Source note
Aikido Code Audit
Summary
Aikido Code Audit is a product claim for agentic static code review that targets multi-step security flaws before release. The excerpt gives internal and early-user benchmarks, but no public dataset, reproducible protocol, or independent evaluation.
Problem
- Existing SAST tools miss logic flaws that require tracing intent and state across files because no single line matches a known rule.
- Pentests can find these issues, but they usually need a live environment, credentials, time, and higher cost.
- The product matters because code-focused attack agents may reduce the time needed to discover chained vulnerabilities.
Approach
- Code Audit scans static source code across one or more repositories.
- It follows references across files and modules to connect multi-step exploit paths.
- Each finding includes a root cause, code evidence, and an AutoFix that can generate a pull request.
- The claimed scope includes web apps, mobile apps, smart contracts, legacy codebases, feature-flagged code, undeployed changes, and admin routes.
Results
- Aikido claims Code Audit covers roughly 70-80% of what a full pentest engagement surfaces, based on internal testing and early users.
- Aikido claims the product costs about 10x less than a full pentest engagement.
- Early users reportedly found a median of about 25 security issues per codebase.
- Aikido reports 0 audits came back clean in early use.
- The excerpt gives an example of a multi-step IDOR chain across 3 files that a pattern-based scanner would miss.
- Setup is described as taking a few minutes, with audits taking as little as 5 minutes depending on codebase size and complexity.