Exposure & Vulnerability Management

Pick the first of two products.

Open a name for its full profile

Cycode
Scored
Cycode · Commercial · 8 capabilities in this domain · 4.07 / 5
Select
Apiiro
Scored
Apiiro · Commercial · 7 capabilities in this domain · 3.97 / 5
Select
ArmorCode
Capabilities only
ArmorCode · Commercial · 5 capabilities in this domain
Select
Brinqa
Capabilities only
Brinqa · Commercial · 5 capabilities in this domain
Select
Nucleus Security
Capabilities only
Nucleus Security · Commercial · 5 capabilities in this domain
Select
Seemplicity
Capabilities only
Seemplicity · Commercial · 4 capabilities in this domain
Select
Snyk AppRisk
Capabilities only
Snyk · Commercial · 4 capabilities in this domain
Select
DefectDojo
Capabilities only
OWASP Foundation · Open Source · 3 capabilities in this domain
Select
Jit
Capabilities only
Jit · Freemium · 3 capabilities in this domain
Select
Qualys VMDR
Capabilities only
Qualys · Commercial · 3 capabilities in this domain
Select
Rapid7 InsightVM
Capabilities only
Rapid7 · Commercial · 3 capabilities in this domain
Select
Tenable Vulnerability Management
Capabilities only
Tenable · Commercial · 3 capabilities in this domain
Select
OX Security
Capabilities only
OX Security · Commercial · 2 capabilities in this domain
Select
Aikido Security
Capabilities only
Aikido Security · Freemium · 1 capabilities in this domain
Select
Echo Frontier
Capabilities only
Echo · Commercial · 0 capabilities in this domain
Select

In Exposure & Vulnerability Management

Aikido Security

Aikido Security · Exposure & Vulnerability Management

FreemiumCompany

Aikido orchestrates open-source and proprietary scanners, deduplicates and auto-triages results, and adds Safe Chain malware protection and Zen runtime firewall.

What it does7 capabilities · 4 at full coverage

4 of 7 at full coverage.

Cloud Security Posture ManagementPartialCLOUD · level 2 · 15 providers
Malicious Package DetectionFullDEPS · level 2 · 14 providers
Software Composition Analysis★FullDEPS · level 1 · 23 providers
Vulnerability Aggregation & DeduplicationFullEVM · level 2 · 11 providers
Secrets Detection in Source Code★PartialSECRETS · level 1 · 15 providers
Finding Triage & False-Positive SuppressionFullSAST · level 3 · 7 providers
Static Application Security TestingPartialSAST · level 2 · 21 providers

What it proves50 controls across 15 frameworks

Satisfied through its capabilities, not claimed by the vendor.

SSDF 1.18 / 42PS.1.1 PW.4.1 PW.4.4 PW.7.1 PW.7.2 RV.1.1 RV.1.2 RV.2.1
CSF 2.05 / 106GV.SC-07 ID.RA-01 PR.AA-01 PR.PS-01 PR.PS-06
SAMM 2.05 / 90I-DM-1-A I-SB-2-B I-SD-2-B V-ST-1-A V-ST-2-A
ASVS 5.04 / 17V1 V13 V15 V5
CIS Controls4 / 18CIS 10 CIS 16 CIS 4 CIS 7
CNAS Top 104 / 10CNAS-1 CNAS-2 CNAS-5 CNAS-7
S2C2F4 / 25ING-3 SCA-1 SCA-2 SCA-4
OWASP Top 103 / 10A02:2025 A03:2025 A05:2025
CI/CD Top 102 / 10CICD-SEC-3 CICD-SEC-6
CIS Benchmarks2 / 6CIS AWS Foundations Benchmark CIS Microsoft Azure Foundations Benchmark
CRA2 / 41Annex I Part I (2)(a) Annex I Part II (3)
DSOMM2 / 19TV-Consolidation TV-Static-Depth-Applications
SP 800-204D2 / 11204D-CI-COMMIT 204D-CI-DEPS
Scorecard2 / 20SAST Vulnerabilities
LLM Top 101 / 10LLM03:2025

What it stops14 techniques · 5 risks

14 techniques countered, 11 of them common

Cloud Misconfiguration ExploitationVery Common
Exploit Public-Facing ApplicationT1190Very Common
Exploitation of Known Vulnerable ComponentVery Common
Injection ExploitationVery Common
Leaked Secret AbuseVery Common
Malicious Install-Time ScriptVery Common
Unsecured Credentials: Credentials In FilesT1552.001Very Common
Compromise Software Dependencies and Development ToolsT1195.001Common
Data from Cloud StorageT1530Common
Data from Information Repositories: Code RepositoriesT1213.003Common
Maintainer Account TakeoverCommon
Self-Propagating Package WormEmerging
Protestware and Maintainer SabotageRare
SLSA threat DEP: Dependency threat (A–H applied recursively)SLSA-DEP

5 risks reduced

Leaked credential enables unauthorized accessCritical
Malicious dependency executes in development or CICritical
Exploitable flaw in first-party application codeHigh
Exposed and over-privileged cloud resources go unnoticedHigh
Known vulnerability in a reachable dependency is exploitedHigh

Where it runs4 phases · 1 way to deploy

Capabilities per lifecycle phase

Code5
Build3
Operate1
Monitor4

How it is delivered

SaaS

What it unlocks9 activities · reaches level 5

Program activities its capabilities support, reaching level 5. Supporting an activity is not completing it.

Level 1

Assess cloud accounts against benchmarksLow effort
Run SAST on critical repositoriesLow effort
Scan dependencies for known vulnerabilities and licensesLow effort
Scan repositories and history for secretsLow effort

Level 2

Aggregate findings and route to ownersMedium effort
Scan every pull request and block new high-confidence issuesLow effort

Level 3

Block malicious packages with behavioral analysisMedium effort
Tune rules and automate triageMedium effort

Level 5

Preventive cloud guardrails make misconfiguration impossibleHigh effort

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsOpen core or freemium · free tier

LicensingOpen core or freemium

Priced perfree tier plus paid tiers

BillingSubscription

Scales withFeature tier, users or usage beyond the free tier

Total cost

Start free; enterprise needs such as SSO, audit logs and policy often require the paid tier.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at1 sibling

Same family

Aikido SASTFreemium · 4.22

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13