Compare
Kissaki vs Aikido
Both products consolidate code, dependency, container, cloud and API scanning behind one workspace, and both ship a free tier. Consolidation is where the comparison starts, not where it ends. Two things decide it: what an application has to pay for before it is tested properly, and whether a finding arrives with the evidence to act on it.
Aikido's free plan is genuinely broad. It carries dependency scanning, static analysis, secret detection, cloud posture and container and IaC scanning at no cost. The line falls on two capabilities: dynamic web and API testing, and malicious-package detection. Kissaki puts both on its free plan. On Aikido, per its pricing page, both sit on the Pro tier at $600 a month.
The other difference is what a finding is. Kissaki reports a vulnerability only when it can attach a reproducible proof that the vulnerability is real, and re-tests every asset every 24 hours. That is the whole product thesis: proof, not guesswork.
| Capability | Kissaki | Aikido |
|---|---|---|
| Free plan | Yes. 5 users, one application, the full scanner set | Yes (Developer). 2 users, 10 repositories |
| Dependencies, licences, EOL runtimes (SCA) | Free | Free |
| Static analysis + secret detection | Free | Free |
| Containers, Kubernetes, IaC | Free | Free |
| Cloud posture (CSPM) | Free. AWS, Azure, GCP | Free |
| Malicious-package detection | Free | Pro ($600/mo) |
| Dynamic web & API testing (BOLA, BFLA, injection, SSRF, business logic) | Free | Paid. Attack Surface Monitoring on Pro ($600/mo); AI Pentesting is credit-based |
| Evidence model | A reproducible proof on every finding it can prove, or it is not reported | Findings with AI autofix; see Aikido's docs for its evidence model |
| Rescan cadence | Every 24 hours, 12 for cloud | Every 3 days on the free tier |
| Pull-request gating | Startup (299 EUR/mo) | Basic ($300/mo) |
| Compliance mapping (SOC 2, ISO 27001, DORA, NIS 2, HIPAA) | Growth (599 EUR/mo) | Compliance sync (Drata, Vanta) from Basic; framework coverage differs |
| Code-to-runtime reachability | Growth (599 EUR/mo) | Reachability included with SCA |
| Fix pull requests | Growth. Opened for review, never applied for you | AI autofix from Free; credit-gated deep analysis on Pro |
| Runtime protection (WAF / bot) | Not offered | AI & Bot protection (Zen) from Basic |
| Hosting / residency | EU-hosted, zero retention | See Aikido's documentation for hosting regions and retention |
Where Aikido may fit better
An honest comparison names the other side's strengths. Aikido's free tier covers far more repositories than Kissaki's (ten against one application), so a large codebase with no dynamic-testing need starts cheaper there. Aikido also ships capabilities Kissaki does not: runtime AI and bot protection, AI autofix at scale, CVE-free base images, marketplace procurement through AWS and Azure, and FedRAMP and FIPS options for public-sector buyers.
If your priority is breadth of repositories on a free plan, in-app runtime protection, or procurement through a cloud marketplace, Aikido is the stronger fit. If it is proving that a finding is real, and getting dynamic web and API testing and malicious-package detection without reaching a paid tier, that is where Kissaki is built to win.
Aikido details from its public pricing page (https://www.aikido.dev/pricing), verified 17 August 2026. Pricing and tiers change; check the source before relying on a figure. Kissaki figures are in EUR, Aikido's in USD as published.