olegs/ai_tools_analysis
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
501b9c5f2ea7014944e6c10f2bf7201c3ff6d9f1
ai_tools_analysis/evaluation_security_aikido.md
T
olegs 6c65691b2e initial
2026-02-02 13:41:43 +02:00

8.5 KiB
Raw Blame History

Security AI Tool Evaluation: Aikido

Tool Overview

Name: Aikido Security Type: All-in-One Security Platform Website: https://www.aikido.dev Primary Function: Application security, vulnerability scanning, SAST, DAST, SCA, secrets detection, compliance monitoring

Privacy Policy & Enterprise Compatibility

Commercial/Enterprise Use Permission

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Key Questions:

  • Does the privacy policy explicitly permit commercial use?
  • Are there any restrictions on enterprise deployment?
  • What is the licensing model for commercial use?
  • Any industry-specific restrictions?

Data Training & Model Use

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Key Questions:

  • Is customer code used to train or improve AI models?
  • Does Aikido use AI/ML for vulnerability detection?
  • Can customers opt out of data collection for model training?
  • How is code analyzed (locally vs cloud)?
  • What data is collected during scans?
  • Is any data anonymized and aggregated?

Data Retention Policies

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Key Questions:

  • How long is scan data retained?
  • How long are vulnerability reports stored?
  • What is the data deletion policy?
  • Can customers request data deletion?
  • Data retention for different data types (logs, scans, reports)
  • Backup retention periods

Data Sharing Policies

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Key Questions:

  • Is data shared with third parties?
  • Who are the subprocessors?
  • Is data shared across Aikido customers?
  • Are vulnerability patterns aggregated/anonymized?
  • What data is shared with integrations (Slack, Jira, etc.)?

IP & Confidentiality Concerns

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Key Questions:

  • Who owns the IP rights to scan results?
  • Are there confidentiality protections for proprietary code?
  • What happens to customer code during scanning?
  • Is source code stored or only analyzed?
  • Are there NDA provisions for enterprise customers?
  • How are secrets/credentials handled during detection?

Pricing & Plans

Free Tier

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Information Needed:

  • Features Included: Which security modules (SAST, DAST, SCA, secrets, etc.)
  • Repository Limits: Number of repositories that can be scanned
  • User Limits: Number of team members
  • Scan Limits: Number of scans per month
  • Duration: Is it free forever or a trial period?
  • Support Level: Community, email, or chat support?
  • Integration Limits: Which integrations are available?

Paid Plans

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Plans to Document:

Starter/Pro Plan (if available)

  • Cost: per user/month or per repository/month
  • Features: List key features
  • Limits: Repositories, users, scans
  • Support: Level of support included
  • Integrations: Available integrations

Business/Team Plan (if available)

  • Cost: $ per user/month
  • Features: Advanced features
  • Limits: Higher or unlimited limits
  • Support: Priority support
  • Additional: Advanced integrations, compliance features

Enterprise Plan

  • Cost: Custom pricing (contact sales)
  • Features: Full feature set, SSO, SAML, advanced reporting
  • Limits: Typically unlimited or very high
  • Support: Dedicated support, SLAs, CSM
  • Additional: Custom DPA, compliance certifications, on-premise options

Usage Limits

API Rate Limits

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Information Needed:

  • API requests per hour/day
  • Webhook limits
  • Different limits per plan tier
  • Rate limit headers and policies

Repository/Project Limits

Status: REQUIRES MANUAL VERIFICATION Information Needed:

  • Number of repositories per organization
  • Number of active scans
  • Repository size limits
  • Limits vary by plan tier

User/Seat Limits

Status: REQUIRES MANUAL VERIFICATION Information Needed:

  • Minimum seats for paid plans
  • Maximum collaborators
  • Read-only user limits
  • Guest/external user policies

Scan Limits

Status: REQUIRES MANUAL VERIFICATION Information Needed:

  • Number of scans per month
  • Concurrent scan limits
  • Scan frequency (continuous vs scheduled)
  • Size limits for scanned assets
  • Timeout limits for scans

Integration Limits

Status: REQUIRES MANUAL VERIFICATION Information Needed:

  • Number of integrations per plan
  • API connection limits
  • Webhook delivery limits

Enterprise-Specific Considerations

Compliance & Certifications

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Check for:

  • SOC 2 Type II certification
  • ISO 27001
  • GDPR compliance
  • CCPA compliance
  • Industry-specific compliance (HIPAA, PCI-DSS, etc.)
  • OWASP Top 10 coverage
  • CWE/CVE database integration

Deployment Options

Status: REQUIRES MANUAL VERIFICATION Check for:

  • Cloud-hosted (SaaS)
  • Self-hosted/on-premise options
  • Private cloud deployment
  • Air-gapped environment support
  • Multi-tenant vs single-tenant
  • Data residency options (EU, US, etc.)

Security Features

Status: REQUIRES MANUAL VERIFICATION Check for:

  • SSO/SAML support
  • SCIM provisioning
  • Role-based access control (RBAC)
  • Audit logging
  • Data encryption (in transit and at rest)
  • Two-factor authentication (2FA)
  • IP whitelisting
  • Secrets management integration

Integration Ecosystem

Status: REQUIRES MANUAL VERIFICATION Check for:

  • Git providers (GitHub, GitLab, Bitbucket)
  • CI/CD platforms (Jenkins, CircleCI, GitHub Actions)
  • Issue trackers (Jira, Linear, GitHub Issues)
  • Communication (Slack, Microsoft Teams)
  • Cloud providers (AWS, Azure, GCP)
  • Container registries

Research Checklist

  • Read complete privacy policy
  • Review terms of service
  • Check pricing page for current costs and plans
  • Review API documentation for rate limits
  • Check for Data Processing Agreement (DPA)
  • Verify GDPR/compliance information
  • Review documentation for deployment options
  • Check security/trust center for certifications
  • Test free tier if possible (sign-up requirements)
  • Contact sales for enterprise-specific information
  • Review integration documentation
  • Check for customer case studies or testimonials

Additional Resources

Notes

Important Considerations for Aikido:

  1. Aikido is a relatively newer platform - verify company stability and funding
  2. Check if "all-in-one" approach means different data handling per module
  3. Verify if cloud scanning means code leaves customer infrastructure
  4. Understand how secrets detection works and if secrets are stored
  5. Check if DAST scanning requires exposing applications
  6. Verify if continuous monitoring means persistent data collection
  7. Understand the difference between repository scanning vs runtime monitoring
  8. Check if vulnerability database is proprietary or uses public CVE feeds

Competitive Positioning:

  • Compare to Snyk, Semgrep, Checkmarx
  • Note unique features or limitations
  • Evaluate maturity of the platform

Last Updated: [DATE TO BE ADDED AFTER RESEARCH] Researcher: [TO BE COMPLETED] Verification Status: Template - Requires Manual Research

Reference in new issue View Git Blame Copy Permalink