Aikido AI Pentest

What it does

Aikido AI Pentest runs autonomous agents against web apps, APIs, network targets, mobile apps and AI agent or MCP features. Agents map the attack surface from your code, API specs or a live app, then attack and re-exploit each candidate issue so the results contain only confirmed findings. Each verified finding includes impact, reproduction steps, remediation guidance and a working proof of concept.

Teams use it to run pentests on each release and to produce audit-ready reports for SOC 2, ISO 27001 or HIPAA. Reports come in auditor, management, customer and post-remediation versions, plus a letter of attestation for RFPs. A finding can become a pull request in one click, and new agents can retest a patch.

It suits engineering and security teams that need compliance evidence on a defined scope. You choose which domains may be attacked, and the system pauses for human approval before escalating a possible vulnerability. Pricing is per assessment with rightsized ranges, and continuous testing is quoted separately. A separate Aikido Machine on-prem GPU option exists for regulated organizations.

What it can do

• Autonomous agents map apps, APIs and infrastructure from code, API specs or live targets
• Re-exploits each candidate finding to confirm it and suppress false positives
• Generates audit-grade PDF reports for SOC 2, ISO 27001 and HIPAA plus management and customer reports
• Creates a pull request from a verified finding in one click
• Launches new agents to retest a fix after remediation
• Covers web/API, network, mobile and agent/MCP targets

Before you choose

• Results depend on the scope you define; targets outside scope are not tested
• A rightsized quote is calculated from repos, endpoints and roles, and continuous testing requires an initial assessment first
• Human-led pentests remain available through Aikido's CREST accreditation for standards that require them

Listed under

• Security
• App and code security

Get started

Requires an Aikido account; a free sign-up path is shown.

1. Create an Aikido account at app.aikido.dev
2. Choose the domains or assets to test and confirm the scope and pre-flight checks
3. Optionally connect repositories and share test credentials to improve coverage and pricing accuracy

A typical pentest is a fixed-scope per-assessment fee. Rightsized pentests are scoped to your application and priced from your repos, endpoints and roles. Continuous testing is a custom quote. The pricing page states 'No high or critical findings = No pay'. Prices exclude taxes; other currencies are listed on the pricing page.

Source: aikido.dev/pricing, checked 29 Oct 2026. Prices can change; check before you buy.

Sources for this overview

Product pages, documentation, and pricing checked 29 Oct 2026. Each source supports part of the overview; availability and prices can change.

• AI Pentests That Simulate Real Attacks | Aikido Security ↗www.aikido.dev
• Pricing | Aikido Security ↗www.aikido.dev
• Aikido Security | Secure everything your devs build, ship & run. ↗www.aikido.dev
• Aikido Machine | AI pentesting entirely under your control ↗www.aikido.dev
• AI PR Review - Review every PR with full codebase context l Aikido Security ↗www.aikido.dev
• Aikido Docs Overview | Aikido ↗help.aikido.dev

Company website

aikido.dev: product, pricing and policy pages

Social accounts

Accounts the company links, and its posts on X

Human review

Checked by a person

knowledge_base

manual_review

Last checked 29 Oct 2026. Every field keeps its source and date; unknown means we couldn’t confirm it.