Aikido Security details how its AI pentesting and Aikido Infinite fit into existing security stacks
Aikido Security published a vendor blog post describing how its AI Pentesting product can be added on top of existing SAST, SCA and cloud security tooling to find logic flaws that deterministic scanners miss. It cites First National Bank of America, which ran a test of a new customer portal in 1 hour 40 minutes and found a high-severity issue before launch. The post is product and marketing content with no incident, vulnerability or threat actor involved. It promotes whitebox testing, continuous testing with Aikido Infinite, and on-prem testing with Aikido Machine.
Detalhes técnicos
- Aikido claims whitebox testing (repository access) found 7x more vulnerabilities than greybox testing across more than 1,000 pentests. This is a vendor claim.
- Tests should target a staging environment with test data and use credentials for each user role, so agents can check broken access control and cross-role data access.
- Findings are validated by additional agents, ship with a proof-of-concept, reproduction steps, a severity rating and an estimated time to fix.
- Aikido Infinite uses the last full assessment as a baseline and launches targeted agents on security-relevant changes, on deploy or on a schedule.
- The post also covers external network pentesting, with a supervisor that blocks damaging actions and agents that prove access without downloading or storing data. It names Pentera, NodeZero, Hadrian and Escape as other tools.
Remediação
- Route each finding into the existing tracker, assign an owner, fix through normal code review, then retest in the test environment.
- Define scope, access, cadence, ownership and cost before the first run.
- Where supported, AutoFix proposes code changes for pentest findings.
Linha do tempo
-
Aikido Security details how its AI pentesting and Aikido Infinite fit into existing security stacks
ler a análise desta fonte ocultar
Aikido Security published a vendor blog post describing how its AI Pentesting product can be added on top of existing SAST, SCA and cloud security tooling to find logic flaws that deterministic scanners miss. It cites First National Bank of America, which ran a test of a new customer portal in 1 hour 40 minutes and found a high-severity issue before launch. The post is product and marketing content with no incident, vulnerability or threat actor involved. It promotes whitebox testing, continuous testing with Aikido Infinite, and on-prem testing with Aikido Machine.
Technical Details
- Aikido claims whitebox testing (repository access) found 7x more vulnerabilities than greybox testing across more than 1,000 pentests. This is a vendor claim.
- Tests should target a staging environment with test data and use credentials for each user role, so agents can check broken access control and cross-role data access.
- Findings are validated by additional agents, ship with a proof-of-concept, reproduction steps, a severity rating and an estimated time to fix.
- Aikido Infinite uses the last full assessment as a baseline and launches targeted agents on security-relevant changes, on deploy or on a schedule.
- The post also covers external network pentesting, with a supervisor that blocks damaging actions and agents that prove access without downloading or storing data. It names Pentera, NodeZero, Hadrian and Escape as other tools.
Remediation
- Route each finding into the existing tracker, assign an owner, fix through normal code review, then retest in the test environment.
- Define scope, access, cadence, ownership and cost before the first run.
- Where supported, AutoFix proposes code changes for pentest findings.