Aikido Security is one of the more interesting AppSec outfits operating today, at a time when code security is becoming increasingly important. They started out as a product company offering an orchestrator for several application security libraries (Semgrep, Trivy, Gitleaks, Checkov and ZAP-class engines), with a focus on triage, deduplication, UX and flat pricing. This worked for a while, until Semgrep needed to show its Series D investors how it could protect a moat, which forced Aikido to initiate a new forked project called Opengrep and to become more intentional about hiring security researchers and acquiring companies in the space.
To understand Aikido Security, however, we first need to look at the dynamics of the AppSec market, which is one of the stranger corners of cybersecurity relative to its importance.
Introduction to AppSec
AppSec is application security: securing the software you build and ship, not the laptop or the firewall. In practice, it means finding and fixing flaws in five places:
your code (SAST: SQL injection, XSS, bad auth patterns)
other people’s code you import (SCA: vulnerable npm and Maven packages, licenses)
secrets left in repos (API keys, tokens)
how you define infrastructure as code (IaC: open S3 buckets, bad IAM in Terraform)
the running app (DAST, pentest, runtime: probing it the way an attacker would)
Buyers are AppSec engineers, platform security teams, or a CISO program. Users are developers and, since 2025, the coding agents they point at the repo. Most implementations ended up failing in some version of security buys a scanner, developers drown in false positives, and nothing gets fixed. Every vendor claims to have solved this problem (for real this time!).
What do vendors actually sell?
There are twelve high-level categories to look at:
SAST. Static analysis of your source code: injection, XSS, bad crypto. Priced per contributor or bundled. Checkmarx; Semgrep from $30 per contributor per month; GitHub Code Security at $30 per active committer. Commoditized by GitHub from below and by the labs’ code-review agents from above.
SCA. Known vulnerabilities and licenses in the open source you import, plus the SBOM that compliance teams like to have. Typically priced per developer or per project. Snyk, Mend, Aikido Code. Commoditized by Dependabot and by reachability analysis showing up in every platform.
Supply-chain malware and registry intelligence. Not the same thing as SCA (typically CVEs in a version published last year); this is about pwned about package published twenty minutes ago. Socket, Aikido Intel and Safe Chain, Sonatype Repository Firewall, JFrog Curation. Priced per developer or per registry, usually free at the entry tier. Hard to displace with LLMs because it’s a live intel feed.
Secrets detection. Keys and tokens in git history and CI. GitGuardian standalone, a module inside every suite, and GitHub Secret Protection at $19 per active committer. Mostly commoditized by GitHub.
IaC, container, and image scanning. Terraform, Kubernetes manifests, and Docker images. Trivy and Aqua, Wiz, Prisma. Priced per asset or per cloud account. This is where AppSec meets CNAPP (which Wiz dominates).
DAST and API security testing. Probing the running app and its APIs. Invicti, Rapid7, StackHawk, plus the API specialists Akamai and Harness bought. Priced per app, per scan, or by subscription. AI pentesting products are now capturing this market.
Offensive: pentest, bug bounty, and AI attack. Cobalt and Synack for humans; HackerOne and Bugcrowd for crowds; XBOW, Horizon3, and Pentera for machines; Aikido Attack for the bundle. Priced through project fees, credits, or retainers, with the automated tier reportedly starting at about $4,000 a test. Often compliance-driven, given the need for audit reports for cyber insurance.
ASPM. Aggregating findings from everything above, deduplicating them, and prioritizing by reachability and exploitability. Apiiro, Cycode, Legit, and ArmorCode; Snyk bought Enso for it. Priced per developer or per application. Commoditized by the platforms absorbing it and by a language model with a spreadsheet.
Runtime protection. Hooks inside the live app, bot defense, WAF-ish rules. Contrast, which renamed RASP to application detection and response after RASP failed to become a category, and Aikido Zen, one of the few new entrants. Priced per request or per app.
Edge protection, WAAP. Cloudflare, Akamai, F5, and Imperva. Priced per request, per app, or through the enterprise contract you already have. The biggest AppSec share of wallet by a mile.
Remediation and secure supply. Hardened images, patched dependencies without forced major upgrades, autofix PRs. Chainguard had an early lead, but the category has become very crowded lately.
AI code and AI application security. Scanning agent-written code in the IDE before it hits CI (Semgrep Guardian, Snyk’s agent work, Cursor Bugbot, the review built into Claude Code) and securing AI apps themselves against prompt injection and model abuse (Palo Alto bought Protect AI for this). Priced per seat or per token. Currently very contested, with Anthropic and OpenAI accounting for most of the usage.
Plus services: pentesters, triage as a service, program build-out. While this article will focus on the testing side of things, I’ve covered the Cloudflare play here:
Infra Play #109: It’s time to talk about Cloudflare
The reason I focus on cloud infrastructure software companies is that they often have an outsized impact on the world around us, even if on paper they are “small” or a “niche industry.” One of these examples is Cloudflare, a cybersecurity company that, while on paper is a cybersecurity vendor, has progressively grown into one of the critical backbones of how the Internet operates today.
The detection tools market is roughly a third of total spend and hasn’t really covered itself in glory. Unlike Cloudflare, none of these companies managed to scale to an IPO, and even revenue success stories like GitHub are mostly disliked by their customers and were carried by aggressive upselling from Azure sales reps.