Aikido fits when
You want one developer security platform across code, dependencies, cloud and runtime, with an AI pentest and an in-app firewall as part of it.
ShieldProbe and Aikido Security
Aikido Security and ShieldProbe: compare the pentest, the protection and the fix.
Aikido covers code, cloud and runtime, and sells an AI pentest, an in-app firewall and AutoFix. ShieldProbe Assess is a consultant-approved pentest of web apps, APIs, networks and servers, internal or external. Here is where they overlap and where they differ.
How Aikido and ShieldProbe compare
Aikido Security is a developer security platform across code, cloud and runtime, including an AI pentest, the Zen in-app firewall and AutoFix. Here is how the overlapping parts compare.
Scroll the table sideways to compare both options. You can also focus it and use the arrow keys.
| Compared on | Aikido Security | ShieldProbe |
|---|---|---|
| What it tests | AI Pentest covers web apps, frontend apps, APIs (REST, GraphQL, gRPC, SOAP) and external networks, with broker support for internal applications. Aikido’s own comparison says it does not yet replace NodeZero for internal network, Active Directory, Kubernetes and cloud attack-path testing. The wider platform adds SAST, SCA, secrets, IaC, container and cloud posture scanning. | Web apps, APIs (REST, GraphQL, SOAP), networks and servers, internal or external. Black-box for every target; grey-box with your test accounts for web apps and APIs. |
| Findings and review | Separate agents re-exploit each finding against the live target and drop anything unproven. Agents pause and show their analysis before escalating. Aikido states it holds CREST accreditation and offers human-led pentests on request. It does not mention a person reviewing AI pentest findings before you see them. | AI authors each finding and a named consultant approves it before you can see it. Every finding carries the request, response and impact, so your team can reproduce it. |
| Fixes and retests | AutoFix opens pull requests with targeted code changes for confirmed vulnerabilities. Findings can be retested for up to 6 months, including bypass checks. Aikido Infinite runs a scoped pentest when new code lands and retests the fix. | Retests of confirmed findings for 12 months under your engagement terms. Fix drafts the code change in VS Code or Visual Studio (beta) for your developers to review. |
| Application protection | Zen, an open-source in-app firewall library, blocks SQL injection, command injection, path traversal and bot traffic and rate-limits APIs, with a dry mode for testing. It supports Node.js, Python, PHP, Java, .NET, Ruby and Go. For Node.js, a tenant-isolation control parses SQL queries and raises an error when a query does not filter on the correct tenant. Zen is not described as building rules from your own pentest findings. | Defend, sold separately, adds protection rules for supported findings inside your Node.js app. It starts in log-only mode and blocks only once you turn enforcement on. Ownership flaws such as IDOR are logged, never blocked: they need the code fix. |
| How it runs | A developer security platform. You choose which domains agents may attack; testing runs white-box from code and OpenAPI specs, or grey-box or black-box. On-premises, air-gapped AI pentesting is also documented. | A scoped pentest run from our own attack infrastructure. External targets need nothing installed; internal targets are reached through a small connector that needs no admin rights. The report arrives in 48 hours for agreed scope once access is ready. |
| Pricing | A pentest can start without payment; high and critical findings and the full report unlock when you pay. Some plans carry a no-finding, no-payment guarantee. | Quoted per assessment from the agreed scope, before testing starts. Defend is sold separately. |
Plan a side-by-side test
Use the same targets and test accounts you gave the other tool. We agree scope and access with you before testing starts.
Which fits your team
ShieldProbe fits when
You want a pentest of web apps, APIs, networks and servers, internal or external, where a named consultant approves every finding, and protection built from the findings in your own assessment.
What happens after the report
Each module takes a finding one step further.
Assess
A pentest of your web apps, APIs, networks and servers. A named consultant approves every finding, and each one comes with evidence your team can reproduce.
Explore AssessDefend
Protection for supported findings inside your Node.js app, sold separately. It starts in log-only mode and blocks only when you turn enforcement on. Ownership flaws are logged, never blocked.
Explore DefendFix
A code change drafted from the actual attack, in VS Code or Visual Studio (beta). Your developers review it and raise the pull request.
Explore FixContinuous
Developer preview. Selected tests run on the repository events you enable, so each change is tested as it ships.
Explore ContinuousCommon questions
Does Aikido already do pentest, protection and fix?
Yes. Aikido sells an AI pentest, the Zen in-app firewall and AutoFix code changes. The difference is how the steps connect: a named consultant approves each ShieldProbe finding first, and Defend builds protection for the supported findings in your own assessment.
Is Aikido’s AI pentest limited to web applications?
No. It covers web apps, APIs and external networks, with broker support for internal applications. Aikido says it does not yet replace NodeZero for internal network, Active Directory, Kubernetes and cloud attack-path testing.
Can we run ShieldProbe alongside Aikido?
Yes. Aikido covers code, cloud and runtime scanning that ShieldProbe does not. Use ShieldProbe Assess where you need a consultant-approved pentest of web, API, network or server targets, internal or external.
How does Defend differ from Zen?
Zen blocks the attack classes it lists, across several languages, and its Node.js tenant-isolation control stops SQL queries that skip the tenant filter. Defend builds rules for supported findings from your own assessment. It runs in Node.js today, starts in log-only mode, and logs ownership flaws rather than blocking them.
Sources
Details about other products and standards come from the public sources below, reviewed on 20 October 2026 unless dated. If anything has changed, tell us and we will correct it.
- Aikido: AI Pentest scope, validation, retests and AutoFix (reviewed 27 October 2026)
- Aikido: Zen in-app firewall (reviewed 27 October 2026)
- Aikido: Zen tenant isolation for IDOR (16 February 2026; updated 18 May 2026) (reviewed 28 October 2026)
- Aikido Infinite: continuous pentesting on code change (reviewed 27 October 2026)
- Aikido: code, cloud and runtime platform overview (reviewed 27 October 2026)
- Aikido: Horizon3 alternatives, stating its own pentest coverage (16 October 2026) (reviewed 27 October 2026)