Aikido is the no-nonsense security platform for developers. The all-in-one security platform that covers you from code-to-cloud and helps you get security done. Engineering teams execute faster with Aikido thanks to centralized scans, aggressive false positive reduction, automatic risk triaging & fixing, risk bundling, and easy step-by-step risk fixes. Aikido makes security simple for SMEs and doable for developers, so companies can win customers, grow up-market, and ace compliance. Don’t just get security done fast, get it done automatically.

Get started for free: https://app.aikido.dev/ 
No strings attached.

Mathias Deloof

10+ years in engineering and security before founding Latio Tech to help security engineers cut through the marketing noise and find the technical details of products.

I have a passion for driving security teams as contributors to product (the true meaning of DevSecOps) and built Latio Tech to help connect people with the right products.

James Berthoty

Three cool announcements this week:

1. Aikido Security hitting the billion dollar valuation. If you can sell security to mid-market, it proves you're selling something of value. The team here is focusing only on what moves the needle for the 99%. Combined with their big findings in open source malware and early bet on AI pen-testing, Aikido has a great future ahead.

2. I'm thrilled to be hosting a new podcast from Exaforce called "SecOps Confidential." I've been given complete editorial freedom with this, so this isn't just vendor sales pitching. The goal is to give teams actionable advice for teams scaling their security programs. The first episode was with Patrick McKinney from Invisible Technologies, talking about how to think about starting your SecOps program, and when building vs. buying vs. both makes the most sense. I'm super excited for the next episode as well, you can check it out here: https://lnkd.in/e3kSPMk4

3. ARMO's partnership with Rapid7. More established security companies have long needed to bolster their runtime cloud security offerings - most products I've tested continue to do a disservice to platform teams trying to take their runtime detection capabilities seriously. This is exactly the purpose of CADR, and the CTEM (vulnerabilities) + CADR (runtime) storyline is the ideal scenario.

AI SAST is a new functionality, so there are many vendors saying they have it but offering different capabilities. From the tools that I've tested, there are at least four different kinds of "AI SAST," each of which is pretty different in terms of impact, potential, and capabilities.

1. AI based prioritization analysis. This has existed for about two years, and can have some decent false positive reduction effects, even if it's not perfect. In my experience this feature is good but overhyped, as most vendor agents don't have enough understanding of your overall architecture or code base to make a great call on the use case and risk assessments.

2. Having LLM's write and execute queries in a vendor's query language in order to investigate new security issues based on organizational context. While this has the benefit of an objective output, it in my opinion limits the potential of what LLM's can do by limiting the amount of context they have access to, and types of vulnerabilities they can find.

3. Using MCP or the new Cursor hooks to have agents run a code scanner on newly generated code. While I think this workflow is inelegant in general, calling it AI SAST is the closest to disingenuous, as it's just running a SAST scan on AI code the same way an IDE plugin would, and giving the results to the AI. I don't like this approach because if traditional SAST scanners are so noisy developers turn them off in their IDE, why would we slow down AI coding by giving them the same ineffective tools? I'm a bigger fan of the secure rules approach.

4. When I say AI SAST, I'm referring to LLM's utilizing various code intelligence tools, like how Cursor works, to discover novel vulnerabilities in your code base. In my experience, this is the only approach that leads to a truly generational improvement in SAST findings.

Great product in a strong niche. Rare to have a one of one solution in 2025, but others are clearly building in their direction. 

If you're wondering what Koi does, it was unique enough that we wanted to write an article on the problem space when they came out of stealth here: https://lnkd.in/ebk7jfiE

Palo Alto Networks in negotiations to acquire one-year-old Israeli startup Koi for $400 million.

The deal would extend the cyber giant’s reach in enterprise endpoint protection amid AI-driven market shifts.
https://lnkd.in/dNEY5JWH

Open article: Palo Alto Networks in negotiations to acquire one-year-old Israeli startup Koi for $400 million | CTech by calcalistech.com

Palo Alto Networks in negotiations to acquire one-year-old Israeli startup Koi for $400 million | CTech

We are early in the tipping point of running an agentic security code review in pipeline rather than traditional static code analysis, this will fundamentally change how teams think about shift left programs and what they mean. 

On the one hand, this is a radical shift, as in-pipeline scanning was the defining feature of the last ten years of application security. On the other hand, it doesn't address a number of other things application security engineers do, or other potential security issues:

1. Addressing backlogs
2. Finding new unique issues
3. Threat modeling and design review
4. Giving agents more context to produce secure code

So while application security is fundamentally changing, I think we're a far cry away from traditional scanning and processes being obsolete; rather the focus will shift away from pipeline scanning features as agents handle the code analysis part.

I do my best to only share legitimately helpful vendor resources, and this CADR for dummies book from Oligo Security does a wonderful job breaking down what I view as the future of runtime protection in more detail. Solutions in this category continue to represent the best cloud workload protection an organization can get by introducing the missing application layer to detecting attacks. As web application and supply chain attacks continue to increase, this layer of runtime protection is essential.

Open article: CADR for dummies® | Cloud Application Detection and Response by oligo.security

CADR for dummies® | Cloud Application Detection and Response

IT Helpdesk or ITOps roles are some of the most overlooked roles in implementing cloud and application security practices, and they're rarely considered the way they should be. This is especially true in SMB and midmarket companies, where they end up doing a lot of the work that larger enterprises have entirely separate teams for. They serve as the daily managers of many security tools such as:

1. SASE - managing allowlists and policy exemptions
2. SSO - responsible for access reviews and onboarding/offboarding
3. MDM - enforcing endpoint security controls
4. Cloud - often responsible for day to day permissions controls and group access
5. Apps - managing internal applications and permissioning

The technical sophistication of these teams continue to grow, and it's essential to include them in your security planning - both from a roadmap perspective, and from a threat modeling one, as one missed permission can be as good a front door as any. While a lot of attention is placed on security and developer relationships, this one is just as important - it just tends to be more organic as the CIO and CISO are often given similar purviews.

taplio

The Battle

Mathias Deloof

James Berthoty

Followers

Posts

Engagements

Likes

Performance ScoreJames Berthoty's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Mathias Deloof

James Berthoty

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}James Berthoty's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreJames Berthoty's LinkedIn Performance