Software Composition Analysis (SCA)

Open source dependency scanning

Detects vulnerabilities, malware, end-of-life runtimes & OSS licenses or generate SBOMs.

Finds more vulnerabilities than other tools
Auto-triaging to filter out false positives
Clear remediation advice & auto-fixes

Start for Free Book a Demo

Importance of SCA

Why should you do open source dependency scanning?

If you're using dependencies, you'll get vulnerabilities, it's that simple.

Covers all languages

Open source tools don't always support all languages. Aikido combines multiple scanners to fix all gaps. (For example, Aikido supports .csproj files out of the box)

Check language support

Works out of the box

Open source projects tend to be hard to set up and keep running flawlessly. Aikido fixes any issues and keeps your scans going. On top of that, you're able to easily see if you're missing lockfiles.

Features

Open Source Dependency Scanning Features

Autofix

Aikido Autofix is a tool you can use to have Aikido fix vulnerabilities in 3rd party dependencies in your projects. It will do this by creating pull requests that remove the vulnerability via package updates or by other means. In some cases an Aikido Autofix can remove a whole class of vulnerabilities instead of just 1 issue.

Learn more

Instant Deduplication

When Aikido finds vulnerabilities, it will report duplicate issues as one issue. Unlike other scanners that will overload you with hundreds of security alerts, when the affected function is found multiple times. You'll only get alerted if there exists a known fix for any given vulnerability.

Reachability Analysis

Aikido checks if you're using a certain function. If not, it's clearly a false positive and it's automatically triaged.

Learn more

Reliable databases

Checks against multiple popular CVE databases. With Aikido Intel detecting vulnerabilities earlier than anyone else with the help of AI (LLM).

Actionable advice

No need to do CVE research. Aikido gives you the TL;DR, tells you how you're affected & how you can most easily remediate security issues or even auto-fix them.

Learn more

Malware detection

The npm ecosystem is susceptible to malicious packages being published because of its open nature.
Aikido identifies malicious code that may be embedded within JavaScript files or npm packages. Powered by Phylum. (Scans for backdoors, trojans, keyloggers, XSS, cryptojacking scripts and more.)

Create SBOMs

Security audits typically require providing an SBOM. Aikido makes it easy to analyze this list in advance & generate it whenever required. You're also able to create an SBOM of containers. Aikido supports cycloneDX and SPDX.

Compliance made easy

Aikido automates all technical vulnerability management controls, making SOC2 & ISO 27001 compliance a whole lot easier. Compliant companies have an easier time to prove that their customer's data is secure, which helps with closing bigger deals.

FAQ

More to explore

Documentation

Trust Center

Integrations

Is Aikido's software pentested?

Yes. We run a yearly pentest on our platform and also have an ongoing bug bounty program to ensure the security of Zen is continuously tested by a wide range of security experts.

Can I also generate an SBOM?

You can create a CycloneDX SBOM or csv export with one click. Just go to the Licenses & SBOM report where you'll get a full overview of all the packages & licenses you're using.

What do you do with my source code?

Aikido does not store your code after analysis has taken place. Some of the analysis jobs such as SAST or Secrets Detection require a git clone operation. More detailed information can be found on docs.aikido.dev.

Do I need to give access to my repos to test out the product?

When you log in with your VCS we don’t get access to any of your repositories. You can manually give access to the repositories you’d like to scan. It’s also possible to test out the platform using sample repositories.