282 lines
8.5 KiB
Markdown
282 lines
8.5 KiB
Markdown
# Security AI Tool Evaluation: Aikido
|
|
|
|
## Tool Overview
|
|
**Name:** Aikido Security
|
|
**Type:** All-in-One Security Platform
|
|
**Website:** https://www.aikido.dev
|
|
**Primary Function:** Application security, vulnerability scanning, SAST, DAST, SCA, secrets detection, compliance monitoring
|
|
|
|
---
|
|
|
|
## Privacy Policy & Enterprise Compatibility
|
|
|
|
### Commercial/Enterprise Use Permission
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Privacy Policy: https://www.aikido.dev/privacy
|
|
- Terms of Service: https://www.aikido.dev/terms
|
|
- Legal Documentation: https://www.aikido.dev/legal
|
|
|
|
**Key Questions:**
|
|
- Does the privacy policy explicitly permit commercial use?
|
|
- Are there any restrictions on enterprise deployment?
|
|
- What is the licensing model for commercial use?
|
|
- Any industry-specific restrictions?
|
|
|
|
### Data Training & Model Use
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Privacy Policy: https://www.aikido.dev/privacy
|
|
- AI/ML disclosure in documentation
|
|
- Security documentation: https://docs.aikido.dev/
|
|
|
|
**Key Questions:**
|
|
- Is customer code used to train or improve AI models?
|
|
- Does Aikido use AI/ML for vulnerability detection?
|
|
- Can customers opt out of data collection for model training?
|
|
- How is code analyzed (locally vs cloud)?
|
|
- What data is collected during scans?
|
|
- Is any data anonymized and aggregated?
|
|
|
|
### Data Retention Policies
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Privacy Policy: https://www.aikido.dev/privacy
|
|
- Data Processing Agreement (DPA)
|
|
- GDPR compliance documentation
|
|
|
|
**Key Questions:**
|
|
- How long is scan data retained?
|
|
- How long are vulnerability reports stored?
|
|
- What is the data deletion policy?
|
|
- Can customers request data deletion?
|
|
- Data retention for different data types (logs, scans, reports)
|
|
- Backup retention periods
|
|
|
|
### Data Sharing Policies
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Privacy Policy: https://www.aikido.dev/privacy
|
|
- Subprocessor List
|
|
- Third-party integrations documentation
|
|
|
|
**Key Questions:**
|
|
- Is data shared with third parties?
|
|
- Who are the subprocessors?
|
|
- Is data shared across Aikido customers?
|
|
- Are vulnerability patterns aggregated/anonymized?
|
|
- What data is shared with integrations (Slack, Jira, etc.)?
|
|
|
|
### IP & Confidentiality Concerns
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Terms of Service: https://www.aikido.dev/terms
|
|
- Enterprise Agreement
|
|
- Intellectual Property Policy
|
|
- Confidentiality provisions
|
|
|
|
**Key Questions:**
|
|
- Who owns the IP rights to scan results?
|
|
- Are there confidentiality protections for proprietary code?
|
|
- What happens to customer code during scanning?
|
|
- Is source code stored or only analyzed?
|
|
- Are there NDA provisions for enterprise customers?
|
|
- How are secrets/credentials handled during detection?
|
|
|
|
---
|
|
|
|
## Pricing & Plans
|
|
|
|
### Free Tier
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Pricing Page: https://www.aikido.dev/pricing
|
|
- Documentation: https://docs.aikido.dev/
|
|
|
|
**Information Needed:**
|
|
- **Features Included:** Which security modules (SAST, DAST, SCA, secrets, etc.)
|
|
- **Repository Limits:** Number of repositories that can be scanned
|
|
- **User Limits:** Number of team members
|
|
- **Scan Limits:** Number of scans per month
|
|
- **Duration:** Is it free forever or a trial period?
|
|
- **Support Level:** Community, email, or chat support?
|
|
- **Integration Limits:** Which integrations are available?
|
|
|
|
### Paid Plans
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Pricing Page: https://www.aikido.dev/pricing
|
|
- Contact sales for detailed pricing
|
|
|
|
**Plans to Document:**
|
|
|
|
#### Starter/Pro Plan (if available)
|
|
- **Cost:** $ per user/month or $ per repository/month
|
|
- **Features:** List key features
|
|
- **Limits:** Repositories, users, scans
|
|
- **Support:** Level of support included
|
|
- **Integrations:** Available integrations
|
|
|
|
#### Business/Team Plan (if available)
|
|
- **Cost:** $ per user/month
|
|
- **Features:** Advanced features
|
|
- **Limits:** Higher or unlimited limits
|
|
- **Support:** Priority support
|
|
- **Additional:** Advanced integrations, compliance features
|
|
|
|
#### Enterprise Plan
|
|
- **Cost:** Custom pricing (contact sales)
|
|
- **Features:** Full feature set, SSO, SAML, advanced reporting
|
|
- **Limits:** Typically unlimited or very high
|
|
- **Support:** Dedicated support, SLAs, CSM
|
|
- **Additional:** Custom DPA, compliance certifications, on-premise options
|
|
|
|
---
|
|
|
|
## Usage Limits
|
|
|
|
### API Rate Limits
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- API Documentation: https://docs.aikido.dev/api
|
|
- Rate Limiting Documentation
|
|
|
|
**Information Needed:**
|
|
- API requests per hour/day
|
|
- Webhook limits
|
|
- Different limits per plan tier
|
|
- Rate limit headers and policies
|
|
|
|
### Repository/Project Limits
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Information Needed:**
|
|
- Number of repositories per organization
|
|
- Number of active scans
|
|
- Repository size limits
|
|
- Limits vary by plan tier
|
|
|
|
### User/Seat Limits
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Information Needed:**
|
|
- Minimum seats for paid plans
|
|
- Maximum collaborators
|
|
- Read-only user limits
|
|
- Guest/external user policies
|
|
|
|
### Scan Limits
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Information Needed:**
|
|
- Number of scans per month
|
|
- Concurrent scan limits
|
|
- Scan frequency (continuous vs scheduled)
|
|
- Size limits for scanned assets
|
|
- Timeout limits for scans
|
|
|
|
### Integration Limits
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Information Needed:**
|
|
- Number of integrations per plan
|
|
- API connection limits
|
|
- Webhook delivery limits
|
|
|
|
---
|
|
|
|
## Enterprise-Specific Considerations
|
|
|
|
### Compliance & Certifications
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Security/Trust page: https://www.aikido.dev/security (or similar)
|
|
- Compliance documentation
|
|
|
|
**Check for:**
|
|
- SOC 2 Type II certification
|
|
- ISO 27001
|
|
- GDPR compliance
|
|
- CCPA compliance
|
|
- Industry-specific compliance (HIPAA, PCI-DSS, etc.)
|
|
- OWASP Top 10 coverage
|
|
- CWE/CVE database integration
|
|
|
|
### Deployment Options
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Check for:**
|
|
- Cloud-hosted (SaaS)
|
|
- Self-hosted/on-premise options
|
|
- Private cloud deployment
|
|
- Air-gapped environment support
|
|
- Multi-tenant vs single-tenant
|
|
- Data residency options (EU, US, etc.)
|
|
|
|
### Security Features
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Check for:**
|
|
- SSO/SAML support
|
|
- SCIM provisioning
|
|
- Role-based access control (RBAC)
|
|
- Audit logging
|
|
- Data encryption (in transit and at rest)
|
|
- Two-factor authentication (2FA)
|
|
- IP whitelisting
|
|
- Secrets management integration
|
|
|
|
### Integration Ecosystem
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Check for:**
|
|
- Git providers (GitHub, GitLab, Bitbucket)
|
|
- CI/CD platforms (Jenkins, CircleCI, GitHub Actions)
|
|
- Issue trackers (Jira, Linear, GitHub Issues)
|
|
- Communication (Slack, Microsoft Teams)
|
|
- Cloud providers (AWS, Azure, GCP)
|
|
- Container registries
|
|
|
|
---
|
|
|
|
## Research Checklist
|
|
|
|
- [ ] Read complete privacy policy
|
|
- [ ] Review terms of service
|
|
- [ ] Check pricing page for current costs and plans
|
|
- [ ] Review API documentation for rate limits
|
|
- [ ] Check for Data Processing Agreement (DPA)
|
|
- [ ] Verify GDPR/compliance information
|
|
- [ ] Review documentation for deployment options
|
|
- [ ] Check security/trust center for certifications
|
|
- [ ] Test free tier if possible (sign-up requirements)
|
|
- [ ] Contact sales for enterprise-specific information
|
|
- [ ] Review integration documentation
|
|
- [ ] Check for customer case studies or testimonials
|
|
|
|
---
|
|
|
|
## Additional Resources
|
|
|
|
- Documentation: https://docs.aikido.dev/
|
|
- Blog: https://www.aikido.dev/blog
|
|
- GitHub: Check for open-source components or examples
|
|
- Status Page: Check for uptime/status page
|
|
- Support: Check for support portal or contact information
|
|
|
|
---
|
|
|
|
## Notes
|
|
|
|
**Important Considerations for Aikido:**
|
|
1. Aikido is a relatively newer platform - verify company stability and funding
|
|
2. Check if "all-in-one" approach means different data handling per module
|
|
3. Verify if cloud scanning means code leaves customer infrastructure
|
|
4. Understand how secrets detection works and if secrets are stored
|
|
5. Check if DAST scanning requires exposing applications
|
|
6. Verify if continuous monitoring means persistent data collection
|
|
7. Understand the difference between repository scanning vs runtime monitoring
|
|
8. Check if vulnerability database is proprietary or uses public CVE feeds
|
|
|
|
**Competitive Positioning:**
|
|
- Compare to Snyk, Semgrep, Checkmarx
|
|
- Note unique features or limitations
|
|
- Evaluate maturity of the platform
|
|
|
|
**Last Updated:** [DATE TO BE ADDED AFTER RESEARCH]
|
|
**Researcher:** [TO BE COMPLETED]
|
|
**Verification Status:** Template - Requires Manual Research
|