AAikido Infinite

Aikido Infinite Turns Each Code Change Into a Pentest

In a survey of 500 security and engineering leaders run by Aikido, 76% said they ship significant production changes weekly or faster, while only 21% validate security on every release. Aikido Infinite, launched on February 24, 2026, is the company’s answer: AI agents that pentest each change on deploy, exploit what they find, open a fix pull request and retest.

Infinite suits software teams that deploy often and want security testing to keep pace. It costs $10 per agent, with each agent running up to 30 minutes, so the bill follows the volume of security-relevant code. Human testers are still needed for non-web systems. Infinite scores 9.2/10 on our scale.

Aikido’s Funding, Customers and Pentest Survey Numbers

The launch coverage, the Series B report, Aikido’s product page and G2 supply these facts.

The survey numbers frame the product. If 85% of leaders say pentest findings are stale by the time the report arrives, a test that runs on each deploy addresses a real complaint. The survey was run by Aikido, though, so it reflects the vendor’s own sample.

The growth figures matter for a buyer weighing a young vendor. Fivefold revenue growth, a $1 billion valuation and 180 staff suggest Aikido has the money to keep developing Infinite. Its own team ships more than 60 deployments a day, the kind of pace Infinite is designed for.

How an Aikido Infinite Run Moves Through a Deploy

Infinite plugs into the deployment pipeline and runs whenever new code lands. Aikido describes three steps.

Trigger on Deploy

When code ships, Infinite analyzes the diff and launches a pentest scoped to the changed code and the surfaces it affects. Diffs with no security relevance, such as large JSON files or unit tests, are ignored.

Exploit Every Diff

Specialized agents try every attack route they can find, including undocumented endpoints, hidden logic paths, multi-step edge cases and architectural anomalies. They use context from Aikido’s code-to-runtime platform: source code, application architecture and internal logic flows. Aikido reports a finding only after the agent has exploited it. The engine is model-agnostic and combines AI with Aikido’s own exploit validation and controlled runtime execution.

Patch and Retest

For each confirmed vulnerability, Infinite opens a merge-ready pull request with a code-level fix, where Aikido judges the fix safe to apply. Developers review and merge it, then trigger a retest to confirm the risk dropped. Infinite also learns from each finding and feeds lessons back to developers before they commit.

Setting Up Continuous Testing

Continuous mode needs two things first: an initial assessment of the application and a connection to the repositories Aikido will watch. Aikido offers a CI/CD guide and git integrations for the hookup. A standalone AI pentest, run against a target the team defines, needs no repository connection at all.

A Pull Request With a New Endpoint, Step by Step

A developer merges a change that adds an API endpoint for exporting invoices. On deploy, Infinite reads the diff and sends agents at the new endpoint and the code paths it touches. One agent finds that the export skips a tenant check and pulls another customer’s invoice. Since the exploit worked, Infinite reports it, opens a pull request adding the missing check and waits. The developer merges the fix, the retest confirms the endpoint now refuses the request, and the finding closes.

What Aikido Infinite Costs per Agent and per Month

Aikido prices Infinite by agent runs. The table lists what the product page publishes.

Three Monthly Testing Budgets Worked Out

The calculator in the app estimates agent counts from a team’s last 30 days of diffs. Using the $10 rate, a team whose changes call for 25 agents a month pays $250. A busier team at 100 agents pays $1,000 a month, or $12,000 a year. A platform with many services at 300 agents a month pays $3,000, or $36,000 a year.

Compare that with point-in-time testing. Four on-demand XBOW pentests a year at $4,000 each cost $16,000. The 100-agent Aikido budget comes in under that and tests every change. The comparison is rough, since XBOW prices a full test and Infinite prices agent runs, but the order of magnitude helps a budget owner. The trade-off is that Infinite’s scope follows code changes, while a scheduled pentest looks at the whole application at once, so many teams will run both.

Aikido Infinite Against XBOW, NodeZero and Qodo

XBOW and NodeZero are AI pentest agents. Qodo reviews code before merge. All four aim to catch flaws before attackers do.

Infinite and Qodo sit at different points in the pipeline: Qodo reviews code before merge, and Infinite attacks it after deploy. NodeZero covers networks and infrastructure, which Aikido says still need other testers. XBOW suits teams that want a full scheduled test with a report. See our cybersecurity agents for more choices.

Where Infinite Sits in the Aikido Platform

Aikido started as a developer-first security platform that finds, ranks and fixes issues across code, cloud and runtime. Aikido Attack added on-demand AI pentests with hundreds of specialized agents. Infinite takes the same agents and runs them on every deploy. A team can use the scanners for known patterns, Attack for a full on-demand test and Infinite for each change.

Audit Evidence and Certifications Behind Infinite

Aikido’s Infinite page shows badges for SOC 2, ISO 27001, ISO 42001 and FedRAMP authorization. ISO 42001 covers how an organization manages AI systems, which is relevant for a product built on AI agents.

For customers, the more practical point is the report format. Aikido says Infinite reports are structured to meet SOC 2 and ISO 27001 requirements, so findings and fixes can go into an audit file. When an auditor insists on a human tester, Aikido’s CREST accreditation lets it supply a human-led pentest. Security leads should still confirm with their auditor that continuous AI testing counts toward the pentest control they need.

Security Teams That Gain Most From Infinite

Infinite fits companies that deploy web applications many times a week and cannot afford a human pentest for each release. Fintech and SaaS teams, where a broken access check can expose customer data, gain the most from testing on every change.

It also suits teams heading into SOC 2 or ISO 27001 audits. Aikido says its reports are structured for those standards, and its CREST accreditation means a human-led test can be added when an auditor asks for one. Existing Aikido customers have the shortest path, since Infinite runs on the same platform they already use.

Product teams building with AI coding agents are a newer fit. When agents write more of the code, changes arrive faster and in larger batches, and a test on each deploy keeps pace in a way a quarterly pentest cannot.

When Infinite May Not Be the First Purchase

Organizations whose main exposure is networks, devices or other non-web targets should start with a tool built for those, since Aikido itself says human testers remain useful there. Teams that deploy rarely may get more from a scheduled pentest once or twice a year.

Teams that need a pentest of the whole application for a customer or regulator should note how Infinite scopes its work. Each run tests changed code and the surfaces it affects. A full-application test is the job of Aikido Attack or a human-led engagement.

Very small teams should check costs against their budget. Some G2 reviewers say Aikido’s upgrades are expensive for micro businesses, and Infinite adds usage on top. Running the calculator against a month of real diffs gives a firm number before committing.

Five Questions to Put to Aikido Before Turning On Infinite

First, which environment do the agents attack? Most teams will want Infinite pointed at staging, with production left to scheduled tests. Second, what data can an agent touch during an exploit, and how is test data cleaned up afterward? Third, who approves the fix pull requests, and can branch protection stop agents from merging on their own?

Fourth, how many agents did the calculator estimate for the last 30 days, and how much did that number vary week to week? Fifth, how does Aikido handle a finding the team disputes? Clear written answers will make the security review and the budget request faster.

Dashboard, Integration and Pricing Themes in G2 Reviews

Aikido Security holds 4.5 stars from 272 G2 reviews of its platform. Ease of use leads the praise with 78 mentions, followed by security coverage, the dashboard, integrations such as GitLab, and setup.

The complaints center on depth and price. Reviewers ask for more advanced features, such as deeper analysis and dark mode, and for richer compliance reporting. Others say pricing is high for micro businesses and that upgrades are steep. Infinite itself is newer, and Aikido could publish customer results, such as exploits found and fixed per month, to show how it performs.

Aikido’s Run of 2026 Launches

• January 14, 2026: Aikido raises a $60 million Series B at a $1 billion valuation, led by DST Global.
• February 24, 2026: Aikido Infinite launches as continuous, self-remediating AI penetration testing.
• 2026: the Infinite product page publishes $10 per-agent pricing and an in-app usage calculator.

Aikido Infinite Scores High for Closing the Loop

Infinite scores 9.2/10. It leads on autonomy and trust: agents find, exploit, patch and retest on their own, and the product page lists SOC 2, ISO 27001, ISO 42001 and FedRAMP. Pricing is published per agent, though monthly totals move with code volume. Setup takes an initial assessment and repository access.

For a team shipping web code every week, Infinite brings pentesting into the deploy pipeline at a known unit price. Run the calculator on last month’s diffs, start with one application and keep a periodic full pentest for broader coverage.

Questions AppSec Leads Ask About Aikido Infinite

When Did Aikido Infinite Launch?

Aikido unveiled Infinite on February 24, 2026, about six weeks after its $60 million Series B.

How Much Does Aikido Infinite Cost?

$10 per agent, with each agent running up to 30 minutes. A calculator in the app estimates agents from the last 30 days of code changes, and irrelevant diffs are skipped at no charge.

Does Infinite Report False Positives?

Aikido says Infinite reports a finding only after an agent has exploited it, which is meant to remove unconfirmed alerts.

Does Infinite Fix Vulnerabilities on Its Own?

It opens a merge-ready pull request with a code-level fix where it judges the fix safe. A developer reviews and merges it, then triggers a retest.

Can Infinite Replace a Human Pentest?

Aikido says human testers remain valuable for non-web targets and highly contextual edge cases. It offers CREST-accredited human-led tests when auditors require them.

How Does Infinite Differ From Aikido Attack?

Aikido Attack runs an on-demand AI pentest against a target you define. Infinite runs continuously, triggered by each code change, and needs an initial assessment and a repository connection.

Which Companies Use Aikido?

Aikido names Revolut, SoundCloud, Niantic, the Premier League, Pendo, Deel, Visma, n8n and Lovable among more than 100,000 teams on its platform.

Does Infinite Need Access to Our Source Code?

Continuous mode needs a repository connection to spot security-relevant changes. Standalone AI pentests work without it, but Aikido says connecting source code improves results.