Aikido Security: toward self-securing software

Xander Van Buggenhout is with Aikido Security, “a Belgian cyber security player growing quite rapidly”. Luca Berton talked to him at Techorama Netherlands 2026 in Utrecht on 27 October 2026.

From code to cloud

Aikido Security started in application security, with code scanning: you hook it up and it scans all of your repos for vulnerabilities, with deterministic checks but also a lot of AI. It helps triage, so you know what to focus on, and it filters out a lot of false positives compared with other tools.

From there the product shifted more and more to the right. You can also hook up your cloud environment: “So we follow the code from where it’s written to where it’s hosted basically.” That gives a lot of context to filter out even more false positives, and it scans containers and VMs as well.

AI pentesting

At runtime, Aikido now does AI pen testing, “where basically an army of LLM agents can try to hack your application.” Given access to the code base, the agents have a lot of context to find possible vulnerabilities, and they then try to validate and exploit them.

Is it better than Mythos, Luca asked? “It should be better than Mythos.” It is very focused on the harness: “So the harness around it is really what makes it strong”, with different models underneath depending on the action it is taking. Mythos is a very expensive model, very good in cybersecurity, but you should run it multiple times to find a lot of vulnerabilities.

Device protection

The latest launch is device protection. Supply chain attacks now go for the developers’ endpoints and steal secrets there, and across ecosystems: npm and PyPI, but now also VS Code extensions and AI skills. Device protection is installed on the developer’s endpoint, looks at the network traffic, and blocks npm packages and VS Code extensions before they are installed.

Self-securing software

“Our future as a product, we really want to create self-securing software.” Aikido already finds vulnerabilities, and its autofix already proposes a fix you can turn into a pull request from within the platform. The next step is auto-ship: shipping the fix, smoke testing it and validating that it doesn’t break the builds. Developers can then focus on building new features, while security keeps finding, validating and fixing, in a loop.

Try it

At app.aikido.dev there is a free forever version for hobby projects, and a pro trial for a couple of days, or even two weeks.

More

The episode with Xander Van Buggenhout is edited and goes out on YouTube first, then on Apple Podcasts, Spotify and Amazon Music.