Aikido Gets $60M Series B to Scale, Automate AI Pen Testing

A Belgian software security startup raised $60 million to reduce the time, cost and effort associated with penetration testing using artificial intelligence.

See Also: Proof of Concept: Bot or Buyer? Identity Crisis in Retail

The DST Global-led Series B funding round will enable Aikido Security to double down on AI-powered pen testing, which the Ghent, Belgium-based vendor sees as faster, cheaper and more effective than human testers, said co-founder and CEO Willem Delbare. The company also plans to expand its open-source efforts related to supply chain attacks to immunize developer systems against modern threats.

“It’s a chance for us to solidify the brand and the story,” Delbare told Information Security Media Group. “In security, it’s a little bit about brand halo as well. If you’re a Fortune 500, you don’t necessarily want to buy from any random startup. You do want to know this party is going to be around for the next 15 to 20 years if you let them do your entire code security.”

Aikido, founded in 2022, employs 164 people and has raised nearly $85 million in four rounds of outside funding, having last received a Series A investment in May 2024 led by Singular.vc. The company has been led since its inception by Willem Delbare, who co-founded Teamleader CRM, Futureproofed Cities and Officient before starting Aikido. The company inked a $1 billion valuation in conjunction with its Series B (see: Aikido Security Buys AI Code Startup Trag to Outpace Rivals).

Why the Software Security Market Is Over-Fragmented

The company planned for 3x revenue growth in the past year but achieved 5x, which he said not only proved the viability and scalability of its product but also increased Aikido’s appetite for more ambitious growth targets in 2026 and 2027. He said lead investor DST offers global credibility given its backing of high-growth European startups including Revolut and having been an early investor in Facebook.

“The growth numbers were better than expected,” Delbare said. “So, that also means you burn a little extra money.”

The current software security market is over-fragmented with tools that overlap in functionality and are typically offered by different vendors, leading to poor integration, increased cost and operational burden for security teams, he said. Aikido merges AI pen testing, auto-fix capabilities and continuous feedback loops, providing constant assessment and remediation throughout the development life cycle.

“We do believe that all of these categories – usually they overlap a lot – will merge into one,” Delbare said. “It also doesn’t make sense from the buyer’s perspective. Gotta talk to like four vendors with poorly integrated products. Our approach fixes all of that and makes it more cost efficient and a more unified experience.”

While the space is crowded with new startups, Aikido most frequently competes against players with large install bases, extensive market presence and well-known brands such as Checkmarx, Veracode and Snyk, Delbare said. Aikido has an excellent track record of winning RFPs when it’s invited to participate, meaning the challenge is in discoverability and awareness and not product competitiveness.

“We encounter the biggest companies the most often, just because they have the biggest install base,” Delbare said. “Once we are in a deal with an RFP, we almost always win the deals. So, for us, it’s purely about being discovered.”

How AI Agents Can Mimic the Behavior of Human Pen Testers

Aikido’s AI agents can mimic the behavior of a human pen tester, especially for repetitive, mechanical and time-consuming tasks, complete pen testing cycles in as little as 12 hours, operating 50 to 100 times faster than humans and identifying two to three times more critical vulnerabilities. Delbare said the result is a service that is much more affordable, making continuous pen testing feasible for mid-market customers.

“If you have a lot of these agents working together, they can actually mimic what a human pen tester does – or at least the very boring parts of what they do over the course of two weeks,” he said. “We’re still benchmarking it against human assessors, but what we’re seeing is that the agents’ performance is absolutely magical. We thought it would take nine or 12 more months before it would reach this level.”

Tools such as CrowdStrike are highly effective for compiled software, but do not scan non-compiled or interpreted code such as JavaScript-based plugins and extensions. Aikido fills this gap by securing against threats from npm packages, Chrome extensions and VS Code plugins, which are popular vectors for malware because they run directly in developer environments and bypass traditional defenses.

“Our malware team will monitor every new release of every new Chrome extension, every new Visual Studio extension and evaluate it for weird behavior,” Delbare said. “Our Safe Chain product line is a free, open-source product you can install on laptops to immunize them against supply chain attacks.”

Delbare expects an IPO in three-to-four years and sees the company already in the tens of millions of annual recurring revenue, with a target of $100 million in ARR within 18 to 24 months. The company also monitors the number of critical vulnerabilities discovered, adoption of Aikido’s open-source tools, and customer success and platform stickiness through enterprise onboarding rates and retention, he said.

“Our other metric is keeping our users secure,” Delbare said. “That in turn translates into stopping the next malware attack, finding CVEs, onboarding new companies into our platform and adoption of our open-source software. I think we have at least 20 projects on GitHub now.”