — tokens and API keys in query strings, redirects, and clone URLs that may be captured by logs, proxies, or browser history.
    • Detects API over-exposure — endpoints returning more fields than the caller is entitled to, and missing tenant ownership checks.
    • Detects unsafe logging and exports — unredacted PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. and secrets appearing in application logs, traces, caches, and dumps.
    • Detects over-broad third-party and AI sharing — customer data and secrets sent to vendors, analytics pipelines, LLM prompts, and vector storesvector storesA database built to store embeddings and find the nearest ones to a query quickly. It is the retrieval half of most RAG systems..

    +4 more show less

    • Detects weak storage — regulated data stored unencrypted, or protected only with base64, MD5, or SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications..
    • Detects incomplete deletion — delete flows that leave downstream records, caches, and related stores intact, including shadow copies in staging and snapshots.
    • Detects over-permissioned IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles and OAuth scopes, and unauthenticated data stores.
    • Runs against already-connected repositories with no new data source to onboard; each audit consumes credits from the Aikido Wallet.

    9 details in Everything

31. 🚀 Extreme Noise Reduction for Secrets and CVEs seen Aug 25, 2026 · issue 056

    Aikido adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered Secrets AutoTriage and CVE Exploitability Analysis to automatically prioritize and act on findings.

    ⤢ ⤢ ⤢ ⤢
    • New Secrets AutoTriage agent runs after entropy detection to assess whether a discovered secret is a real, exposed credential — evaluating liveness, scope, and surrounding code context — then applies defined rules or LLM reasoning for ambiguous cases.
    • New CVE Exploitability Analysis agent evaluates whether a CVE is actually reachable and exploitable in your codebase using LLM reasoning over how your code uses the affected package.
    • Both agents can act autonomously: upgrading, downgrading, snoozing, or ignoring findings automatically based on rules you control.
    • Each agent run is logged with a short rationale explaining what was analyzed and what actions were taken, allowing teams to review and override decisions.

    4 details in Everything

32. 🚀 Protect Company Devices From Supply Chain Attacks seen Aug 25, 2026 · issue 056

    Aikido Device Protection agent adds real-time malware blocking, extension governance, group policies, and an approval workflow for developer devices.

    ⤢ ⤢ ⤢ ⤢
    • New Device Protection agent provides real-time malware blocking across npm, PyPI, Maven, and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. package managers, powered by Aikido Intel.
    • Adds extension governance covering VS Code, OpenVSX, Chrome, and skills.sh extensions.
    • Introduces a request-and-approval workflow: blocked installs trigger a one-click exception request reviewable inside the Aikido admin Inbox.
    • Supports group-based policies, enabling different package and extension rules per team.
    • Adds continuous device inventory giving an always-current view of every package and extension installed per device.

    +1 more show less

    • Agent runs silently in the background and surfaces desktop notifications only when a package is blocked (malware or policy) or held for approval.

    6 details in Everything

33. 🚀 Code Audit: Pentest-grade reasoning on your source code, no environment required. seen Aug 25, 2026 · issue 009

    Aikido adds Code Audit: agentic, pentest-grade source code reasoning with AutoFix PR generation, no live environment needed.

    ⤢
    • New Code Audit feature runs agentic, pentest-grade security reasoning directly on source code to find logic flaws (e.g. cross-tenant data leakage) that pattern-based scanners miss — no staging URL, traffic replay, or agent deployment required.
    • AutoFix generates remediation PRs from Code Audit findings with a few clicks, alongside root cause analysis and remediation guidance.
    • Code Audit is priced in credits shown upfront before the audit starts, with cost based on codebase size and complexity.
    • Supports hard-to-test-by-URL codebases including mobile apps, smart contracts, desktop apps, embedded software, and libraries.

    4 details in Everything

34. 🚀 DSPM: Find data exposure risks without connecting your data stores seen Aug 25, 2026 · issue 009

    Aikido adds code-based DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores.: Data Exposure Audit maps sensitive data flows through source code without connecting production data stores.

    ⤢
    • New Data Exposure Audit feature performs code-based DSPM using LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. agents to trace sensitive fields from sources (request bodies, DB reads, config) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — no production data store access required.
    • Detects credentials in URLs — tokens and API keys in query strings, redirects, and clone URLs that may be captured by logs, proxies, or browser history.
    • Detects API over-exposure — endpoints returning more fields than the caller is entitled to, and missing tenant ownership checks.
    • Detects unsafe logging and exports — unredacted PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. and secrets appearing in application logs, traces, caches, and dumps.
    • Detects over-broad third-party and AI sharing — customer data and secrets sent to vendors, analytics pipelines, LLM prompts, and vector storesvector storesA database built to store embeddings and find the nearest ones to a query quickly. It is the retrieval half of most RAG systems..

    +4 more show less

    • Detects weak storage — regulated data stored unencrypted, or protected only with base64, MD5, or SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications..
    • Detects incomplete deletion — delete flows that leave downstream records, caches, and related stores intact, including shadow copies in staging and snapshots.
    • Detects over-permissioned IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles and OAuth scopes, and unauthenticated data stores.
    • Runs against already-connected repositories with no new data source to onboard; each audit consumes credits from the Aikido Wallet.

    9 details in Everything

35. 🚀 Protect Company Devices From Supply Chain Attacks seen Aug 25, 2026 · issue 009

    Aikido Device Protection agent adds real-time malware blocking, extension governance, group policies, and an approval workflow for developer devices.

    ⤢ ⤢ ⤢ ⤢
    • New Device Protection agent provides real-time malware blocking across npm, PyPI, Maven, and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. package managers, powered by Aikido Intel.
    • Adds extension governance covering VS Code, OpenVSX, Chrome, and skills.sh extensions.
    • Introduces a request-and-approval workflow: blocked installs trigger a one-click exception request reviewable inside the Aikido admin Inbox.
    • Supports group-based policies, enabling different package and extension rules per team.
    • Adds continuous device inventory giving an always-current view of every package and extension installed per device.

    +1 more show less

    • Agent runs silently in the background and surfaces desktop notifications only when a package is blocked (malware or policy) or held for approval.

    6 details in Everything

36. 🚀 Extreme Noise Reduction for Secrets and CVEs seen Aug 25, 2026 · issue 009

    Aikido adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered Secrets AutoTriage and CVE Exploitability Analysis to automatically prioritize and act on findings.

    ⤢ ⤢ ⤢ ⤢
    • New Secrets AutoTriage agent runs after entropy detection to assess whether a discovered secret is a real, exposed credential — evaluating liveness, scope, and surrounding code context — then applies defined rules or LLM reasoning for ambiguous cases.
    • New CVE Exploitability Analysis agent evaluates whether a CVE is actually reachable and exploitable in your codebase using LLM reasoning over how your code uses the affected package.
    • Both agents can act autonomously: upgrading, downgrading, snoozing, or ignoring findings automatically based on rules you control.
    • Each agent run is logged with a short rationale explaining what was analyzed and what actions were taken, allowing teams to review and override decisions.

    4 details in Everything

37. #54 - Device Protection for Linux and VM Scanning for Google Cloud seen Aug 25, 2026 · issue 009

    Aikido adds Linux device protection (.deb/.rpm), agentless GCP VM scanning, OSCAL FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. reports, and new bulk-configuration APIs.

    • New API to bulk update GitHub PR configuration across repositories.
    • New API to request a hardened container image.
    • Device Protection for Linux (beta): blocks malware at install time on Linux desktops and servers, distributed as .deb and .rpm packages.
    • GCP VM Scanning is now generally available — agentless setup with no SSH keys or agents required, completing coverage across AWS, Azure, and GCP.
    • Adds OSCAL FedRAMP DAST report format under Reports.

    +6 more show less

    • Zen Firewall agent releases now available for Dotnet, Java, PHP, Ruby, Golang, and Node.
    • CVE Exploitability assessment now supports containers.
    • Package Health adds support for NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. and JetBrains packages.
    • Adds ability to request ignore of an issue on a PR/MR with admin approval.
    • Adds ability to ignore license issues by path.
    • New VSCode IDE extension release.

    11 details in Everything

38. #53 - Deep Review, Android Pentests, Custom Reports and Free Credits seen Aug 12, 2026 · issue 043

    Aikido #53 adds agentic PR deep review, Android pentesting, custom AI-built reports, and free monthly credits.

    • New Deep Review feature performs agentic PR analysis that goes beyond the diff, examining surrounding code and linked repositories to catch business logic mistakes and cross-service security issues.
    • Aikido Pentest now covers native and hybrid Android apps, including those with biometric login.
    • New Custom Reports capability lets users describe a report in plain language; Aikido Agent builds it from findings and makes it shareable across the workspace.
    • Pro and Advanced plans now receive 100–200 free Aikido Credits per month for use with Deep Review and Security Audit.
    • Adds an Aikido Terraform provider integration.

    +8 more show less

    • New API surface to read and update AutoFix settings.
    • Adds Zen Firewall agents for PHP and Ruby.
    • Adds new IDE extensions for VSCode and Visual Studio.
    • GitLab integration now supports resolving issues.
    • Adds per-repository bypass of PR checks in Training mode.
    • Kubernetes team annotations are now surfaced as container labels in Cloud.
    • Kubernetes agents now have FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. variants.
    • Adds a repository filter for trends-over-time in Reports.

    13 details in Everything

39. New - DSPM: Find data exposure risks without connecting your data stores 🚀 seen Aug 12, 2026 · issue 043

    Aikido adds code-based DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores.: Data Exposure Audit maps sensitive data flows through source code without connecting production data stores.

    ⤢
    • New Data Exposure Audit feature performs code-based DSPM by using LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. agents to trace sensitive data from sources (request bodies, uploads, DB reads, config, application logic) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — no production data store connection required.
    • Detects credentials in URLs, API over-exposure (endpoints returning excess fields, missing tenant ownership checks), unsafe logging of unredacted PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. and secrets, over-broad third-party and AI data sharing, weak storage (unencrypted regulated data, base64/MD5/SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications. misused as encryption), and incomplete deletion flows leaving downstream records and caches intact.
    • Runs against already-connected repositories with no new data source to onboard; each Data Exposure Audit consumes credits from the Aikido Wallet.

    3 details in Everything

40. New - DPSM: Find data exposure risks without connecting your data stores 🚀 seen Aug 4, 2026 · issue 035

    Aikido adds code-based DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores.: map sensitive data flows and find exposure risks without connecting production data stores.

    ⤢
    • New Data Exposure Audit feature uses LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. agents to trace sensitive data from sources (request bodies, uploads, DB reads, config, application logic) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — entirely from code, with no production data store connection required.
    • Detects credential and token leakage in URLs, query strings, redirects, and clone URLs where logs, proxies, and browser history can capture them.
    • Identifies API over-exposure: endpoints returning more fields than the caller is entitled to, and missing tenant ownership checks on data access.
    • Flags unsafe logging and exports: unredacted PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. and secrets in application logs, traces, caches, and dumps.
    • Surfaces over-broad third-party and AI data sharing: customer data and secrets sent to vendors, analytics, LLM prompts, and vector storesvector storesA database built to store embeddings and find the nearest ones to a query quickly. It is the retrieval half of most RAG systems. beyond what is required.

    +3 more show less

    • Detects weak storage patterns: regulated data stored unencrypted, or with base64, MD5, or SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications. used in place of real encryption.
    • Finds incomplete deletion flows that leave downstream records, caches, and related stores intact, including shadow copies in staging and snapshots.
    • Each Data Exposure Audit consumes credits from the Aikido Wallet.

    8 details in Everything

41. New - DPSM: Find data exposure risks without connecting your data stores 🚀 seen Aug 4, 2026 · issue 006

    Aikido adds code-based DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores.: map sensitive data flows and find exposure risks without connecting production data stores.

    ⤢
    • New Data Exposure Audit feature uses LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. agents to trace sensitive data from sources (request bodies, uploads, DB reads, config, application logic) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — entirely from code, with no production data store connection required.
    • Detects credential and token leakage in URLs, query strings, redirects, and clone URLs where logs, proxies, and browser history can capture them.
    • Identifies API over-exposure: endpoints returning more fields than the caller is entitled to, and missing tenant ownership checks on data access.
    • Flags unsafe logging and exports: unredacted PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. and secrets in application logs, traces, caches, and dumps.
    • Surfaces over-broad third-party and AI data sharing: customer data and secrets sent to vendors, analytics, LLM prompts, and vector storesvector storesA database built to store embeddings and find the nearest ones to a query quickly. It is the retrieval half of most RAG systems. beyond what is required.

    +3 more show less

    • Detects weak storage patterns: regulated data stored unencrypted, or with base64, MD5, or SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications. used in place of real encryption.
    • Finds incomplete deletion flows that leave downstream records, caches, and related stores intact, including shadow copies in staging and snapshots.
    • Each Data Exposure Audit consumes credits from the Aikido Wallet.

    8 details in Everything

42. 🚀 DSPM: Find data exposure risks without connecting your data stores Aug 4, 2026 · release notes

    Aikido adds code-based Data Exposure Audit (DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores.) to analyze sensitive data flows in connected repositories without new integrations.

    • Adds Data Exposure Audit capability that uses LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. agents to map sensitive data creation, movement, storage, and exposure within application code.
    • Identifies specific risk vectors including credentials in URLs (tokens/keys in query strings), API over-exposure (missing tenant checks), unsafe logging (unredacted PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations./secrets), weak storage (base64/MD5/SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications. encryption), and incomplete deletion flows.
    • Provides AutoFix to automatically open a PR with code-level remediation for identified data exposure findings.

    3 details in Everything

43. #52 - DSPM, Aikido Libraries and Repository Code Quality scans seen Jul 31, 2026 · issue 031

    Aikido adds DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores., backport CVE patches via Aikido Libraries, code quality repo scans, and new language firewall agents.

    └──▷ HOW TO FIND IT
    Point Aikido at a repository to audit sensitive data flows and exposures at the source — no database credentials needed.
    📍In the Aikido console, go to your repository, open the Data Exposure Audit (DSPM) scan, and review where sensitive data is exposed in code.
    Gate pull requests on code quality severity so high-severity issues block merges automatically.
    📍In the Aikido console, go to Code Quality settings for your repository and enable PR/MR Gating by Severity, then select the minimum severity threshold to block.
    Assign multiple cloud accounts to a team in bulk rather than one at a time.
    📍In the Aikido console, go to Settings › Clouds, select the cloud accounts you want to assign, and use Bulk assignment to map them to a team.
    • New Data Exposure Audit (DSPM) feature tracks how sensitive data flows and where it gets exposed, reading entirely from source code — no database connections or data access grants required.
    • New Aikido Libraries capability delivers PRs that backport open-source CVE fixes to the exact version already running, avoiding major-version bumps or breaking changes.
    • New Code Quality Repository Scans surface existing code quality issues across repos to help find and prioritize technical debt over time.
    • Noise reduction for container images in cloud scanning reduces alert fatigue.
    • Bitbucket Server support added for PR Checks.

    +8 more show less

    • Kubernetes registry option added for public image scanning.
    • Code Quality PR/MR Gating by Severity enables blocking merges based on issue severity.
    • New Code Quality rule: Keep the diff minimal.
    • Device Protection now supports JetBrains Zen.
    • Firewall agents released for PHP, Ruby, Golang, and Node.
    • IDE extensions updated with new releases for VSCode, JetBrains, and Visual Studio.
    • Health score for the Maven ecosystem added to Aikido Intel.
    • Bulk assignment of cloud accounts to teams now available in Settings.

    13 details in Everything

44. #52 - DSPM, Aikido Libraries and Repository Code Quality scans seen Jul 28, 2026 · issue 028

    Aikido adds DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores., backport library patches, code quality scans, and new agent/IDE releases in one drop.

    └──▷ HOW TO FIND IT
    Point DSPM at a repository to discover where sensitive data is exposed in code — no database credentials or access grants needed.
    📍In the Aikido console, navigate to your repository, then open the Data Exposure Audit (DSPM) scan to review sensitive data flow findings and remediate at the source.
    Merge a backported CVE fix for an existing dependency version without upgrading to a new major version.
    📍In the Aikido console, go to Aikido Libraries, select an open-source CVE affecting your current dependency version, and open the generated PR to apply the backported patch.
    • New Data Exposure Audit (DSPM) scans repos to track how sensitive data flows and where it gets exposed — no database connections or data access grants required.
    • New Aikido Libraries capability delivers backported CVE fixes for the exact dependency version already in use, without requiring major-version upgrades or refactors.
    • New Code Quality Repository Scans surface existing code quality issues across repos to help identify and prioritize technical debt over time.
    • Noise reduction for container images in Cloud scans.
    • Bitbucket Server support added for PR Checks.

    +7 more show less

    • Kubernetes registry option added for public image scanning.
    • PR/MR gating by severity now available on GitHub for Code Quality findings.
    • Device Protection adds support for JetBrains Zen.
    • Firewall agents now available for PHP, Ruby, Golang, and Node.
    • IDE extensions updated with new releases for VSCode, JetBrains, and Visual Studio.
    • Health score added for the Maven ecosystem in Aikido Intel.
    • Bulk assignment of cloud accounts to teams available in Settings.

    12 details in Everything

45. #52 - DSPM, Aikido Libraries and Repository Code Quality scans Jul 28, 2026 · release notes

    Aikido adds DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. data exposure tracking, direct library CVE remediation PRs, and repository code quality scans.

    • Data Exposure Audit (DSPM) scans track sensitive data flows and exposures by reading directly from your repo without database connections or extra data access grants.
    • Code Quality Repository Scans identify existing code quality issues and technical debt to prioritize remediation as code evolves.

    2 details in Everything

46. #51 - Repository Code Quality scans, Ignore Approval Inbox and Noise Reduction for Secrets & CVE’s seen Jul 15, 2026 · issue 015

    Aikido #51 adds repository-wide code quality scans, an ignore approval inbox, AI-powered noise reduction for secrets & CVEs, and a wave of new integrations and APIs.

    └──▷ HOW TO FIND IT
    Trigger a full repository code quality scan to find hotspots across the entire codebase, not just open PRs.
    📍In the Aikido console, go to Code Quality › Repository Scan (early access) and initiate a full codebase scan to view quality trends and refactoring hotspots.
    Review and approve or reject team ignore requests before they take effect, maintaining admin control over noise suppression.
    📍In the Aikido console, go to the Approval Inbox and review pending ignore requests submitted by team members before approving or rejecting each.
    • New Code Quality Repository Scan (early access): scan entire codebases for quality issues, monitor trends, and identify refactoring hotspots — not just PR-level checks.
    • New Approval Inbox for Ignores: routes every ignore request through a central inbox requiring admin sign-off before issues leave the feed.
    • New AI-powered Noise Reduction for Secrets & CVEs: analyzes each secret and CVE against actual code to surface only truly exploitable findings and suppress irrelevant ones.
    • New Dashboard available to all users.
    • Adds Azure DevOps Self-Managed Server support for source code scanning.

    +14 more show less

    • Adds ticket integration support for GitHub Server and Azure DevOps Cloud.
    • Adds Render cloud misconfiguration scanning.
    • Adds Kubernetes namespace labels to container metadata.
    • Adds Terraform module for GCP project/organization onboarding.
    • Device Protection can now be temporarily disabled for up to 1 hour.
    • Adds Google Cloud Artifact Registry Proxy support.
    • Zen Firewall Node agent adds ElysiaJS framework support.
    • IDE extensions updated for VSCode and JetBrains, including new JetBrains CLion support.
    • New API endpoint to list snoozed and ignored issues from PRs.
    • New API endpoint to retrieve Device Protection SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
    • New API endpoint to get SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. settings.
    • New API endpoint for GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. reports.
    • New API endpoints to get, add, update, and remove container labels.
    • New API endpoint to list repository PR configuration.

    19 details in Everything

47. #41 - Aikido MCP, re-testing AI Pentest findings, and Azure Management Group support seen Jul 13, 2026 · issue 014

    Aikido adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. for AI-driven security workflows, AI Pentest re-testing, Azure Management Group auto-discovery, and a wave of new integrations.

    └──▷ HOW TO FIND IT
    Trigger a targeted re-test of a single AI Pentest finding after applying a fix, instead of re-running the full pentest.
    📍In the Aikido console, navigate to AI Pentest › Findings, select the individual finding you fixed, and click Re-test to have Aikido verify the fix in isolation.
    Connect an Azure Management Group so Aikido automatically discovers all current and future subscriptions without manual re-configuration.
    📍In the Aikido console, go to Integrations › Cloud › Azure, choose Management Group, enter your Management Group ID, and save — Aikido will enumerate all child groups and subscriptions automatically.
    • New Aikido MCP integration lets AI agents analyze code for security risks and fixes locally, without sending code or data to the cloud.
    • New re-test capability for individual AI Pentest findings lets teams confirm a specific fix is resolved without running a full pentest.
    • New Azure Management Group support: connect once and Aikido auto-discovers all existing and future groups and subscriptions.
    • New Broker Helm chart released for self-hosted broker deployments.
    • New GitHub Enterprise Server on-premises support via Aikido Broker for code scanning.

    +19 more show less

    • New AutoFix support for Bun runtime.
    • New malware detection in container images.
    • New Kubernetes checks for ingress-nginx and MongoDB.
    • New GraphQL support in AI Pentest.
    • Code Quality scanning now automatically ignores generated files.
    • New ability to link domains directly to teams in Domains & APIs.
    • New custom headers support for API scans in Domains & APIs.
    • New OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets./2FA support for authenticated API scanning in Domains & APIs.
    • New local scanner release for Virtual Machines.
    • New Zen Firewall agent releases for Dotnet, Java, Python, PHP, Ruby, and Node.
    • New IDE extension releases for VSCode, JetBrains, and Visual Studio.
    • Safe-chain adds full Python support (pip, pipx, uv, poetry) and CircleCI support, plus configurable custom/private npm registries.
    • New email forwarding support for Notifications.
    • New FDA/NTIA-compliant reports with component hashes and supplier information.
    • New API endpoint to add a Kubernetes cluster.
    • New API endpoint to start a scan on a code repository.
    • New API endpoint to list all CI scans.
    • New API endpoint to get issue reachability analysis.
    • New API endpoint to add a note to an issue group.

    24 details in Everything

48. #42 - Dep Upgrade Analysis, Eclipse IDE, AI Pentest Preview & Real Time Kubernetes Image Scanning seen Jul 13, 2026 · issue 014

    Aikido adds Kubernetes real-time image scanning, Eclipse IDE plugin, AI pentest preview, and dependency upgrade breaking-change analysis.

    • New Dependency Upgrade Breaking Change Analysis: Aikido AutoFix surfaces code-breaking impacts of dependency upgrades before they are applied.
    • New Kubernetes In-Cluster Image Scanning: continuously monitors container images running in live Kubernetes clusters for vulnerabilities.
    • New AI Pentest Skip-Payment model: run a full whitebox pentest and pay only to unlock details of High or Critical findings.
    • New Eclipse IDE plugin: scans projects in real time for secrets, API keys, and security vulnerabilities as you code.
    • New and improved Reachability view: refreshed design with deeper, more granular insights accessible directly from the Feed on hover.

    +19 more show less

    • Adds Visual Basic.NET support to Code Scanning.
    • Adds Clojure support to Code Scanning.
    • Adds Azure China support for Cloud scanning.
    • New Zen Firewall agent releases for Dotnet, Java, Python, PHP, Ruby, Golang, and Node.
    • Enables editing of Custom Rules in Code Quality.
    • AI Pentest now estimates the number of agents needed for optimal coverage.
    • AI Pentest supports programmatic creation of new pentests via API.
    • AI Pentest supports scheduling for weekend execution.
    • AI Pentest now suggests hardening improvements to code.
    • IntelliJ IDE plugin adds Full Codebase Scan capability.
    • New IDE feature to track Expansion Pack (Secrets, Safe-Chain, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) usage across the organization.
    • New IDE releases for VSCode, JetBrains, and Visual Studio.
    • Safe-Chain adds custom registry support for Python and Jenkins support.
    • New compliance integration with CompAI.
    • New Reports: UK Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against..
    • New API endpoint to start a container scan.
    • New API endpoint to set network connectivity for a repository.
    • New API endpoint to list tasks related to a group.
    • New API endpoint to get AI Pentest assessment details.

    24 details in Everything

49. #43 - Aikido Infinite (Continuous Pentesting), VM Reachability Diagrams & IDE full scan seen Jul 13, 2026 · issue 014

    Aikido adds continuous pentesting, VM reachability diagrams, full IDE workspace scanning, and expanded integrations.

    └──▷ HOW TO FIND IT
    Visualize the network path to a vulnerable cloud VM to quickly assess real-world exploitability before prioritizing remediation.
    📍In the Aikido console, open a Cloud VM finding, then select Reachability Diagram to view the network path, entry points, and exposed ports leading to the affected resource.
    Attach custom Jira fields (e.g. team or severity tier) when Aikido creates issues, so tickets route correctly without manual editing.
    📍In the Aikido console, go to Integrations › Jira, open your integration settings, and configure Custom Fields with the desired Jira field keys and values.
    • New Aikido Infinite (Continuous Pentesting): automatically re-tests your app after every code change, focusing on what changed and validating exploitability to reduce false positives.
    • New Reachability Diagrams for Cloud VMs: visualizes whether a finding is exploitable by mapping the network path, entry points, and exposed ports in your cloud environment.
    • Full Workspace Scan now available across all supported IDEs (VS Code, JetBrains, Visual Studio, Eclipse, Cursor), with IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanning added for VS Code.
    • Adds package health scoring for PHP and malware detection for skills.sh, Go, Rust, and WordPress plugins.
    • Container image scanning supports include/exclude filtering by pattern.

    +8 more show less

    • Kubernetes image scanning now supports multiple tags of the same image per cluster.
    • AI Pentest agent gains file upload support and SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels.-based two-factor authentication and OAuth Password Grant flows.
    • Zen runtime protection releases Go beta and Ruby full release, plus IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data. blocking in Node.js.
    • Jira integration supports setting Custom Fields on issues.
    • Slack integration updated with direct actions from Slack notifications and an improved detail view.
    • New Comp AI integration for Governance, Risk, and Compliance (GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically.).
    • New API endpoints: save pull request config for Azure, Bitbucket, and GitHub; adjust group severity; add subdomains to attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. domains.
    • GitHub PR integration supports ignoring security issues and code quality findings directly from within a PR.

    13 details in Everything

50. #44 - Talk to Aikido Autofix, Pentest Threat Model and support for Alibaba Cloud seen Jul 13, 2026 · issue 014

    Aikido adds conversational AutoFix refinement, Pentest Threat Model, Alibaba Cloud support, and new APIs in release #44.

    └──▷ HOW TO FIND IT
    Iteratively refine an AutoFix to match your team's code conventions using natural language inside Aikido.
    📍In the Aikido UI, open an AutoFix suggestion, click Refine with Aikido AI, and type a natural-language instruction such as 'Use async/await instead of callbacks and follow our error-handling conventions'.
    • Adds Refine with Aikido AI — iteratively adjust AutoFixes using natural language to match your code style without leaving Aikido.
    • New Pentest Threat Model provides a real-time, transparent view of your attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. and how your application's security posture will be tested.
    • Supports Alibaba Cloud: scan for misconfigurations, exposed resources, and risky settings across your Alibaba Cloud environment.
    • Adds custom context on SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. rules to improve AutoTriage accuracy.
    • Displays CVEs on VM attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. diagrams in Cloud & VM views.

    +9 more show less

    • Introduces Aikido Claude Plugin via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration.
    • Adds Jira/task tracker integration with team-to-project mapping and custom priority mapping.
    • Releases Zen Firewall agents for .NET, Java, Python, and Golang.
    • Releases IDE extensions for VSCode and JetBrains.
    • Sponsors Betterleaks (next Gitleaks iteration) delivering 5.2× better performance and improved accuracy.
    • New API endpoint to list attack surface subdomains.
    • New API webhook for manual severity changes.
    • New API endpoint to unlink a container from a repository.
    • New API endpoint to get AI Pentest issue details.

    14 details in Everything

51. #45 - Aikido × Lovable - Vibe, Fix, Ship and Container Reachability seen Jul 13, 2026 · issue 014

    Aikido adds Lovable pentesting integration, container network reachability, new APIs, and expanded Zen Firewall agent support.

    • Adds Container Reachability: maps the complete network route to running containers and surfaces CVEs in deployment context, showing what is exposed to the internet.
    • Detects org.opencontainers.image.source tags in Docker images for improved container identification.
    • Extends Virtual Machine Reachability support to Azure.
    • Refreshes Zen Firewall installation flow with new installation instructions.
    • Ships Zen Firewall agents for .NET, PHP, Ruby, Golang, and Node.

    +5 more show less

    • Automatically links SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. users to GitHub teams in User Management.
    • Adds Drupal malware scanning to Aikido Intel.
    • Releases new Safe Chain version with minimum package age support for Python.
    • Publishes new IDE extensions for VSCode and Visual Studio.
    • New API endpoints to manage webhooks, manage excluded paths per repository, and set custom headers for webhooks.

    10 details in Everything

52. #46 - Escalating your AI Pentest and Additional Context for AutoTriage seen Jul 13, 2026 · issue 014

    Aikido adds AI pentest escalation, AutoTriage custom context, cloud reachability for GCP, and new Zen firewall agents.

    • Enables escalation of AI pentest vulnerabilities beyond default cautious mode to perform deeper exploitation analysis and confirm whether protection layers hold up.
    • Adds custom environment context input for AutoTriage to improve finding accuracy and reduce false positives.
    • New out of SLA graph added to Reports Trends Over Time view.
    • Supports direct reply or ignore actions via GitLab MR comments integration.
    • Extends cloud reachability analysis for containers to Google Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity..

    +9 more show less

    • Supports custom context for AutoFix via an .aikido configuration file.
    • Adds additional pentest login methods: files, keys, and scripts.
    • Adds broker support for WebSockets in integrations.
    • Enables exclusion of specific users from Zen rate limiting.
    • Releases Zen Firewall agents for .NET, Go, and Node.
    • Releases new IDE extensions for VSCode, JetBrains, and Visual Studio.
    • New API endpoint to add Azure Container Registry.
    • New API endpoint to add GCP registry.
    • Updates headers for the Domain Scan API.

    14 details in Everything

53. #47 - Aikido Device Protection and Aikido AI Chat seen Jul 13, 2026 · issue 014

    Aikido adds Device Protection for blocking malicious packages on developer machines, AI Chat in AutoFix, and new API endpoints.

    └──▷ HOW TO FIND IT
    Use the AI Chat inside the AutoFix modal to refine a generated fix without leaving the product — useful when the suggested PR needs a small scope adjustment.
    📍In the console, open a finding in the Code Analysis or AutoFix modal, then use the embedded Aikido AI Chat panel to describe the change you want (e.g., 'Scope the fix to only the affected function, not the entire file') and submit.
    Add organization-specific context (custom libraries, internal policies) so AutoFix generates more accurate PRs tailored to your codebase.
    copy

    $ # Place a .aikido file at the root of your repository with custom context
    echo 'We use our internal wrapper `safe_query()` instead of raw DB calls.' > .aikido

    • New Device Protection agent blocks malicious packages (npm, PyPI, Maven, NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code., and more) and risky IDE/browser extensions at install time on developer devices to stop supply chain attacks.
    • Aikido AI Chat is now embedded in the AutoFix & Code Analysis Modal, enabling natural-language interaction with security findings and in-product AutoFix PR customization.
    • Adds cloud support for detecting Supabase common configuration issues.
    • Enables custom context for AutoFix via .aikido files.
    • Aikido Infinite now supports custom scan frequencies (e.g., every 6 weeks).

    +5 more show less

    • Zen Firewall agents released for Dotnet, Python, PHP, Ruby, Golang, and Node; Ruby agent adds Outbound Request Blocking support.
    • New IDE extension releases for VSCode, JetBrains, and Eclipse.
    • New API endpoint: List Cloud rules.
    • New API endpoint: Get project/repository mapping.
    • New API endpoint: Get CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. and AWS CIS report.

    10 details in Everything

54. #48 - AI Code Audit, Aikido MCP and ServiceNow Integration seen Jul 13, 2026 · issue 014

    Aikido adds AI code auditing, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration, ServiceNow ticketing, Oracle/Alibaba cloud support, and Zen Firewall agent expansion.

    └──▷ HOW TO FIND IT
    Query your Aikido security findings — such as leaked secrets or critical open vulnerabilities — directly from an AI coding assistant via the MCP integration.
    📍In your AI coding assistant's MCP settings, add the Aikido MCP server, then prompt: "Show me all critical findings and leaked secrets in the <repo> repository."
    Automatically route Aikido security findings into ServiceNow for teams that manage remediation through existing ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. workflows.
    📍In the Aikido console, go to Integrations › Task Trackers › ServiceNow and connect your ServiceNow instance to enable automatic ticket creation from findings.
    Audit source code for logic flaws and vulnerabilities beyond what traditional SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. tools detect, using AI-powered pentest-grade analysis.
    📍In the Aikido console, go to Code › AI Code Audit and connect a repository to trigger pentest-grade AI reasoning on your source code.
    • New AI Code Audit capability performs pentest-grade reasoning on source code to catch logic flaws and vulnerabilities that traditional scanners miss — activated by connecting a repo.
    • New Aikido MCP integration lets AI coding assistants (e.g. Cursor, Claude) query Aikido issues — critical findings, leaked secrets, and open vulnerabilities — directly from the coding environment.
    • New ServiceNow integration automatically converts security findings into ServiceNow tickets, routing them into existing team workflows.
    • Adds CVE lookup via Aikido's chat interface for rapid vulnerability research.
    • Adds release gating with SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. Mode for code scanning, enabling enforcement of security SLAs at the pipeline level.

    +11 more show less

    • Adds Oracle Cloud support with 50+ detection rules for cloud security scanning.
    • Adds support for onboarding an entire Alibaba Cloud organization.
    • Adds GCP support for VM scanning.
    • Adds Pentest Pause and Pentest Monorepo support.
    • Adds Golang ecosystem support to Device Protection.
    • Adds Slack and Microsoft Teams inbox notifications for Device Protection.
    • Adds macOS silent install support for MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. deployment in Device Protection.
    • Expands Zen Firewall Agent to .NET, Java, PHP, Ruby, Golang, and Node runtimes.
    • New Zen Firewall view to inspect why a specific IP is being blocked.
    • New IDE releases for VSCode, JetBrains, and Visual Studio with added IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanning support in JetBrains.
    • New API endpoints: List Licenses, List Malware, and Get IDE/MCP usage statistics.

    16 details in Everything

55. #49 - Visualize Threat models, Device Protection for Windows and Labels on Repositories & Containers seen Jul 13, 2026 · issue 014

    Aikido #49 adds threat model diagrams, Windows device protection, repo/container labels, and a wave of new API endpoints.

    └──▷ HOW TO FIND IT
    Filter your issue feed to only repositories tagged with a specific business unit or data-sensitivity label to prioritize remediation for PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations.-handling services.
    📍In the Aikido console, go to Repositories (or Container Images) › select a repo › Labels › add a label (e.g. PII or business-unit:payments). Then in the Issues feed, use the Labels filter to scope results to that label.
    Export an SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. for a specific device to inventory software components and feed downstream vulnerability management tools.
    📍In the Aikido console, go to Endpoint › Devices › select a device › Export SBOM.
    • New threat model visualization: every AI pentest and code audit now ships an architecture diagram showing roles and trust boundaries.
    • Device Protection now supports Windows, including MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. rollout for fleet-wide deployment.
    • New Labels feature lets you attach arbitrary metadata (business unit, PII, region, etc.) to repositories and container images and filter your issue feed by those labels.
    • Code Audit gains a Retest capability to re-evaluate issues after code changes.
    • Endpoint feature adds device SBOM export.

    +7 more show less

    • Zen Firewall adds agents for .NET, PHP, Ruby, and Golang (in addition to existing Node support).
    • Package Proxy adds malware scanning for private registries.
    • New CIS KubernetesCIS KubernetesHardening benchmarks published by the Center for Internet Security for Kubernetes clusters, giving cyber tools a concrete, versioned checklist of configuration checks to run and report against. Benchmark report available.
    • MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. v1.0.8 adds a new search repositories tool.
    • Task Trackers now support specifying which repository tasks should be created for, across all task managers.
    • Task Trackers now support configuration of multiple task trackers simultaneously.
    • New API endpoints: List Zen Users; Add Exception; List Devices, Activity Logs, Exceptions, and Permission Groups for Device Protection; Export Single Repository Report; List Notes.

    12 details in Everything

56. #50 - Agentic Dependency AutoFix, Registry Proxy and Device Protection adds Ruby and Rust seen Jul 13, 2026 · issue 014

    Aikido adds agentic dependency AutoFix, a registry proxy for malware blocking, and Ruby/Rust device protection.

    └──▷ HOW TO FIND IT
    Use Agentic Dependency AutoFix on a project with many interlocking dependencies to let Aikido automatically compute and apply a safe upgrade path.
    📍In the Aikido console, open a dependency vulnerability finding and select AutoFix to trigger the agentic resolution workflow.
    • New Agentic Dependency AutoFix automatically resolves complex, interlocking dependency interactions on your behalf.
    • New Registry Proxy routes your private registry through Aikido to block malware and risky new packages and serve safe, patched versions before they reach your codebase.
    • Device Protection now covers Ruby (gems) and Rust (crates), blocking malware on install and adding them to your device SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
    • Continuous Pentest adds Azure support for cloud environment scanning.
    • Continuous Pentest now supports selecting specific branches for On Schedule runs.

    +8 more show less

    • Supports importing labels directly from GitHub.
    • MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration updated with a new auth flow plus workspace, branch, and team filters.
    • Code Audit enables adding additional custom instructions before an audit begins.
    • Zen Firewall adds new agents for .NET, Python, PHP, Golang, and Node.
    • New IDE plugin releases for JetBrains.
    • API now supports managing labels on repositories.
    • API now supports listing container runners.
    • AI Pentest adds a Letter of Attestation capability.

    13 details in Everything

57. New - Code Audit: Pentest-grade reasoning on your source code, no environment required. 🚀 seen Jul 13, 2026 · issue 014

    Aikido launches Code Audit: agentic pentest-grade source code reasoning that finds logic flaws without a live environment.

    └──▷ HOW TO FIND IT
    Launch a code audit on a connected repo directly from the Aikido console — no staging URL or pentest scope needed.
    📍In the Aikido console, go to Code Audit, select the target codebase, review the credit cost shown upfront, and click Start Audit.
    • New Code Audit feature applies agentic, pentest-grade reasoning directly to source code to detect logic flaws — such as cross-tenant data leakage — that pattern-based scanners miss.
    • Supports codebases that are difficult to test via URL: mobile apps, smart contracts, desktop apps, embedded software, and libraries.
    • Integrates with Aikido's existing issue experience: findings include code-based evidence, root cause analysis, remediation guidance, and AI-powered AutoFix for opening remediation PRs.
    • Upfront credit-based pricing displayed before audit starts, with cost scaled to codebase size and complexity — no hidden setup costs.
    • Requires no staging environment, traffic replay, or agent deployment — connect a repo and start the audit immediately.

    5 details in Everything

58. New - Extreme Noise Reduction for Secrets and CVEs 🚀 seen Jul 13, 2026 · issue 014

    Aikido adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered AutoTriage for secrets and CVEs to cut noise and automate prioritization decisions.

    └──▷ HOW TO FIND IT
    Review a Secrets AutoTriage outcome to confirm or override the agent's liveness and scope assessment for an ambiguous credential.
    📍In the Aikido console, open a secrets finding › AutoTriage result to read the agent's explanation of the credential type, liveness, and risk level, then accept or override the decision.
    • New Secrets AutoTriage agent: assesses whether a detected secret is a real, exposed credential and evaluates its liveness and scope to determine actionable risk.
    • New CVE Exploitability Analysis agent: uses LLM reasoning against your actual codebase to determine whether a CVE is reachable and how urgently it must be addressed.
    • Automated remediation actions: the CVE agent can upgrade, downgrade, snooze, or ignore findings automatically based on configurable rules.
    • Audit log per run: every agent analysis is logged with a short rationale so teams can review decisions and override them.

    4 details in Everything

59. New - Protect Company Devices From Supply Chain Attacks 🚀 seen Jul 13, 2026 · issue 014

    Aikido launches Device Protection: real-time malware blocking, extension governance, and group-based policies for developer devices.

    └──▷ HOW TO FIND IT
    Review and action a developer's blocked-install exception request without leaving Aikido.
    📍In the Aikido console, go to Device Protection › Inbox, locate the pending approval request, review the flagged package details, and approve or deny the exception.
    • New Device Protection agent provides real-time malware blocking across npm, PyPI, Maven, and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. package ecosystems powered by Aikido Intel.
    • Adds extension governance covering VS Code, OpenVSX, Chrome, and skills.sh extensions with policy-based controls.
    • New request-and-approval workflow pauses blocked installs and routes one-click exception requests to the admin Inbox inside Aikido.
    • Supports group-based policies allowing different installation rules to be set per team.
    • Continuous device inventory delivers an always-current view of every package and extension installed per developer device.

    5 details in Everything

60. #51 - Repository Code Quality scans, Ignore Approval Inbox and Noise Reduction for Secrets & CVE’s Jul 13, 2026 · release notes

    Aikido v51 adds Repository Code Quality scans, Azure DevOps Self-Managed support, and several new API endpoints.

    • Adds Repository Code Quality scans (early access) to monitor codebase trends and spot refactoring hotspots
    • Adds Approval Inbox for Ignores to route ignore requests through admin sign-off
    • Adds Noise Reduction layer that flags truly exploitable secrets/CVEs and quiets non-exploitable ones
    • Added Render cloud misconfiguration scanning
    • Adds K8s namespaces to container labels

    +13 more show less

    • Adds Terraform module for GCP project/organization onboarding
    • Adds PHP composer support
    • Supports Google Cloud Artifact Registry Proxy
    • Adds Zen Firewall Agent releases for Java, Python, Ruby, Golang and Node
    • Adds ElysiaJS support for Node
    • New IDE releases for VSCode and Jetbrains, including CLion
    • Adds API endpoint to List snooze and ignored issues from PR
    • Adds API endpoint to Get Device Protection SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
    • Adds API endpoint to Get SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. settings
    • Adds API endpoint to List AutoFix history
    • Adds API endpoint to Generate GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. report
    • Adds API endpoints to Get, Add, Update, Remove Container label
    • Adds API endpoint to List repository PR configuration

    18 details in Everything

61. 🚀 Extreme Noise Reduction for Secrets and CVEs Jul 8, 2026 · release notes

    Adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-driven Secrets AutoTriage and CVE Exploitability Analysis with auto-remediation capabilities.

    • Adds Secrets AutoTriage to determine whether detected secrets are real credentials and actionable risk.
    • Adds CVE Exploitability Analysis using LLM reasoning to identify exploitable CVEs and automatically upgrade, downgrade, snooze, or ignore findings.
    • Adds run logging for Secrets AutoTriage and CVE Exploitability Analysis to audit agent actions.

    3 details in Everything

62. #50 - Agentic Dependency AutoFix, Registry Proxy and Device Protection adds Ruby and Rust Jun 30, 2026 · release notes

    Aikido #50 introduces agentic dependency autofix, registry proxy, Ruby/Rust device protection, and new API endpoints.

    • device_protection agent now covers Ruby and Rust platforms, blocking installation of malicious gems/crates and adding them to the device SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
    • GET /api/repositories/:id/runners endpoint lists container runners for a repository
    • PUT /api/repositories/:id/labels endpoint manages labels on repositories

    3 details in Everything

63. #49 - Visualize Threat models, Device Protection for Windows and Labels on Repositories & Containers Jun 15, 2026 · release notes

    Visualized threat model diagrams, Windows device protection with MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies., repository/container labels, and new Zen API endpoints.

    • Every AI pentest & code audit now ships a diagram of your app's architecture, roles, and trust boundaries
    • Device Protection is now available for Windows, with MDM support to roll it out across your fleet
    • Attach any metadata you want to repositories and container images (business unit, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., region, ... ) and filter you issue feed based on those labels

    3 details in Everything

64. #48 - AI Code Audit, Aikido MCP and ServiceNow Integration Jun 2, 2026 · release notes

    New AI Code Audit engine, Aikido MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration, ServiceNow ticketing, and multiple API endpoints added in v48.

    • Adds Aikido MCP capability to search and fetch issues directly from an AI coding assistant
    • Adds ServiceNow Integration to connect ServiceNow as a task tracker for automatic ticket creation
    • Adds new API endpoints: List Licenses, List Malware, and Get IDE/MCP usage statistics
    • Adds Oracle Cloud support with +50 rules under the Cloud section
    • Adds Alibaba organization onboarding capability under the Cloud section

    +1 more show less

    • Adds GCP VM Scanning support

    6 details in Everything

65. 🚀 Code Audit: Pentest-grade reasoning on your source code, no environment required. May 26, 2026 · release notes

    Introduces Code Audit feature using agentic reasoning to detect logic flaws in source code without requiring a live environment.

    • Adds Code Audit capability to find logic flaws like cross-tenant data leakage directly on connected repositories
    • Enables AutoFix for creating remediation PRs via the issue experience in the Code Audit workflow
    • Pricing for Code Audit is exposed upfront in credits before starting an audit

    3 details in Everything

66. #47 - Aikido Device Protection and Aikido AI Chat May 18, 2026 · release notes

    Adds Device Protection agent to block malicious packages, embeds Aikido AI Chat in AutoFix and Code Analysis, and exposes List Cloud rules, project mapping, and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. report AP

    • Adds Device Protection agent to stop supply chain attacks at install time by blocking malicious packages (npm, PyPI, Maven, NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code.) and risky IDE/browser extensions.
    • Embeds Aikido AI Chat in the AutoFix and Code Analysis Modal UI for natural language interaction and PR changes without leaving the product.
    • Adds support for Supabase common configuration issues in Cloud security checks.
    • Adds ability to pass custom context to AutoFix via .aikido files.
    • Adds Aikido Infinite support for Custom Frequencies (e.g., every 6 weeks).

    +5 more show less

    • Adds Zen Firewall Agent releases for Dotnet, Python, PHP, Ruby, Golang, and Node.
    • Adds Outbound Request Blocking support for the Ruby Zen Firewall Agent.
    • Releases new IDE agent versions for VSCode, JetBrains, and Eclipse.
    • Adds List Cloud rules API endpoint.
    • Adds Get project / repository mapping API endpoint.

    10 details in Everything

67. 🚀 Protect Company Devices From Supply Chain Attacks May 6, 2026 · release notes

    New Device Protection agent with real-time malware blocking, extension governance, and approval workflows for developer devices

    • Introduces the Device Protection agent covering malware blocking, extension governance, and group-based policies across npm, PyPI, Maven, NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code., VS Code, OpenVSX, Chrome, and skills.sh.
    • Adds a request-and-approval workflow where blocked installs trigger a one-click exception request reviewed in the Aikido Inbox.

    2 details in Everything

68. #46 - Escalating your AI Pentest and Additional Context for AutoTriage Apr 28, 2026 · release notes

    Aikido v46 adds escalatable pentest agents, AutoTriage context, Azure/GCP registry APIs, and more

    • Adds the ability to remove agent restrictions in Pentest Agents for deeper analysis and vulnerability confirmation
    • Adds support for providing specific environment knowledge to AutoTriage to improve finding accuracy and reduce false positives

    2 details in Everything

69. #45 - Aikido × Lovable - Vibe, Fix, Ship and Container Reachability Apr 10, 2026 · release notes

    Integrates pentesting for Lovable, adds container reachability mapping, new Safe Chain tool, and API/webhook management

    • Adds integrated pentesting for Lovable to find and fix security issues before launch.
    • Adds container reachability visualization to map network routes to running containers and view CVEs in deployment context.
    • Adds API endpoints to manage webhooks for repositories.
    • Adds API capability to manage excluded paths for a repository.
    • Adds support for custom headers in webhook configurations via the API.

    5 details in Everything

70. #44 - Talk to Aikido Autofix, Pentest Threat Model and support for Alibaba Cloud Mar 23, 2026 · release notes

    Adds Alibaba Cloud support, Aikido AutoFix refinement, and multiple API endpoints for threat modeling.

    • Adds Alibaba Cloud as a supported platform to scan for misconfigs, exposed resources, and risky settings.
    • Adds ability to refine AutoFixes iteratively using natural language via the Talk to Aikido AI feature.
    • Adds Pentest Threat Model providing a real-time view of attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. and testing posture.

    3 details in Everything

71. #43 - Aikido Infinite (Continuous Pentesting), VM Reachability Diagrams & IDE full scan Mar 4, 2026 · release notes

    Aikido Infinite continuous pentesting, VM reachability diagrams, IDE full scans, and new API endpoints for PR config and subdomains.

    • Adds Aikido Infinite continuous pentesting to automatically re-pentest apps after code changes and validate exploitability.
    • Adds VM Reachability Diagrams to visualize network paths, entry points, and exposed ports for cloud findings.
    • Adds full Workspace Scan across VS Code, Jetbrains, Visual Studio, Eclipse, and Cursor, with IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanning in VS Code.
    • Adds GitHub support for ignoring security issues and code quality within the PR directly from Aikido.
    • Adds package health for PHP and malware detection for skills.sh, Go, Rust, and WordPress plugins in Intel.

    +12 more show less

    • Adds Autofix suggestions for Code Quality fixes.
    • Adds ELS libraries support for .NET autofix.
    • Adds container image include/exclude by pattern matching.
    • Adds support for multiple tags of an image for the same cluster in Kubernetes scanning.
    • Adds file upload support for the AI Pentest agent browser.
    • Adds SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels.-based two-factor authentication and OAuth Password Grant support for AI Pentest.
    • Adds Jira custom field setting support in Integrations.
    • Adds direct actions and improved detail views in Slack alerts.
    • Adds Comp AI integration for Governance, Risk, and Compliance.
    • Adds API endpoint Save pull request config for Azure, Bitbucket and Github.
    • Adds API endpoint Adjust group severity.
    • Adds API endpoint Add subdomains to attack surface domains.

    17 details in Everything

72. #42 - Dep Upgrade Analysis, Eclipse IDE, AI Pentest Preview & Real Time Kubernetes Image Scanning Feb 9, 2026 · release notes

    New Eclipse IDE plugin, in-cluster Kubernetes scanning, dependency upgrade analysis, and AI pentest payment skip

    • Aikido AutoFix analyzes dependency upgrades to surface code-breaking impacts early
    • Continuously scans container images running in your Kubernetes clusters to detect vulnerabilities on all running containers
    • Run a full whitebox pentest without paying upfront and only pay to unlock High or Critical findings
    • Eclipse IDE plugin released to scan projects in real time for secrets, API keys, and vulnerabilities

    4 details in Everything

73. #41 - Aikido MCP, re-testing AI Pentest findings, and Azure Management Group support Dec 30, 2025 · release notes

    Adds Aikido MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. for agent code analysis, Azure Management Group auto-discovery, and GraphQL to AI Pentest

    • Adds Aikido MCP to let AI agents analyze code security risks locally without sending data to the cloud
    • Adds re-testing capability for individual AI Pentest findings to verify fixes without a full pentest run
    • Adds Azure Management Group support to automatically discover all groups and subscriptions in a single connection

    3 details in Everything