Share your experience using Continuous Dynamic (formerly WhiteHat Dynamic)

My main use case for Aikido Security is vulnerability scanning of our internal applications. We have a development department, and we scan those applications for vulnerabilities and other security issues.

In addition to my main use case, we have samples where clients want to see security information reports from our internally developed systems. We generate those reports with Aikido Security, and then we are able to show them how we are aligned with best practices and frameworks such as ISO 27001.

The best features Aikido Security offers are the ability to generate reports aligned with security frameworks and how well we accomplish alignment with those security frameworks.

The level of detail and the way Aikido Security matches every topic from frameworks make the reporting and alignment with security frameworks stand out. It divides the report topic by topic of the framework.

I can assign to my developers the things I want them to change, which is an important feature of Aikido Security.

Aikido Security has positively impacted my organization because we feel more secure. We have a good monitoring system for vulnerabilities through Aikido Security, and we are able to show our clients our security posture and the security posture of our internal systems.

Since using Aikido Security, it has become easier for us to show evidence about compliance. For example, when auditors want to check those kinds of things, we are able to show them how we are in compliance with ISO 27001 and in compliance with development best practices.

Aikido Security's governance and security capabilities are great. It is quicker to access the features and easiest to get accurate information regarding vulnerabilities and changes we need.

The accuracy and reliability of output from Aikido Security are excellent. It is very accurate, and we always have the latest information from the topics we are working on.

Aikido Security could be improved by allowing us to scan the entire network, not just the applications, but also devices such as computers and servers, to have all vulnerability reports for my entire infrastructure.

Everything else is fine for me regarding needed improvements. The interface of Aikido Security is intuitive and very easy to use.

I have been using Aikido Security for at least two or three years.

Aikido Security is stable. We have not had any issues since we started using it.

The scalability of Aikido Security is good. I think it is solid, and we have not had any issues with it. We are able to work on a daily basis without any constraints.

The customer support for Aikido Security is great.

Aikido Security is the first solution for the company regarding development vulnerabilities. Before choosing Aikido Security, I did evaluate other options, but I do not remember the other ones because it was three years ago.

My advice for others looking into using Aikido Security is to take into account that they will get a robust solution with AI capabilities and a perspective aligned with a security framework, which is very important.

A specific example of how I use Aikido Security in my workflow is that when we have a new build for an application developed internally, we scan that build and then proceed to see what happens and what the Aikido Security results from the scan are. I then communicate to the development team the things they have to update, create, or change to be able to mitigate those breaches.

I would rate this solution a ten out of ten.

My main use case for Aikido Security is detecting security issues and triaging, and if there is any security risk, we detect and fix those security fixes.

I use Aikido Security for detecting and fixing security risks by implementing a DevOps pipeline using a static application security testing tool, which helps automate the detection of exposed secrets and checks for any malicious open-source packages, making it easier for developers to prepare a list of issues they need to fix. Our goal is to ensure all repositories are free from any security issues, monitor cloud configurations that are not done correctly, scan images for runtime threats, and perform automated penetration testing to simulate real-world attacks, detecting any loopholes. It also helps improve developers' productivity by filtering out false positives and generating AI fixes with a single click for identified vulnerabilities.

The main use case for Aikido Security is to perform static application security testing whenever a developer checks in code to ensure there is no malicious code checked in.

The best features Aikido Security offers include code supply chain scanning, cloud container security to monitor for misconfigurations or runtime threats, automated penetration testing, and the Autofixes feature, which is a new addition in recent versions and helps fix most security issues.

The feature I find myself relying on the most is code and supply chain scanning, which makes it easier to automate the detection of any security issues, helping to fail the build if there is any malicious code.

Aikido Security has positively impacted my organization by improving overall code quality, enabling us to develop a secure product, and drastically improving our reputation among customers. We now have all types of reports and dashboards, allowing any stakeholder or management to easily check how much work has been done and the product's security status.

The biggest outcome I have seen from using Aikido Security is improved code quality.

There is still a lot of scope for improving the automated fixes with Aikido Security.

I would like to see some alerts and configurations added as specific improvements.

I rate it an eight because there are some gaps and issues with certain features, particularly in identifying issues and marking them as positive, as well as finding real false positives. By addressing these issues, they can improve the score.

Regarding Aikido Security's AI capabilities, it lacks in governance and security; while it uses contextual AI to dismiss false positives automatically, we still conduct manual reviews. Since it's still a premature feature, we do double-check AI-related fixes and review any custom AI rules that allow the team to write guidelines for AI-powered PR checks.

The accuracy of Aikido Security's output is still not very high, and there are a few features where they are still lacking behind regarding accuracy.

I have been working for two years in my current field.

Aikido Security is stable.

Aikido Security's scalability is shifting; it helps to transition the clunky security approach to a developer-first AppSec.

I would say customer support is average.

I would rate the customer support a six out of ten.

I previously used different solutions such as the Semgrep open-source tool and other open-source tools for detecting configuration issues, including OWASP, and while some projects still use Semgrep and OWASP, we have switched to Aikido Security.

We were able to close 90% of issues with the help of Aikido Security tools, providing a return on investment.

Regarding my experience with pricing, I know we have some open-source tools in use; however, Aikido Security has a plan for $4,200 annually for up to 10 users.

Before choosing Aikido Security, I evaluated other options such as TruffleHog, which is also free, and I also assessed Snyk, Checkmarx, Black Duck, and Veracode.

We were able to close 90% of issues with the help of Aikido Security tools, providing a return on investment.

I would advise others looking into using Aikido Security to evaluate several options based on their specific requirements for SAST, DAST, and SCA, including how much they want to automate and their budget for security tools. While there are better options available, some might be expensive, and there are free options that don't provide the same features as Aikido Security.

I would rate this review an eight overall.