History
Aikido Security was incorporated on 26 October 2022 in Ghent by Willem Delbare, Roeland Delrue, Felix Garriau, and Madeline Lawrence. The company's name refers to the Japanese martial art aikido. In January 2023, the company raised €2 million in pre-seed funding. In November 2023, it raised €5 million in a seed funding round co-led by Notion Capital and Connect Ventures.
In May 2024, the company raised $17 million in a Series A funding round led by Singular. In January 2025, Aikido Security co-launched Opengrep, an open-source fork of Semgrep. In August 2025, the company acquired the artificial intelligence (AI) code review startup Trag.
In September 2025, it acquired Allseek and Haicker, the company introduced automated penetration testing under the name “Aikido Attack”. In the same month, Aikido Security researchers reported malicious code in npm packages during a supply chain attack.
On 14 January 2026, the company raised a $60 million Series B at a $1 billion valuation. In February 2026, Aikido introduced Infinite, a product that uses automated agents to conduct penetration testing on successive software releases and propose or validate remediations.
In March 2026, Zach Rice, the creator of Gitleaks, joined Aikido Security and started the open-source project Betterleaks. In April 2026, Aikido launched Device Protection (marketed at launch as Aikido Endpoint), a security agent that inspects and blocks risky packages, extensions, and AI tools on developer devices before installation.
In June 2026, Aikido acquired Root.io, whose technology became part of Aikido Libraries and Aikido Images, providing patched versions of vulnerable dependencies and container images without requiring major upgrades. In August 2026, Aikido partnered with Belfius to deploy Aikido Machine, an on-premises AI penetration-testing server, inside the bank's data center.
Products and activities
Aikido Security develops application security software that connects to software-development tools and cloud environments, analyzing code, infrastructure, applications, and developer devices, consolidating findings and generating automated fixes for identified issues.
Code and software supply chain
Aikido analyzes source code, open-source dependencies, software packages, secrets, and infrastructure-as-code for vulnerabilities and malicious components. Its Aikido Libraries and Aikido Images products, launched following its 2026 acquisition of Root.io, patch vulnerable open-source dependencies and container images without requiring a version upgrade.
Threat intelligence
Aikido Intel, the company's threat intelligence engine, identifies malicious packages and vulnerabilities across open-source registries. As of April 2026, it detected roughly 100,000 such packages daily, up from about 20,000 a year earlier.
Cloud and infrastructure
Aikido assesses cloud configurations and identifies vulnerabilities in virtual machines, containers, and Kubernetes environments.
Attack testing and runtime protection
Aikido provides dynamic application security testing and on-demand AI-assisted penetration testing under the name Aikido Attack. Infinite extends this into continuous penetration testing that runs on each software release and validates proposed fixes. Its Device Protection product, launched the same year, runs on individual developer machines and inspects packages, IDE extensions, browser plugins, and AI tools before they are installed, blocking those it identifies as malicious or risky.
