Aikido CSPM vs Endor Labs
Aikido CSPM
aikido.dev
Endor Labs
endorlabs.comSide by side
| Figure | Aikido CSPM | Endor Labs |
|---|---|---|
| Price from | $300/mo | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 6 | 3 |
| Spec score · DevSecOps Platforms | 9.5 (#1) | 8.9 (#2) |
| Founded | Gartner Peer Insights lists Aikido Security as founded in 2022. | 2021 |
| Free tier limits | The Developer plan is free forever, includes one cloud account, and lists CSPM among its cloud features. | The Developer tier scans locally and provides read-only access to vulnerability data, without a UI, policies, or scan history. |
| Headquarters | Ghent, Belgium | Palo Alto, California, United States |
| Integrations | The integration directory lists AWS, Azure, Google Cloud, GitHub, GitLab, Bitbucket, GitHub Actions, GitLab CI/CD, Jira, Asana, Slack, Microsoft Teams, Drata, Vanta, Docker, Kubernetes, IDEs and many other tools. | Documented integrations include GitHub, GitLab, Jenkins, Jira, Slack, Microsoft Defender for Cloud, Azure DevOps, Bitbucket, and cloud marketplaces. |
| Rating on G2 | 4.6 out of 5 from 266 reviews | 4.8 out of 5 from 10 reviews |
| Rating on Gartner Peer Insights | 4.7 out of 5 from 84 reviews | 4.7 out of 5 from 4 reviews |
| Secrets detection | Secrets scanning covers IDE, CI and Git workflows, includes secret-liveness checks and supports pre-commit blocking. | The platform detects exposed credentials and API keys before they reach production. |
| Self-hosting | Aikido says local scanners can run on-premises, while its standard product is delivered as a SaaS service. | Endor Outpost is offered as an on-premises deployment for eligible customers with strict residency or compliance requirements. |
| Source-code handling | Repositories are cloned into temporary Docker environments, removed after analysis, and Aikido says it does not retain source code or GitHub refresh tokens. | The vendor says cloud scans briefly clone source into a scanning container and destroy it afterward; CI scans can keep code inside the customer runner. |
| Support | Published support channels include email/help desk, chat, knowledge base, FAQs/forum, documentation, live online sessions, webinars and videos. | Endor Labs offers multiple Technical Success tiers tailored to team needs and deployment complexity. |
| What it does | Aikido is a developer-focused security platform that scans code, cloud environments and runtime systems, prioritizes actionable vulnerabilities and helps teams remediate them. | Endor Labs is an application-security platform that analyzes first-party code, open-source dependencies, secrets, containers, and AI-generated software. |
Plans
Aikido CSPM
- DeveloperFree
- Basic$300 a month
- Advanced$600 a month
- Pro$600 a month
- Typical Pentest$4,000, paid once
- EnterprisePriced on request
In their own words
Aikido CSPM
Aikido CSPM gives teams a unified view of cloud misconfigurations, exposures, identity risks, and compliance gaps across cloud environments. It connects to accounts through read-only APIs, with no agents required, and lists AWS, Azure, GCP, and selected other providers such as DigitalOcean. Checks include public storage buckets, unencrypted databases, open SSH ports, and overly permissive IAM policies. Context-aware scoring prioritizes higher-impact production issues over lower-impact staging findings. Cloud Search accepts plain-language queries and can turn searches into real-time alerts. For some issues, Aikido offers guided fixes and auto-generated pull requests, but does not automatically change infrastructure. Other listed capabilities include container image and EC2 vulnerability scanning, IaC checks, runtime detection, asset inventory, attack path analysis, and SBOM management. Compliance checks map to SOC 2 and ISO 27001, with reporting that can sync to Vanta and Drata. The free Developer plan includes one cloud account; Basic is $300 a month, while Pro and Advanced are each $600 a month.
Endor Labs
Endor Labs is an application security platform spanning code, secrets, dependencies, container images and coding agents. AURI for Developers helps scan for vulnerabilities, detect secrets and block malicious dependencies in AI coding workflows. Endor Code provides AI SAST and secrets detection; Endor Open Source adds reachability-based SCA, malicious-package detection, AI model governance, and SBOM and VEX generation. The platform can inventory coding agents, models, MCP servers and skills, then enforce policies on agent actions. Integrations include GitHub, GitLab, Bitbucket, CircleCI, Jenkins, Jira, Slack, Vanta, Cursor, Claude, Gemini and GitHub Copilot. Scans can run through cloud apps, inside CI/CD runners or with Endor Outpost for scheduled monitoring and on-premises deployment. The company says cloud scanning briefly clones code into a container that is destroyed after scanning, while CI/CD scanning keeps code in the runner. The free Developer tier supports local scans and read-only vulnerability data, but has no UI, policies or scan history. Paid plans are seat-based and require contacting sales for pricing.