Aikido is the no-nonsense security platform for developers. The all-in-one security platform that covers you from code-to-cloud and helps you get security done. Engineering teams execute faster with Aikido thanks to centralized scans, aggressive false positive reduction, automatic risk triaging & fixing, risk bundling, and easy step-by-step risk fixes. Aikido makes security simple for SMEs and doable for developers, so companies can win customers, grow up-market, and ace compliance. Don’t just get security done fast, get it done automatically.

Get started for free: https://app.aikido.dev/ 
No strings attached.

Mathias Deloof

Pentest every feature release. Patch automatically. Launching: Aikido Infinite.

AppSec & CloudSec made easy | Aikido Security

Software can now secure itself.

→ aikido.dev/attack/infinite

10+ years in engineering and security before founding Latio Tech to help security engineers cut through the marketing noise and find the technical details of products.

I have a passion for driving security teams as contributors to product (the true meaning of DevSecOps) and built Latio Tech to help connect people with the right products.

James Berthoty

Parsing the hype on Claude Code Security, what it is and what it isn't:

1. Claude Code has had a security review command for months, what anthropic announced is probably just a wrapper for that command, so it's not actually that new. People have already been running security-review in pipeline as a SAST replacement, but this isn't really an end-to-end application security solution. There's no state management, consistent results, prioritization, the many non trivial things application security teams need beyond a good in pipeline scanner. 

2. This is validation that AI SAST is really good, and I agree that it is really good. However, the AI SAST tools I have access to (ZeroPath and Corgea) have given much better results than the security-review command. Claude will get there I'm sure, but there are a lot of small things needed to make things work for security. As a quick example, for a test repo right now one of the tools has 15 true positive logic findings, while Claude found 3, only one of which is an actual issue. And that one actual issue is the one 90% of static scanners detect within 30 seconds instead of 30 minutes. Do a POC and see for yourself 🤷‍♂️

3. Far from selling off unrelated Crowdstrike stocks, people seem to forget that Application Security teams use at least 9 different scanners alone, never mind the workflows and features on top of it. Making one scanner less useful doesn't exactly prompt a fire sale. Yes, AI will continue to change the nature of these scanners, but vendors are extremely aware and pivoting quickly. 

4. A lot of solutions are shifting to governance from scanning in order to accommodate for these changes, others are focusing on runtime capabilities to compensate. 

In sum, this is another step towards Anthropic doing more of the security process, but it's far from the end of AppSec, never mind security more broadly. I'm not saying this isn't a big deal, I am saying it's not as big of a deal as some are making it out to be. 

As an aside, I did sign up for the beta, and if I get access I'll be happy to share more ✨ 

Below you can see Claude spend 17 minutes and 155,000 tokens to find an issue opengrep told me about in 30 seconds, along with two false positives.

In our Application Security report, we covered how the market is at a transitional moment.

We argued that by combining SCA, Container, IaC, and SAST, Snyk became the earliest platform to give a clear vision of what a consolidated application security platform could look like going into 2020. Then came the investment of Snyk Cloud, which rolled into IaC, showing an understanding of the importance of code-to-cloud capabilities for practitioners. Giving emerging platforms a starting point to reference.

Today, this entire model is once again changing.

Companies are focusing more on how to govern their AI coding agents, and less on specific scanning capabilities. This time however, I'd argue almost every company is aware of the paradigm shift that's occurring, and are racing towards it. Even companies like Snyk who invented the modern paradigm are moving quickly to deploy AI governance solutions.

This shift is forcing a focus on AI code governance - security, quality, and secrets - rather than traditional scanning. This is also why the tension exists in the market between security vendors and AI tool providers because everyone is building as they go with no clear reference point.

Just as there was a transition from waterfall to agile, which introduced new risks, opportunities, and scanning paradigms, there’s a current transition from agile to AI code generation, which introduces a new paradigm for the AppSec market.

There's a new "shift-left" happening and we're working at Latio to define it

In the last year, we’ve seen the window for feature differentiation become incredibly short, due to Claude Code's impact. While some startups are making the right investments, many startups are still launching features without true technical differentiation and undervaluing how AI code generation is evolving what's required. Here are some ways this is changing the market:

1. Building a true technical moat matters more than ever for startups. Two examples where I've seen this are with "true” AI SOC and (C)ADR platforms. They do more than SOAR, but also address the underlying data problem. There's a reason these categories remain uncopied while things like "AI Skill Scanners" or "AI workflows" are already deployed by many vendors.

2. It will be harder than ever to build a startup as a pure feature play and then expanding into a platform later. Small features without major technical differentiation are much easier to build in house than they used to be. Teams need to launch with either strong technical justification, or ready to replace existing solutions.

3. Standing out matters more than ever and it means investing in your marketing brand and messaging clarity. These are already under-appreciated aspects of cybersecurity companies, but we're living in a world where selling a tool on pure feature differentiation is becoming less feasible. This will also become harder to do, as the quality bar has been raised by many teams shipping vibe coded hype or supplemental tooling rather than static landing pages.

All of these changes makes our goal at Latio, to be hands on with every product, more important than ever. Vibe coding an MVP can be done in hours, but a mature product assessment covering all edge cases thoroughly takes far more time and intentionality.

I'm not on the "SaaS is dead" train, but the standards are higher.

Today Zach Rice, the original creator of the popular open source secrets scanner gitleaks, spun up betterleaks with the aim of being the best open source secrets scanner available.

Gitleaks was always my go-to open source secrets scanner, and it's great to see its creator back at building an amazing community tool - simple, quick and effective, just like it's predecessor!

Amazing open source tools are the backbone of application security, and it's always great to see meaningful investment in the core scanners that are out there.

Here's the repo - https://lnkd.in/e_GeB-pF

5 things I’m expecting and excited to see at BSides and RSA this year:

1. The evolution of application security companies tackling AI code generation workflows. Companies are racing to rebuild their platforms to support AI use cases, and it’s a genuinely exciting time to be in application security as everyone makes big bets on future architectures.

2. How AI SOC has expanded their use cases and capabilities to tackle broader use cases than SOAR. Many companies are going the MDR direction, while other platforms are becoming more agentic assistants - these tools continue to improve at delivering automation.

3. AI SAST taking the main stage at innovation sandbox. I’ve been a long time believer in AI Native SAST capabilities, and it’s great to see the next generation of code security scanners get proper recognition.

4. How cloud security companies are broadening their offerings to include stronger runtime protection, alongside more third party vulnerability ingestion for better prioritization. Cloud Security is finally evolving beyond CNAPP!

5. The marketing campaign that gets us all talking about it this year 🐶 🛋️ 🐐 

Can’t wait to see everyone there!

This is a major step forward in what automated remediation can be, and one I've actually seen working in my own environment - if you've actually tried to fix a container vulnerability you know how meaningless most tool provided solutions are. Things like bumping container versions or overriding packages are something teams only do in the most pressing circumstances, but are otherwise not the way most vulnerabilities get fixed.

Maze is the first example I've seen of usable fixes - suggesting rebuilding a container, switching to multi-step builds, removing unused components - all of the stuff that really makes a difference.

When we started Maze, we set out to show our customers which vulnerabilities actually matter. Today, we're launching remediation agents to tell you how to fix them.

AI-powered remediation isn't new, but it’s never been anything developers would really use. Most tools just tell you to “update to the latest version.”

That’s not a real fix. It ignores your environment, your dependencies, and everything that makes patching hard. 

So we set out to fix vulnerabilities the way a developer would.

Our AI agents trace every vulnerability to its root cause. Then they combine that root cause with context from your cloud, ticketing systems, vulnerability databases, and more to generate a fix that actually works in your environment.

Then they figure out who on your team should own the fix. And when something's blocking that fix today, you get mitigation options to reduce risk while you plan.

Want to see what Maze can help you fix? Link in the comments.

Today two companies announce funding that point to the future directions of AppSec: Raven.io (20M Seed) and Corridor (25M Series A).

Raven is taking a preventative approach to ADR, which is growing in importance due to AI vulnerability discovery and exploitability. Patching CVEs won't be enough for application protection in an age when attackers can scan for new exploits as fast as they used to look for historical ones.

Corridor is securing AI code generation by learning an organization's environment before generating and enforcing secure coding guardrails - making "secure by default" more the reality that we wanted it to be.

I'm excited for two companies to enter these emerging markets, if you're interested to understand more about these categories, check out the appsec report:

https://lnkd.in/eS7b2R9G

taplio

The Battle

Mathias Deloof

James Berthoty

Followers

Posts

Engagements

Likes

Performance ScoreMathias Deloof's LinkedIn Performance

Performance ScoreJames Berthoty's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Mathias Deloof

James Berthoty

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Mathias Deloof's LinkedIn Performance

Performance ScoreJames Berthoty's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreMathias Deloof's LinkedIn Performance