Skip to content
SPECIFICTION
Get listed

Aikido CSPM

aikido.dev

From $300/mo Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit aikido.dev
Spec score 9.5 #1 of 41 in Cloud Security Posture Management Software

What it is

Aikido CSPM gives teams a unified view of cloud misconfigurations, exposures, identity risks, and compliance gaps across cloud environments. It connects to accounts through read-only APIs, with no agents required, and lists AWS, Azure, GCP, and selected other providers such as DigitalOcean. Checks include public storage buckets, unencrypted databases, open SSH ports, and overly permissive IAM policies. Context-aware scoring prioritizes higher-impact production issues over lower-impact staging findings. Cloud Search accepts plain-language queries and can turn searches into real-time alerts. For some issues, Aikido offers guided fixes and auto-generated pull requests, but does not automatically change infrastructure. Other listed capabilities include container image and EC2 vulnerability scanning, IaC checks, runtime detection, asset inventory, attack path analysis, and SBOM management. Compliance checks map to SOC 2 and ISO 27001, with reporting that can sync to Vanta and Drata. The free Developer plan includes one cloud account; Basic is $300 a month, while Pro and Advanced are each $600 a month.

Spec sheet

What it does
Aikido is a developer-focused security platform that scans code, cloud environments and runtime systems, prioritizes actionable vulnerabilities and helps teams remediate them.Read 15 Oct 2026 · aikido.dev
Integrations
The integration directory lists AWS, Azure, Google Cloud, GitHub, GitLab, Bitbucket, GitHub Actions, GitLab CI/CD, Jira, Asana, Slack, Microsoft Teams, Drata, Vanta, Docker, Kubernetes, IDEs and many other tools.Read 15 Oct 2026 · integrations.aikido.dev
Support
Published support channels include email/help desk, chat, knowledge base, FAQs/forum, documentation, live online sessions, webinars and videos.Read 15 Oct 2026 · getapp.com
Headquarters
Ghent, BelgiumRead 28 Sep 2026 · aikido.dev
Founded
Gartner Peer Insights lists Aikido Security as founded in 2022.Read 15 Oct 2026 · gartner.com
Company
Aikido says it was founded in 2022 and lists its European headquarters in Ghent, Belgium.Read 28 Sep 2026 · aikido.dev
Agentless access
Aikido connects to cloud accounts through read-only APIs and says it requires no agents.Read 28 Sep 2026 · aikido.dev
Agentless deployment
Aikido says cloud monitoring is agentless and requires only minimal read-only cloud permissions, with no installed cloud agents or performance impact.Read 15 Oct 2026 · aikido.dev
Cloud and container coverage
Cloud features include CSPM checks, infrastructure-as-code analysis, container and virtual-machine scanning, and cloud asset graph search.Read 15 Oct 2026 · aikido.dev
Cloud providers
The CSPM page lists AWS, Azure, GCP, and select other providers such as DigitalOcean.Read 28 Sep 2026 · aikido.dev
Cloud search and alerts
Cloud Search supports plain-language queries across cloud resources, and searches can become real-time alerts for matching assets.Read 28 Sep 2026 · aikido.dev
Company headquarters
The company lists Keizer Karelstraat 15, 9000 Ghent, Belgium as its headquarters address.Read 15 Oct 2026 · aikido.dev
Company legal identity
The maker identifies itself as Aikido Security BV, with Belgian enterprise number BE0792914919.Read 15 Oct 2026 · aikido.dev
Company size
Gartner Peer Insights lists the company in the 51–200 employee range.Read 15 Oct 2026 · gartner.com
Compliance and integrations
The CSPM page says checks map to SOC 2 and ISO 27001 and that compliance reporting can sync with Vanta and Drata.Read 28 Sep 2026 · aikido.dev
CSPM
Its CSPM connects to AWS, Azure and Google Cloud through read-only APIs to identify misconfigurations, exposed resources, excessive permissions and compliance gaps.Read 15 Oct 2026 · aikido.dev
Customers at Series A
TechCrunch reported that Aikido had about 3,000 small and midsize customers when its Series A was announced.Read 15 Oct 2026 · techcrunch.com
Documentation
The help center contains getting-started guidance, account and identity management, repository and cloud setup, scanning guides, CI and pull-request gating, AutoFix, AI tools, task trackers, alerts, compliance reporting and troubleshooting articles.Read 15 Oct 2026 · help.aikido.dev
Free tier limits
The Developer plan is free forever, includes one cloud account, and lists CSPM among its cloud features.Read 28 Sep 2026 · aikido.dev
Funding news: Series A
TechCrunch reported on May 1, 2024 that Aikido raised a $17 million Series A led by Singular and had raised $22.5 million total at that point.Read 15 Oct 2026 · techcrunch.com
Funding news: Series B
Aikido announced on January 14, 2026 that it raised a $60 million Series B at a $1 billion valuation, led by DST Global with participation from PSG Equity, Singular and Notion Capital.Read 15 Oct 2026 · aikido.dev
Integration catalog size
GetApp lists 56 integrations, including GitHub, Vanta, Jira, Slack, Android Studio, Drata, CircleCI, Jenkins, Docker, Linear, Kubernetes and Postman.Read 15 Oct 2026 · getapp.com
Limit: accuracy and AI maturity
PeerSpot reviewers report that output accuracy can lag, AI may miss issues, and AI-generated fixes still receive manual review because governance and reliability are considered immature.Read 15 Oct 2026 · peerspot.com
Limit: cloud detection depth
A Capterra reviewer said the product was initially focused mainly on static code checks and requested real-time cloud event detection.Read 15 Oct 2026 · capterra.com
Limit: Jira integration
A PeerSpot reviewer specifically identified the Jira integration as needing improvement.Read 15 Oct 2026 · peerspot.com
Limit: pricing
A PeerSpot reviewer said pricing was high for ordinary users and suggested reducing the pricing model.Read 15 Oct 2026 · peerspot.com
Limit: remediation guidance
A PeerSpot reviewer requested more detailed beginner-oriented remediation guidance and stronger alert and reporting customization.Read 15 Oct 2026 · peerspot.com
Limit: trial scope
A Capterra reviewer described the free trial as relatively limited.Read 15 Oct 2026 · capterra.com
Misconfiguration checks
Checks cover risks such as public storage buckets, unencrypted databases, open SSH ports, and overly permissive IAM policies.Read 28 Sep 2026 · aikido.dev
Offensive testing
Aikido offers DAST, attack-surface monitoring, API scanning, continuous pentesting and AI pentest assessments for web applications and APIs.Read 15 Oct 2026 · aikido.dev
Open-source projects
Aikido separately publishes or supports Opengrep, Zen, Safe Chain and Betterleaks; the main platform is presented as a commercial SaaS product.Read 15 Oct 2026 · aikido.dev
Paid tier support
The Pro plan includes same-day support, while Advanced includes priority support in Slack or MS Teams.Read 28 Sep 2026 · aikido.dev
Praise: consolidation and productivity
PeerSpot reviewers describe unified code and image scanning, easier developer workflows, improved code quality and substantial issue-closure gains.Read 15 Oct 2026 · peerspot.com
Praise: usability and triage
Capterra reviewers repeatedly praise rapid setup, useful findings, simple dashboards, good remediation advice and reduction of false positives.Read 15 Oct 2026 · capterra.com
Public API
The public developer hub documents token authorization, webhooks, rate limiting, issue exports, cloud assets, repositories, SBOMs, pull-request checks, teams, containers, domains, reports, compliance, users, custom rules, pentests, task trackers, endpoint protection and OpenAPI specification access.Read 15 Oct 2026 · apidocs.aikido.dev
Rating on Capterra
4.7 out of 5 from 6 reviewsRead 15 Oct 2026 · capterra.com
Rating on G2
4.6 out of 5 from 266 reviewsRead 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.7 out of 5 from 84 reviewsRead 15 Oct 2026 · gartner.com
Rating on GetApp
4.7 out of 5 from 6 reviewsRead 15 Oct 2026 · getapp.com
Rating on TrustRadius
8.1 out of 10 from 2 reviewsRead 15 Oct 2026 · trustradius.com
Remediation
Aikido provides guided fixes and auto-generated pull requests for some cloud issues, while stating it does not automatically change infrastructure.Read 28 Sep 2026 · aikido.dev
Risk prioritization
Context-aware scoring prioritizes higher-impact production issues over lower-impact staging issues.Read 28 Sep 2026 · aikido.dev
Runtime and device protection
The product family includes runtime protection, bot protection and device protection intended to block supply-chain and application attacks.Read 15 Oct 2026 · aikido.dev
SAST and SCA
The platform provides static analysis, dependency scanning, reachability analysis, license scanning, custom rules, CI integration and automated fixes.Read 15 Oct 2026 · aikido.dev
Scan timing
Aikido states that typical scans and tests take about one to five minutes and temporary containers are automatically removed afterward.Read 15 Oct 2026 · aikido.dev
Scanning features
The CSPM offering also describes container image scanning, AWS EC2 vulnerability scanning, Infrastructure as Code checks, and outdated runtime detection.Read 28 Sep 2026 · aikido.dev
Secrets detection
Secrets scanning covers IDE, CI and Git workflows, includes secret-liveness checks and supports pre-commit blocking.Read 15 Oct 2026 · aikido.dev
Security and compliance
Aikido's Trust Center lists GDPR, ISO 27001:2022, ISO/IEC 42001:2023, SOC 2, CSA STAR Level 1, TX-RAMP Level 2, and AWS Security Competency.Read 28 Sep 2026 · trustcenter.aikido.dev
Security certifications
The trust center lists GDPR, ISO 27001:2022, ISO/IEC 42001:2023, SOC 2, CSA STAR Level 1, TX-RAMP Level 2, AWS Security Competency, CREST membership and FedRAMP Moderate.Read 15 Oct 2026 · trustcenter.aikido.dev
Self-hosting
Aikido says local scanners can run on-premises, while its standard product is delivered as a SaaS service.Read 15 Oct 2026 · aikido.dev
Source-code handling
Repositories are cloned into temporary Docker environments, removed after analysis, and Aikido says it does not retain source code or GitHub refresh tokens.Read 15 Oct 2026 · aikido.dev
Zen licence
The Zen firewall repositories state that the software is available under AGPL or a commercial licence, with a commercial licence required for undisclosed commercial applications.Read 15 Oct 2026 · github.com

Plans and prices

Developer Free free forever 2 users · 10 repositories · 2 container images · 1 domain · 1 cloud account · 10 AI AutoFixes/month · 250k protected requests/month Read 15 Oct 2026 · aikido.dev
Basic $300 a month monthly 10 users · 100 repositories · 50 container images · 3 domains · 3 cloud accounts · unlimited AI AutoFixes/month · 10M protected requests/month Read 15 Oct 2026 · aikido.dev
Advanced $600 a month monthly 10 users · 500 repositories · 200 container images · 20 domains · 20 cloud accounts · 100 VM scaling groups · unlimited AI AutoFixes/month · 50M protected requests/month · 200 credits/month Read 15 Oct 2026 · aikido.dev
Pro $600 a month monthly 10 users · 200 repositories · 100 container images · 10 domains · 10 cloud accounts · 30 VM scaling groups · unlimited AI AutoFixes/month · 20M protected requests/month · 100 credits/month Read 15 Oct 2026 · aikido.dev
Typical Pentest $4,000, paid once per assessment single application and primary APIs · white-box testing · SOC 2 and ISO 27001 PDF report · free retesting Read 15 Oct 2026 · aikido.dev
Enterprise Priced on request tailored pricing Enterprise-grade modules Read 28 Sep 2026 · aikido.dev

Every Aikido CSPM plan and price →

Strong points and limits

Strong points

  • Connects through read-only APIs without agents
  • Cloud Search can create real-time alerts
  • Includes container scanning and IaC checks
  • Free Developer plan includes one cloud account

Limits

  • Does not automatically change infrastructure
  • Developer plan is limited to one cloud account
  • Basic costs $300 a month

Who it suits

It suits teams managing cloud assets across multiple providers that want misconfiguration checks, identity risk analysis, and compliance reporting. The free Developer plan includes one cloud account.

Aikido CSPM in depth

Read the full write-up

Overview

Aikido CSPM is a cloud security posture management service for teams that need to track configuration risks, exposed resources, identity permissions, and compliance across multiple cloud environments. It suits organizations looking to bring those checks together with broader security scanning; its guided fixes and pull requests help teams act on findings without handing the tool authority to change infrastructure.

Key features

Aikido connects to cloud accounts using read-only APIs and says it requires no agents. It covers AWS, Azure, GCP, and selected other providers, including DigitalOcean. Checks target familiar cloud risks such as public storage buckets, unencrypted databases, open SSH ports, and overly permissive IAM policies. That breadth makes it useful for teams managing more than one cloud, while the read-only model keeps infrastructure changes in the hands of operators.

Context-aware scoring ranks production issues above lower-impact staging findings, helping teams spend attention where exposure may matter more. Cloud Search accepts plain-language queries across resources, and a search can become a real-time alert for matching assets. Guided remediation and auto-generated pull requests for some issues shorten the route from finding to proposed fix, but Aikido does not automatically change infrastructure.

The CSPM offering also includes container image scanning, AWS EC2 vulnerability scanning, Infrastructure as Code checks, outdated runtime detection, SBOM management, identity risk analysis, and attack path analysis. Compliance checks map to SOC 2 and ISO 27001, with reporting that can sync to Vanta and Drata. The wider compliance framework set includes OWASP Top 10, CIS, NIS2, and PCI. This range is valuable when cloud posture is one part of a broader security workflow, though teams seeking automatic remediation should look elsewhere.

Pricing

The Developer plan is free forever and includes two users, one cloud account, 10 repositories, two container images, one domain, 10 AI AutoFixes per month, and 250,000 protected requests per month. It is a practical way for a small team to start, but its single-cloud-account cap and modest scanning quotas limit its fit for larger environments.

Basic costs $300 a month, billed as a total fee including 10 users. It raises capacity to 100 repositories, 50 container images, three domains, and three cloud accounts, with unlimited AI AutoFixes per month and 10 million protected requests per month. It fits teams that have outgrown the free caps but do not need the larger inventory allowances or VM scaling groups in higher tiers.

Pro costs $600 a month, billed as a total fee including 10 users. It provides 200 repositories, 100 container images, 10 domains, 10 cloud accounts, 30 VM scaling groups, unlimited AI AutoFixes, and 20 million protected requests per month. Same-day support makes it a stronger fit for teams that need faster help as well as more capacity.

Advanced also costs $600 a month, billed as a total fee including 10 users. For the same monthly price as Pro, it raises the limits to 500 repositories, 200 container images, 20 domains, 20 cloud accounts, 100 VM scaling groups, and 50 million protected requests per month; it also includes priority support in Slack or MS Teams. Enterprise has custom pricing and enterprise-grade modules.

Platforms

Aikido lists API, Linux, macOS, web, and Windows support, and describes its deployment model as hybrid. Its maker lists GDPR, ISO 27001:2022, ISO/IEC 42001:2023, SOC 2, CSA STAR Level 1, TX-RAMP Level 2, and AWS Security Competency among its security and compliance credentials.

Who it's for

Aikido CSPM is best suited to security and cloud teams that want a shared view of posture issues across multiple providers, plus adjacent scanning and compliance work. The free Developer tier suits a small evaluation or limited environment; Basic, Pro, and Advanced suit teams whose account, repository, or request needs exceed those caps. It is a weaker fit for teams that require the product to apply infrastructure changes automatically.

Pros and cons

Pros: Read-only, agentless cloud connections reduce deployment overhead while covering multiple providers.

Pros: Production-aware prioritization, searchable assets, and real-time alerts help focus response on higher-impact findings.

Pros: Guided fixes and pull requests pair posture findings with actionable next steps, while leaving infrastructure changes under team control.

Pros: The tiered quotas make it possible to start free and scale repository, cloud-account, container, and request capacity.

Cons: Developer is capped at one cloud account, and Basic at three, which may constrain teams with wider cloud estates.

Cons: Automated infrastructure remediation is not included; teams must review and apply changes themselves.

Cons: The free plan has limited monthly AutoFix and protected-request allowances, while Enterprise requires custom pricing.

Alternatives

Consider Mondoo CSPM if a free-forever option with cloud, Kubernetes, OS, SaaS, and API scanning is the priority; its open-source tier also includes a Kubernetes operator, extensible provider system, and asset inventory. Choose Prowler Cloud if a 15-day free trial with no cloud-account limit and access to every check and compliance framework is more useful for evaluation.

CloudSploit is a free alternative with a self-hosted open-source version, while its hosted commercial version has custom pricing. Powerpipe is another free, open-source option from Turbot. Qualys TotalCloud offers a free license with limited API calls for control evaluation and a separately priced Cloud Platform subscription.

For broader security needs, Bitdefender Total Security is a paid multi-device product with a free plan and trial; its Individual plan costs $59.99 a year for the first year, plus applicable sales tax, for five devices and one account. Rapid7 Surface Command and CrowdStrike Falcon Surface are paid alternatives with free trials and pricing that requires a separate conversation.

Verdict

Choose Aikido CSPM if you want multi-cloud visibility, prioritized findings, and adjacent scanning and compliance capabilities in one workflow, with guided fixes that preserve human control over infrastructure changes. Look elsewhere if automatic remediation is essential or if the free tier's one-account limit is too restrictive for your environment.

Verdict

Aikido CSPM combines cloud visibility, scanning, prioritization, and compliance features in one offering. Its guided fixes stop short of automatic infrastructure changes.

Where Specifiction places it

Alternatives to Aikido CSPMAll alternatives →