Static code analysis (SAST)
Scans your own source code for security flaws before an issue can be merged.
Aikido Security Partner
Security from code to cloud, delivered by Cybergen.
Aikido brings code scanning, cloud security, AI pentesting and runtime protection into one developer-friendly platform. Cybergen helps you choose it, deploy it and tune it, then backs it with CREST-accredited testing and expert advice.
CYBERGEN AND AIKIDOSASTOpen source (SCA)SecretsInfrastructure as codeContainersCloud postureAI pentestingRuntime protection
The partnership
Developer-first tooling. Expert guidance.
Most teams already run some security scanning. The trouble is that it produces thousands of alerts, sits outside developer tools and arrives too late to fix cheaply.
Aikido tackles that with one platform that filters findings by real risk. Cybergen makes it work in your organisation, from first setup through to continuous improvement, and connects it to your wider security and compliance programme.
See all our technology partnersWe're thrilled to partner with Aikido. This alliance aligns perfectly with our mission to shift security left and support clients in building secure applications from day one.
Aaron BennettCEO, Cybergen
100,000+teams worldwide use Aikido
$60MSeries B funding, January 2026
SOC 2plus ISO 27001 and ISO 42001 compliance
June 2025Cybergen and Aikido partnership announced
Aikido figures and certifications as published by Aikido Security.
The Aikido platform
Four modules. One view of risk.
Choose an area to explore what Cybergen can supply, deploy and support.
Security checks inside the editor, the pull request and the pipeline, so developers see real issues while the fix is still cheap.
Open source dependencies (SCA)
Monitors the packages you rely on for known vulnerabilities, and can generate an SBOM.
Secrets detection
Catches API keys, passwords, certificates and encryption keys that have leaked into code.
Malware in dependencies
Stops malicious packages entering your software supply chain.
Container image scanning
Checks container operating systems for packages with security issues.
Infrastructure as code
Finds misconfigurations in Terraform, CloudFormation and Kubernetes files.
Licences and SBOM
Flags licence risks such as restrictive terms, and produces a software bill of materials.
End-of-life software
Tells you when frameworks and runtimes are no longer maintained.
Code quality and PR review
AI-assisted review for bug risks and anti-patterns on every pull request.
AI AutoFix
Suggested fixes for SAST, IaC, SCA and container findings, ready for a developer to review.
Agentless, read-only visibility across your cloud accounts, tied back to the code that created the risk.
Cloud posture management (CSPM)
Spots misconfigurations, public exposure and overly permissive IAM across AWS, Azure and Google Cloud.
Virtual machine scanning
Finds vulnerabilities on cloud virtual machines without installing an agent.
Kubernetes scanning
Reviews clusters on managed Kubernetes services for risky configuration.
Hardened images
Secure base images that reduce the vulnerabilities you inherit.
Data security posture (DSPM)
Helps you understand where sensitive cloud data sits and how exposed it is.
Cloud attack paths
Shows how separate weaknesses could chain together into a route to something that matters.
AI-driven penetration testing and dynamic scanning that prove what is exploitable, in between your deeper manual assessments.
AI penetration tests
Autonomous agents map, attack and then re-exploit each finding to confirm that it is real.
Continuous pentesting
Runs a scoped test when security-relevant code changes, rather than once a year.
External network testing
Tests your internet-facing network estate.
Mobile app testing
Extends AI-driven testing to mobile applications.
Dynamic testing (DAST)
Authenticated testing of running web applications from the outside in.
API discovery and fuzzing
Finds API endpoints and tests how they behave under hostile input.
Attack surface monitoring
Keeps track of what you expose to the internet.
Protection at runtime and on developer devices, for the gap between finding a flaw and shipping the patch.
Runtime protection (Zen)
An in-app firewall that runs as a library inside your application and blocks attacks such as injection and path traversal.
Bot and abuse protection
Rate limiting and blocking for bots, scrapers, known bad actors and traffic you choose to exclude.
Device protection
Helps protect developer devices, where malicious packages and extensions first land.
See it work
From alert overload to a fix in the pull request
Watch how a noisy scan becomes a short list of real issues, each with a clear next step.
1Scan2Triage3Fix
One scan across your stack
Every module reports into a single place, rather than a dashboard per tool.
- SAST0
- Open source (SCA)0
- Secrets0
- Infrastructure as code0
- Containers0
- Cloud posture0
Filtered down to real risk
Duplicates go first, then anything your code cannot reach or an attacker cannot exploit.
- All findings0
- After de-duplication0
- Reachable in your code0
- Exploitable and exposed0
A fix, ready to review
A developer gets a suggested change in the pull request. Nothing merges without their approval.
users.pySQL injection
- query = f"SELECT * FROM users WHERE id = {user_id}"
+ query = "SELECT * FROM users WHERE id = %s"
- return db.execute(query)
+ return db.execute(query, (user_id,))
Illustrative example with fictional data. Results depend on your code, cloud and configuration.
Across the lifecycle
Security at every stage
Aikido meets developers where they work and keeps watching once code is live. Select a stage to see what happens there.
Issues and suggested fixes appear inside IDEs such as VS Code, JetBrains and Cursor.
SASTSecretsInline fixes
New findings are raised in review, so vulnerable changes can be stopped before they merge.
SCAPR reviewAutoFix
CI gates enforce your standards without slowing every build.
ContainersIaCSBOM
Running applications and APIs are tested the way an attacker would approach them.
DASTAPI testingAI pentest
Cloud posture and in-app protection keep watching after go-live.
CSPMZenAttack surface
AI pentesting and CREST testing
Test more often. Keep the human assurance.
Aikido AI pentests cover the code you ship every week. Cybergen's CREST-accredited testers go deep where judgement matters. Used together, each makes the other more valuable.
- Map
Agents read code and API specifications, or probe the live application, to list what an attacker could reach.
- Attack
Specialist agents work through specific attack vectors, trying to break expected behaviour.
- Prove
Separate agents re-exploit each finding. Anything that cannot be proven is dropped.
| Comparison |  AI pentesting |  CREST penetration testing |
|---|---|---|
| Best used for | Frequent testing of new releases and changed code | Independent, in-depth assurance of what matters most |
| How it works | Hundreds of AI agents map, attack and re-exploit to confirm findings | Experienced testers working to a scope agreed with you |
| Strongest at | Speed, repeatability and coverage as you ship | Creative attack chains and judgement in your business context |
| Control | You choose the targets, with pre-flight checks and an option to stop all agents | Rules of engagement agreed with Cybergen before testing starts |
| You receive | Verified findings, reproduction steps, fix guidance and retesting | A CREST-accredited report, a debrief and remediation support |
Use cases
What do you need to achieve?
Select a goal to see which Aikido capabilities fit and how Cybergen supports them.
USE CASE 01
Pass your audit
Turn code and cloud findings into evidence. Aikido maps cloud checks to SOC 2 and ISO 27001 and syncs to compliance tools including Vanta and Drata. Cybergen adds the consultancy around it.
Aikido capabilities
Compliance mappingSBOM generationPentest reportsCybergen service
ISO ConsultancyUSE CASE 02
Consolidate your tools
Replace a stack of separate scanners and dashboards with one prioritised view, then let us tune it so developers only see what matters.
Aikido capabilities
Aikido CodeAikido CloudAuto-triageCybergen service
DevSecOps & Code SecurityUSE CASE 03
Secure AI-written code
AI coding tools help teams ship faster, and they can introduce flaws just as fast. Put automated checks in the pull request so every change gets reviewed, whoever or whatever wrote it.
Aikido capabilities
SASTDeep PR reviewSecrets detectionCybergen service
AI SecurityUSE CASE 04
Protect your supply chain
Know what is in your software, spot malicious packages and answer customer and regulator questions with a software bill of materials.
Aikido capabilities
SCAMalware detectionSBOMCybergen service
Third-Party RiskUSE CASE 05
Test between pentests
Keep your annual CREST penetration test, and use continuous AI testing to cover the releases you ship in between.
Aikido capabilities
AI pentestsContinuous pentestingDASTCybergen service
CREST Penetration TestingUSE CASE 06
Shield live applications
Reduce exposure with in-app protection while a fix works through your release process, and connect the alerts to your wider monitoring.
Aikido capabilities
Zen runtime protectionBot protectionAttack surfaceCybergen service
Application SecurityWorks with your toolchain
Fits how your teams already work
Aikido connects to common source control, pipelines, cloud platforms and work trackers. It also syncs with compliance tools including Vanta and Drata, both Cybergen partners.
GitHubGitLabBitbucketAzure PipelinesVS CodeJetBrainsCursorWindsurfAWSMicrosoft AzureGoogle CloudKubernetesTerraformJiraAsanaClickUpMondayYouTrackMicrosoft TeamsVantaDrata
Why buy through Cybergen
More than a licence
A tool only reduces risk when it is configured well and someone acts on what it finds. That is where we come in.
Selection and scoping
We review your stack, languages, repositories and cloud accounts, then recommend the Aikido modules that fit. You only buy what you will use.
Rollout and tuning
We connect repositories, pipelines and clouds, agree quality gates and tune triage so developers trust what they are shown.
Ownership and process
We help route findings to the right teams, with clear responsibilities between development and security.
People-led assurance
Our CREST-accredited testers go after the business logic and attack chains that need human judgement.
Compliance alignment
We connect Aikido evidence to ISO 27001, NIS2, DORA and SOC 2 work, with consultants who know what auditors ask for.
Intelligence and response
We connect application findings to threat intelligence, 24x7x365 monitoring and incident response when something goes wrong.
- Assess
- Prove
- Supply
- Implement
- Support
Keep exploring
Insight and related services
ArticleSecure DevOps Made Simple: Cybergen and AikidoHow to secure DevOps pipelines without slowing developers: see how Cybergen and Aikido automate application security testing across your code and cloud.
Press releaseCybergen Partners With Aikido SecurityCybergen announces a strategic partnership with Aikido Security to help organisations secure code, cloud and applications with simpler developer-first tooling.
ArticleHow to Prevent Supply Chain Attacks: Key PrinciplesHow to prevent supply chain attacks: understand the risks, establish control, check supplier arrangements and keep improving to reduce third-party cyber risk.
ArticleAPI Security in 2025: Best Practices for Hidden RisksAPI security best practices for 2025: find shadow APIs, stop business logic abuse and combine documentation, testing and runtime monitoring to stay protected.What is Aikido Security?
Aikido is a developer-first security platform. It brings code scanning, cloud security, AI penetration testing and runtime protection into one place, and filters findings so teams can focus on real risk.
Can Cybergen supply Aikido licences?
Yes. Cybergen is an Aikido partner. We advise on the right modules, supply them, and can deploy, tune and support the platform for you.
Do we need to replace our existing tools?
Not necessarily. We start by reviewing what you already have. Some teams consolidate onto Aikido to reduce cost and noise, while others use it to fill specific gaps.
Does AI pentesting replace our CREST penetration test?
We do not recommend treating it that way. AI testing is well suited to frequent checks of changing code. A CREST-accredited, people-led test adds independent assurance and human judgement, and customers or regulators may specifically ask for it. Most organisations benefit from both.
Will it slow our developers down?
It should not when it is set up properly. Feedback appears in the tools developers already use, and we tune gates and triage so that they block real risk rather than every merge.
Which languages and platforms does it support?
Aikido connects to common source control, CI/CD and cloud platforms including GitHub, GitLab, Bitbucket, AWS, Azure and Google Cloud. Zen runtime protection supports Node.js, Python, PHP, Java, .NET, Ruby and Go. We confirm coverage for your stack during scoping.
Does Aikido need access to our source code?
Aikido uses read-only access for repository and cloud connections, and also offers on-premises scanning. We help you choose the right deployment for your security and data requirements.
Can you run a proof of value first?
Yes. We can connect a sample of your repositories and cloud accounts, agree success criteria and review the results with you before you commit.
Book a consultation
Talk to our Aikido team.
Tell us about your development teams, languages and cloud platforms and we will recommend the right Aikido modules and Cybergen services for you.
Prefer to talk? Call +44 (0) 1865 950 828
Or email [email protected]
Thanks, we've received your enquiry
A member of our team will be in touch shortly.