8.5 KiB
8.5 KiB
Security AI Tool Evaluation: Aikido
Tool Overview
Name: Aikido Security Type: All-in-One Security Platform Website: https://www.aikido.dev Primary Function: Application security, vulnerability scanning, SAST, DAST, SCA, secrets detection, compliance monitoring
Privacy Policy & Enterprise Compatibility
Commercial/Enterprise Use Permission
Status: REQUIRES MANUAL VERIFICATION Sources to Check:
- Privacy Policy: https://www.aikido.dev/privacy
- Terms of Service: https://www.aikido.dev/terms
- Legal Documentation: https://www.aikido.dev/legal
Key Questions:
- Does the privacy policy explicitly permit commercial use?
- Are there any restrictions on enterprise deployment?
- What is the licensing model for commercial use?
- Any industry-specific restrictions?
Data Training & Model Use
Status: REQUIRES MANUAL VERIFICATION Sources to Check:
- Privacy Policy: https://www.aikido.dev/privacy
- AI/ML disclosure in documentation
- Security documentation: https://docs.aikido.dev/
Key Questions:
- Is customer code used to train or improve AI models?
- Does Aikido use AI/ML for vulnerability detection?
- Can customers opt out of data collection for model training?
- How is code analyzed (locally vs cloud)?
- What data is collected during scans?
- Is any data anonymized and aggregated?
Data Retention Policies
Status: REQUIRES MANUAL VERIFICATION Sources to Check:
- Privacy Policy: https://www.aikido.dev/privacy
- Data Processing Agreement (DPA)
- GDPR compliance documentation
Key Questions:
- How long is scan data retained?
- How long are vulnerability reports stored?
- What is the data deletion policy?
- Can customers request data deletion?
- Data retention for different data types (logs, scans, reports)
- Backup retention periods
Data Sharing Policies
Status: REQUIRES MANUAL VERIFICATION Sources to Check:
- Privacy Policy: https://www.aikido.dev/privacy
- Subprocessor List
- Third-party integrations documentation
Key Questions:
- Is data shared with third parties?
- Who are the subprocessors?
- Is data shared across Aikido customers?
- Are vulnerability patterns aggregated/anonymized?
- What data is shared with integrations (Slack, Jira, etc.)?
IP & Confidentiality Concerns
Status: REQUIRES MANUAL VERIFICATION Sources to Check:
- Terms of Service: https://www.aikido.dev/terms
- Enterprise Agreement
- Intellectual Property Policy
- Confidentiality provisions
Key Questions:
- Who owns the IP rights to scan results?
- Are there confidentiality protections for proprietary code?
- What happens to customer code during scanning?
- Is source code stored or only analyzed?
- Are there NDA provisions for enterprise customers?
- How are secrets/credentials handled during detection?
Pricing & Plans
Free Tier
Status: REQUIRES MANUAL VERIFICATION Sources to Check:
- Pricing Page: https://www.aikido.dev/pricing
- Documentation: https://docs.aikido.dev/
Information Needed:
- Features Included: Which security modules (SAST, DAST, SCA, secrets, etc.)
- Repository Limits: Number of repositories that can be scanned
- User Limits: Number of team members
- Scan Limits: Number of scans per month
- Duration: Is it free forever or a trial period?
- Support Level: Community, email, or chat support?
- Integration Limits: Which integrations are available?
Paid Plans
Status: REQUIRES MANUAL VERIFICATION Sources to Check:
- Pricing Page: https://www.aikido.dev/pricing
- Contact sales for detailed pricing
Plans to Document:
Starter/Pro Plan (if available)
- Cost:
per user/month orper repository/month - Features: List key features
- Limits: Repositories, users, scans
- Support: Level of support included
- Integrations: Available integrations
Business/Team Plan (if available)
- Cost: $ per user/month
- Features: Advanced features
- Limits: Higher or unlimited limits
- Support: Priority support
- Additional: Advanced integrations, compliance features
Enterprise Plan
- Cost: Custom pricing (contact sales)
- Features: Full feature set, SSO, SAML, advanced reporting
- Limits: Typically unlimited or very high
- Support: Dedicated support, SLAs, CSM
- Additional: Custom DPA, compliance certifications, on-premise options
Usage Limits
API Rate Limits
Status: REQUIRES MANUAL VERIFICATION Sources to Check:
- API Documentation: https://docs.aikido.dev/api
- Rate Limiting Documentation
Information Needed:
- API requests per hour/day
- Webhook limits
- Different limits per plan tier
- Rate limit headers and policies
Repository/Project Limits
Status: REQUIRES MANUAL VERIFICATION Information Needed:
- Number of repositories per organization
- Number of active scans
- Repository size limits
- Limits vary by plan tier
User/Seat Limits
Status: REQUIRES MANUAL VERIFICATION Information Needed:
- Minimum seats for paid plans
- Maximum collaborators
- Read-only user limits
- Guest/external user policies
Scan Limits
Status: REQUIRES MANUAL VERIFICATION Information Needed:
- Number of scans per month
- Concurrent scan limits
- Scan frequency (continuous vs scheduled)
- Size limits for scanned assets
- Timeout limits for scans
Integration Limits
Status: REQUIRES MANUAL VERIFICATION Information Needed:
- Number of integrations per plan
- API connection limits
- Webhook delivery limits
Enterprise-Specific Considerations
Compliance & Certifications
Status: REQUIRES MANUAL VERIFICATION Sources to Check:
- Security/Trust page: https://www.aikido.dev/security (or similar)
- Compliance documentation
Check for:
- SOC 2 Type II certification
- ISO 27001
- GDPR compliance
- CCPA compliance
- Industry-specific compliance (HIPAA, PCI-DSS, etc.)
- OWASP Top 10 coverage
- CWE/CVE database integration
Deployment Options
Status: REQUIRES MANUAL VERIFICATION Check for:
- Cloud-hosted (SaaS)
- Self-hosted/on-premise options
- Private cloud deployment
- Air-gapped environment support
- Multi-tenant vs single-tenant
- Data residency options (EU, US, etc.)
Security Features
Status: REQUIRES MANUAL VERIFICATION Check for:
- SSO/SAML support
- SCIM provisioning
- Role-based access control (RBAC)
- Audit logging
- Data encryption (in transit and at rest)
- Two-factor authentication (2FA)
- IP whitelisting
- Secrets management integration
Integration Ecosystem
Status: REQUIRES MANUAL VERIFICATION Check for:
- Git providers (GitHub, GitLab, Bitbucket)
- CI/CD platforms (Jenkins, CircleCI, GitHub Actions)
- Issue trackers (Jira, Linear, GitHub Issues)
- Communication (Slack, Microsoft Teams)
- Cloud providers (AWS, Azure, GCP)
- Container registries
Research Checklist
- Read complete privacy policy
- Review terms of service
- Check pricing page for current costs and plans
- Review API documentation for rate limits
- Check for Data Processing Agreement (DPA)
- Verify GDPR/compliance information
- Review documentation for deployment options
- Check security/trust center for certifications
- Test free tier if possible (sign-up requirements)
- Contact sales for enterprise-specific information
- Review integration documentation
- Check for customer case studies or testimonials
Additional Resources
- Documentation: https://docs.aikido.dev/
- Blog: https://www.aikido.dev/blog
- GitHub: Check for open-source components or examples
- Status Page: Check for uptime/status page
- Support: Check for support portal or contact information
Notes
Important Considerations for Aikido:
- Aikido is a relatively newer platform - verify company stability and funding
- Check if "all-in-one" approach means different data handling per module
- Verify if cloud scanning means code leaves customer infrastructure
- Understand how secrets detection works and if secrets are stored
- Check if DAST scanning requires exposing applications
- Verify if continuous monitoring means persistent data collection
- Understand the difference between repository scanning vs runtime monitoring
- Check if vulnerability database is proprietary or uses public CVE feeds
Competitive Positioning:
- Compare to Snyk, Semgrep, Checkmarx
- Note unique features or limitations
- Evaluate maturity of the platform
Last Updated: [DATE TO BE ADDED AFTER RESEARCH] Researcher: [TO BE COMPLETED] Verification Status: Template - Requires Manual Research