Aikido CSPM

Overview

Aikido CSPM brings cloud configuration problems, exposed resources, risky permissions, and compliance gaps into one view. It covers AWS, Azure, GCP, and selected additional providers such as DigitalOcean. The checks include public storage buckets, databases without encryption, open SSH ports, and IAM policies that grant too much access.

Cloud accounts connect through read-only APIs, and Aikido says no agents are required. The deployment model is listed as hybrid. Context-aware scoring helps teams distinguish higher-impact production findings from lower-impact staging issues. Aikido was founded in 2022 and lists its European headquarters in Ghent, Belgium.

CSPM is part of a wider set of security capabilities that also includes container image scanning, AWS EC2 vulnerability scanning, Infrastructure as Code checks, outdated runtime detection, SBOM management, identity risk analysis, and attack path analysis. The breadth may be useful to teams seeking posture checks alongside related cloud and application security work, though the available plan limits and support vary by tier.

Key features

• Cloud inventory and misconfiguration checks: Maintain an inventory of cloud assets and review common exposure and configuration risks across multiple providers.
• Risk prioritization: Context-aware scoring elevates higher-impact production issues over less critical staging findings.
• Cloud Search and alerts: Search cloud resources using plain-language queries, then turn a search into a real-time alert for assets that match.
• Guided remediation: Aikido offers guided fixes and can generate pull requests for some cloud issues. It says it does not automatically alter infrastructure, and automated remediation is listed as unavailable.
• Adjacent scanning: The offering describes container image and AWS EC2 vulnerability scanning, Infrastructure as Code checks, and detection of outdated runtimes. IaC scanning, container scanning, and SBOM management are also listed among its capabilities.
• Compliance: Checks map to SOC 2 and ISO 27001, with compliance reporting that can sync with Vanta and Drata. Listed frameworks also include OWASP Top 10, CIS, NIS2, and PCI.

Aikido's Trust Center lists GDPR, ISO 27001:2022, ISO/IEC 42001:2023, SOC 2, CSA STAR Level 1, TX-RAMP Level 2, and AWS Security Competency. These are company-level security and compliance credentials; they are distinct from the compliance frameworks listed for CSPM checks.

Pricing

The Developer plan is free forever and includes CSPM, one cloud account, two users, 10 repositories, two container images, one domain, 10 AI AutoFixes per month, and 250,000 protected requests per month. This makes the free tier a limited entry point rather than an unrestricted cloud posture plan.

The Pro plan includes same-day support. Advanced includes priority support in Slack or MS Teams. The listed prices are total monthly fees for the paid plans, with 10 users included.

Platforms

Listed platforms are API, Linux, macOS, web, and Windows. The service connects to cloud accounts through read-only APIs and is described as using a hybrid deployment model.

Who it's for

Aikido CSPM may suit teams managing resources across several cloud providers that want configuration checks, asset inventory, identity risk analysis, and compliance reporting in a shared workflow. Its production-versus-staging prioritization and search-based alerts are relevant when teams need to sort findings by context and monitor for matching assets.

The free Developer tier provides one cloud account, while the paid plans list progressively higher account and workload limits. Teams needing automatic infrastructure changes should note that Aikido describes guided fixes and generated pull requests instead, and says it does not automatically change infrastructure.

Pros and cons

• Pros: Multi-cloud coverage includes AWS, Azure, GCP, and selected other providers; read-only API connections require no agents; checks span misconfiguration, identity, IaC, containers, and compliance; plain-language search can become real-time alerts; guided fixes and pull requests are available for some issues.
• Cons: The free plan is limited to one cloud account; automatic remediation is not offered; the Enterprise price is not listed; several capabilities are presented as part of a broader platform, so plan-specific availability should be confirmed where it matters.

Alternatives

For a wider comparison of posture tools, see Cloud Security Posture Management Software. Teams evaluating adjacent development-security categories can also browse DevSecOps Platforms and Infrastructure as Code Security Software. The supplied alternative apps are HCL AppScan, New Relic IAST, DongTai IAST, Contrast Assess, Veracode DAST, NowSecure Platform, Waratek IAST, and Acunetix; these are IAST or DAST-oriented names, rather than a directly specified CSPM comparison set.

Verdict

Aikido CSPM's strongest fit is teams that want cloud posture checks joined with inventory, contextual prioritization, search and alerting, and related scanning capabilities. Read-only connections and a free plan with CSPM lower the barrier to evaluating its scope, while account limits and plan-based workload allowances shape how far that tier can go. Its remediation is guided rather than automatic, an important distinction for teams expecting infrastructure changes to happen without review.