Xander Van Buggenhout: Aikido Security

Why this conversation

Finding vulnerabilities is the start; the work is deciding which ones matter, and fixing them without breaking the build. The host met Xander Van Buggenhout of Aikido Security at Techorama Netherlands 2026 in Utrecht on 27 October 2026 and asked him what they do in security. His answer went from code scanning to agents that attack an application, and to software that fixes and ships its own security fixes.

From code to cloud

“We’re Aikido Security, a Belgian cyber security player growing quite rapidly”, Xander said. They started in application security with code scanning: connect your repositories and Aikido scans all of them for vulnerabilities, with deterministic checks “but also a lot of AI implemented there”. It helps triage, “so you know what to focus on”: “We filter out a lot of false positives if you compare it with other tools.”

From there the product shifted “more and more to the right”. You can connect your cloud environment too, “so we follow the code from where it’s written to where it’s hosted basically”, and that context filters out even more false positives. It scans containers and VMs as well, and some runtime components now do AI pentesting.

AI pentesting, and the harness

In AI pentesting, “an army of LLM agents can try to hack your application”. Given access to the code base, they have a lot of context to find possible vulnerabilities; then they try to validate and exploit them.

Is it better than Mythos, the host asked. “It should be better than Mythos. It’s very harness-focused. So the harness around it is really what makes it strong.” Different models work underneath depending on the action it is taking, where Mythos is one very expensive model, very good in cybersecurity, that you would run several times to find a lot of vulnerabilities.

How to try it

Go to app.aikido.dev. “We have a free forever version for people who have like hobby projects for example”, and you can try the Pro version “for a couple of days or even two weeks”.

Device protection for developers

The latest launch is device protection: “That is a fairly new one.” “We see a lot of supply chain attacks now going for the endpoints of the developers and stealing secrets there”, Xander said, across ecosystems: npm and PyPI, and now VS Code extensions and AI skills too. Installed on the developer’s machine, it looks at the network traffic and blocks npm packages, VS Code extensions and so on before they are installed.

Toward self-securing software

“Our future as a product, we really want to create self-securing software.” Aikido already finds vulnerabilities, and its autofix proposes a fix from which you can create a pull request within the platform. The next step is auto-ship: shipping the fix after smoke testing it and validating that it does not break the build. Developers can then focus on building new features, while security keeps “finding, validating, fixing and like looping that process basically”.

When it comes out

The episode is edited and in the release order. Like every episode it goes out on YouTube first, then on Apple Podcasts, Spotify and Amazon Music.