Share your experience using Continuous Dynamic (formerly WhiteHat Dynamic)

I use Aikido Security for identifying security vulnerabilities in code and dependencies and cloud configurations. In my full-stack project, Aikido Security helped to detect the vulnerable packages and security issues before deployment, thereby improving application security. It also provides actionable recommendations that make it easier to fix issues quickly during deployment.

Aikido Security offers vulnerability scanning, dependency monitoring, cloud security insights, cloud security checks, and an easy-to-use dashboard. The Aikido Security dashboard updates frequently, so I am able to access information in case of emergency or urgent situations. The dashboard itself is in a neat format and very clear-cut, so I am able to use it in an easy manner.

It saves time by prioritizing importance and security issues and reducing alert failures. Aikido Security has improved my project security by helping me identify issues early and increasing my confidence before deployment. My favorite feature is the dependency vulnerability scanning because it quickly identifies the risk in third-party packages, which saves me time in finding vulnerabilities.

I think Aikido Security could be improved with more detailed remediation guidance, such as additional beginner-friendly tutorials and enhanced customization for alerts and reporting. There is room for improvement in customization, reporting, and learning resources for new users.

I have been working with Aikido Security for approximately one to one and a half years in my current field.

I do not think Aikido Security has any downtime or issues with reliability. The platform has been reliable and provides accurate security findings. I have not faced any downtime or issues with it, and Aikido Security is fully stable.

Aikido Security scales well by supporting multiple projects, repositories, and development teams on a single platform.

I have not reached out to customer support, but the documentation and onboarding resources were helpful.

Before Aikido Security, I mainly relied on manual checks and basic security tools, which were less comprehensive. I was supporting multiple projects and repositories through manual methods and basic security tools that were less comprehensive.

I use Aikido Security in the cloud-hosted SaaS version, which was easy to set up and access.

Aikido Security has great accuracy in finding vulnerabilities and management. The reliability has been very useful with remediation guidance, providing accurate security findings with helpful remediation.

Aikido Security is an investment that saved my time by automating security checks and helping identify issues early before they become costly problems.

With Aikido Security pricing, I have not used any paid version yet and am using the free version, which is very useful for my experience. Aikido Security is delivering a cloud-based SaaS platform. I used the free trial, which was sufficient for evaluating the platform and its core features. It saved my time by automating security checks.

Aikido Security saved me several hours each week by automating vulnerability scanning and security checks, reducing the need for manual review and helping me focus on more development.

If you are starting out, use Aikido Security early in development to catch security issues sooner and build more secure applications. Aikido Security provides strong visibility into security risk, vulnerability management, and compliance-related insights in governance and security. I would rate this product an 8 out of 10.

I have been using Aikido Security for approximately more than one year, primarily for securing our development pipelines and scanning our codebase for vulnerabilities across multiple projects.

The use case is definitely developer-first vulnerability management. Aikido Security nests directly in our development workflow and it catches security issues before they reach production. It integrates with GitHub very well. Pull requests get automatically scanned. From that point of view, security becomes part of development rather than an afterthought.

I used it mainly for three things. The first one is static code analysis, open-source dependency vulnerability scanning, and container image scanning. It has become our primary security layer in our development workflow.

When talking about the features, there are several powerful features they have. The first one is static application security testing or SAST. It scans source code for vulnerabilities automatically.

It identifies vulnerable open-source dependencies in our project. Container scanning checks Docker images for known vulnerabilities before deployment. Infrastructure as code scanning scans Terraform and other IaC files for misconfigurations.

The unique feature is secret detection, which automatically finds accidentally committed API keys, passwords, or tokens in code. Also, Auto-Triage intelligently filters false positives so developers only see real, actionable issues.

The impact was significant and immediate. Security shifted left, meaning issues were caught during development rather than after deployment. That alone reduced our remediation costs dramatically, since fixing issues early is always cheaper than fixing them in production. Developer confidence has increased. The team members felt more secure pushing code knowing Aikido Security was continuously scanning. Our comprehensive posture improved with clear visibility into all vulnerabilities across our entire codebase, which made security audits much smoother as well.

There are a few areas for improvement. The first is scan speed. For large repositories, initial scans can be slow. Incremental scanning helps, but full scans still take considerable time. The second thing is the false positive rate. While Auto-Triage is good, it is not perfect. Occasionally, genuine issues get filtered out and real false positives slip through. The third one is remediation guidance. Aikido Security tells you what is vulnerable, but sometimes the fix suggestions are generic. More specific, actionable remediation steps would save developer time. The fourth one is IDE integrations. It currently works best in CI/CD pipelines. A proper VS Code or JetBrains plugin for real-time scanning while coding would be a significant improvement.

From a customer point of view, the following things could change. The first thing is documentation for custom rules. Aikido Security allows you to create custom scanning rules, but the documentation for this feature is surprisingly thin. I spent considerable time in community forums and with trial and error just to configure basic custom rules. Step-by-step guides with real-world examples would make this feature much more accessible. The second thing is better Slack and communication integrations. Currently, security alerts come through email and dashboard notifications, but our team lives in Slack. A more configurable Slack integration that sends contextual alerts directly to the relevant developer, not just a generic channel notification, would dramatically improve response time. The third one is historical trend reporting. While Aikido Security shows current vulnerability status well, generating historical reports showing security posture improvement over time is limited. For presenting security progress to management or stakeholders, better exportable trend reports would be very valuable.

I have been working with Aikido Security for more than two years.

Aikido Security is stable.

From an integration stability perspective, the GitHub integration was rock solid. I never experienced a broken webhook or missed scan trigger throughout our use. That kind of reliability becomes invisible when it works well, which is exactly what you want from a security tool running in your CI/CD pipelines. However, there are two minor stability observations worth mentioning. The first one is during peak hours when multiple large repositories triggered simultaneous scans, there were occasional queuing delays of five to ten minutes. Not a deal-breaker, but noticeable. The second thing is, on two occasions after product updates, the dashboard briefly displayed stale vulnerability data before refreshing. A minor issue, but slightly concerning for a security platform where data freshness matters.

The customer support experience was genuinely positive, especially for a relatively young company. Onboarding support was excellent. Their team proactively reached out after signup to ensure we were set up correctly. Response time for support tickets averaged twelve to twenty-four hours, which is faster than most enterprise security tools. The documentation is clear and well-maintained. Their changelog is also very transparent, with regular product updates and clear explanations. I would rate support an eight out of ten, one of the better support experiences in the developer tools space.

I did a thorough evaluation before choosing Aikido Security. I looked at several alternatives. The first one was Snyk, which was my previous tool. Snyk is the market leader in developer security and has excellent dependency scanning. However, the pricing was significantly higher, especially as our repository count grew. Alert noise was also a consistent frustration, with too many false positives requiring manual triage. Aikido Security's Auto-Triage was noticeably better in our testing. The second thing is Semgrep. It is also a very powerful static analysis tool and highly customizable, but the customizability that makes it powerful also makes it complex to configure. For my small team, I needed something that worked well out of the box without significant configuration overhead. Semgrep felt more suited to large security teams with dedicated AppSec engineers. I chose Aikido Security because it is the best one.

I purchased directly through Aikido Security's website. The signup and onboarding process was very straightforward. Connecting my GitHub organization, I was scanning within minutes, with no complex procurement process needed. Aikido Security's pricing setup follows a repository-based pricing model. The cost scales with the number of repositories being scanned. For small teams, the entire price is very reasonable. The setup cost was essentially zero, with no professional services or implementation fees. The self-service onboarding took less than thirty minutes to connect all repositories and configure scan rules. Licensing is a straightforward annual or monthly subscription, with no per-user fees, which is developer-friendly. Overall, it is one of the most transparent and accessible pricing models I have seen in the security tools space.

The return on investment with Aikido Security was very clear and measurable across multiple dimensions. First and most significant is the cost of prevented breaches. Aikido Security caught a critical remote code execution vulnerability in my Python machine learning pipelines before it reached production. Industry estimates put the average cost of a data breach for a small to mid-sized company at anywhere between one hundred thousand to five hundred thousand dollars. When you factor in incident response, legal costs, customer notification, and reputation damage, preventing even one such incident more than justified my entire annual subscription many times over. The second one is developer time savings. Before Aikido Security, my senior developers spent roughly six to eight hours per week manually reviewing code for security issues and triaging vulnerability alerts from multiple tools. After Aikido Security, that dropped to approximately one to two hours per week, a saving of nearly seventy-five percent of security review time. Across a team of five developers, over a year, that translated to hundreds of recovered engineering hours redirected towards actual product development. The third one is tool consolidation savings. I replaced Snyk and a separate secret scanning tool with Aikido Security alone. That consolidation saved approximately four hundred to five hundred dollars monthly in subscription costs while actually improving our security coverage.

My relationship with Aikido Security is purely as a customer. There is no partnership, no reseller agreement, no referral agreement, and no affiliate relationships of any kind beyond my standard subscription. Everything I shared in this interview is based entirely on genuine, hands-on experience, and my opinions are completely my own.

I have several practical pieces of advice for anyone considering Aikido Security. The first one is to connect all repositories from day one, not just your main production ones. Security vulnerabilities hide in unexpected places such as internal tools, side projects, and experimental repositories. Full coverage from the start gives you complete visibility. The second one is to spend time configuring Auto-Triage rules early. The default settings are good, but customizing triage rules for your specific tech stack significantly reduces noise. Invest that configuration time up front, and you will thank yourself later. The third one is to integrate with your existing workflow immediately. Connect Aikido Security to your GitHub pull request process from day one. Make security scanning a non-negotiable part of every code review. If you add it as optional, it will get ignored. Use it as a developer education tool. Aikido Security does not just find vulnerabilities; it explains why they are dangerous. Encourage developers to read those explanations. Over time, our entire team's security knowledge improved naturally. I would rate this product an eight out of ten overall.