Share your experience using Continuous Dynamic (formerly WhiteHat Dynamic)

My main use case for Aikido Security is detecting security issues and triaging, and if there is any security risk, we detect and fix those security fixes.

I use Aikido Security for detecting and fixing security risks by implementing a DevOps pipeline using a static application security testing tool, which helps automate the detection of exposed secrets and checks for any malicious open-source packages, making it easier for developers to prepare a list of issues they need to fix. Our goal is to ensure all repositories are free from any security issues, monitor cloud configurations that are not done correctly, scan images for runtime threats, and perform automated penetration testing to simulate real-world attacks, detecting any loopholes. It also helps improve developers' productivity by filtering out false positives and generating AI fixes with a single click for identified vulnerabilities.

The main use case for Aikido Security is to perform static application security testing whenever a developer checks in code to ensure there is no malicious code checked in.

The best features Aikido Security offers include code supply chain scanning, cloud container security to monitor for misconfigurations or runtime threats, automated penetration testing, and the Autofixes feature, which is a new addition in recent versions and helps fix most security issues.

The feature I find myself relying on the most is code and supply chain scanning, which makes it easier to automate the detection of any security issues, helping to fail the build if there is any malicious code.

Aikido Security has positively impacted my organization by improving overall code quality, enabling us to develop a secure product, and drastically improving our reputation among customers. We now have all types of reports and dashboards, allowing any stakeholder or management to easily check how much work has been done and the product's security status.

The biggest outcome I have seen from using Aikido Security is improved code quality.

There is still a lot of scope for improving the automated fixes with Aikido Security.

I would like to see some alerts and configurations added as specific improvements.

I rate it an eight because there are some gaps and issues with certain features, particularly in identifying issues and marking them as positive, as well as finding real false positives. By addressing these issues, they can improve the score.

Regarding Aikido Security's AI capabilities, it lacks in governance and security; while it uses contextual AI to dismiss false positives automatically, we still conduct manual reviews. Since it's still a premature feature, we do double-check AI-related fixes and review any custom AI rules that allow the team to write guidelines for AI-powered PR checks.

The accuracy of Aikido Security's output is still not very high, and there are a few features where they are still lacking behind regarding accuracy.

I have been working for two years in my current field.

Aikido Security is stable.

Aikido Security's scalability is shifting; it helps to transition the clunky security approach to a developer-first AppSec.

I would say customer support is average.

I would rate the customer support a six out of ten.

I previously used different solutions such as the Semgrep open-source tool and other open-source tools for detecting configuration issues, including OWASP, and while some projects still use Semgrep and OWASP, we have switched to Aikido Security.

We were able to close 90% of issues with the help of Aikido Security tools, providing a return on investment.

Regarding my experience with pricing, I know we have some open-source tools in use; however, Aikido Security has a plan for $4,200 annually for up to 10 users.

Before choosing Aikido Security, I evaluated other options such as TruffleHog, which is also free, and I also assessed Snyk, Checkmarx, Black Duck, and Veracode.

We were able to close 90% of issues with the help of Aikido Security tools, providing a return on investment.

I would advise others looking into using Aikido Security to evaluate several options based on their specific requirements for SAST, DAST, and SCA, including how much they want to automate and their budget for security tools. While there are better options available, some might be expensive, and there are free options that don't provide the same features as Aikido Security.

I would rate this review an eight overall.

Hybrid Cloud

Microsoft Azure

My main use case for StackHawk is to analyze our application live in our EKS cluster.

A specific example of how we use StackHawk in our EKS cluster is that we deployed an agent authenticated to the StackHawk platform and it is in charge of analyzing our different repositories, letting us know if we have any open vulnerabilities within our base code. Every scenario of analysis is completely published into the StackHawk platform so we can see if we have open vulnerabilities to solve and how much time it takes to perform the analysis.

The best feature StackHawk offers is called Attack Surface, which is a way of letting us know what repositories that we have hosted in any repository system have a surface attack, and in that case, we integrate the platform into StackHawk, then they let us know the application code base and how we have to integrate it and easily set up the application.

The Attack Surface feature has helped our team by having an inventory of our repositories and which of them have a surface attack.

StackHawk has positively impacted my organization by giving us a new vision of how vulnerabilities were seen, as we now have more visibility in that matter. We now take care of not just the static analysis and the composition analysis, but the dynamic analysis. When our microservices are running, we do have a vision of how it performs, and it also lets us know if we have any open vulnerabilities so we can close them.

Since we started using StackHawk, we've seen reports on different vulnerabilities that we have in our current microservices within the cluster, so now we have a wide vision and a wide perspective, and also we have new ideas about what we need to do. We also have similar microservices, so most of them are common errors and now we are closing up that gap of vulnerabilities.

StackHawk can be improved in the way that it is integrated, as at the very beginning, the idea was to, within the pipeline, mount the different resources that our microservices needed to start to run. For example, if we have a service that needed Redis, maybe Kafka, or a database to initialize, we did need to have a Docker Compose file, get up those services, and after that, do the analysis. It didn't have that; it wasn't reachable at the very beginning and it wasn't that good as we expected. But at some point, we decided to mount it as an agent in the Docker file, and it was waiting for new jobs. It was even better, and when we figured out how to integrate it within our EKS cluster, suddenly we started reaching to the services, knowing what was going on, and everything related to security. As long as we have a P2T to our QA site or cluster, we do not have garbage in our databases, but StackHawk does put a little information, a garbage information, doing their job.

That's the main area I'm focusing on right now regarding needed improvements.

I've been using StackHawk for almost a year.

StackHawk is stable.

Regarding StackHawk's scalability, I don't have a clear vision about how scalable it is, but we can use it in every microservice that we have, and we have almost 300 microservices and all of them can be analyzed within the cluster with our agent.

The customer support was amazing; every time they could, they brought a Spanish translator, so the communication was really smooth. I would rate the customer support ten out of ten.

I didn't previously use a different solution for dynamic analysis.

Regarding my experience with pricing, setup cost, and licensing, I'm not sure about pricing since I wasn't part of the team that got the application. The setup cost was actually really cheap; I hosted a self-runner with an image based on the StackHawk one, so it was really cheap and easy. I want to emphasize that I was not part of the pricing details and I'm also not sure about what kind of license we have.

I was just in charge of implementing StackHawk, and I'm actually not part of the security team, so I cannot measure its accuracy and reliability.

Since we started using StackHawk, we've seen reports on different vulnerabilities that we have in our current microservices within the cluster, so now we have a wide vision and a wide perspective, and also we have new ideas about what we need to do. We also have similar microservices, so most of them are common errors and now we are closing up that gap of vulnerabilities.

Actually, I cannot say that we have seen a return on investment, as we've been using it recently and the company hasn't adopted it with all the services, so there isn't any measurement about that. Also, at the very beginning, we were just working with two engineers, and now we have maybe just one, but I don't know, it's complicated.

Actually, I cannot say that we have seen a return on investment, as we've been using it recently and the company hasn't adopted it with all the services, so there isn't any measurement about that. Also, at the very beginning, we were just working with two engineers, and now we have maybe just one, but I don't know, it's complicated.

The setup cost was actually really cheap; I hosted a self-runner with an image based on the StackHawk one, so it was really cheap and easy.

We did not evaluate other options before choosing StackHawk; we went straightforward to it.

I don't actually have a clear perspective on StackHawk's AI capabilities regarding its governance and security.

My advice to others looking into using StackHawk is to stay prepared. Document how your architecture works, whether you have decoupled services or not. Based on that, it will be easier or not to use the application. In our case, we had to deploy an agent within our cluster and that was the only way we could analyze our microservices. So be prepared, especially technically, because they can help a lot in different areas, but you're the owner of your own infrastructure, so it relies on you how you're going to implement the solution.

My overall rating for this review is seven out of ten.

Public Cloud

Amazon Web Services (AWS)