Detectify vs Aikido
Aikido brings code, cloud and runtime security into one platform for developers, while Detectify tests your web apps and APIs with payloads built with ethical hackers.
Last updated 14 October 2026
| Detectify | Aikido | |
|---|---|---|
| How tests are built | Payload-based tests, including 1,765+ Crowdsource modules from ethical hackers | Non-intrusive Quick Scan checks, REST and GraphQL fuzzing, and AI agents that run pentests (Agentic Scan)* |
| Attack surface monitoring | Subdomains, IPs and IP ranges, open ports and technologies, plus subdomain takeover checks every 8 hours | Subdomain enumeration, IP resolution, TLS and exposed-server checks, darknet credential monitoring, plus subdomain takeover detection* |
| Ports monitored | Around 8,500 ports per target | Flags open ports exposed to the internet, highlighting management, file sharing and database ports* |
| Web app scanning | Headless Chrome crawler with full SPA support | Quick Scan checks front-end security best practices with safe, non-destructive tests. Deeper web app testing runs as an AI pentest* |
| Authenticated scanning | Basic, Recorded Login and Recorded Crawling | Form login with OTP, custom headers and AI-agent login (beta). Not on the Free plan. Microsoft and Google SSO not supported* |
| API scanning | OpenAPI v2, v3, v3.1 and GraphQL. OAuth, Basic and API key | REST (OpenAPI spec) and GraphQL fuzzing, run on staging. OAuth, Basic Auth and custom headers. Pro and Advanced plans* |
| Internal scanning | Internal Scanning, deployed with Terraform (AWS) or Helm. Outbound-only connection | Aikido Broker runs inside your network so AI pentests can reach internal apps* |
| Cloud configuration checks | Not covered. DNS connectors import assets only | CSPM checks AWS, Azure and GCP accounts for misconfigurations, plus Kubernetes and infrastructure as code* |
| Emerging threats | New Crowdsource tests for newly disclosed vulnerabilities | Aikido Intel flags new malware and vulnerabilities in open-source packages, used for code and dependency scanning* |
| Integrations | Jira (two-way), Slack, Microsoft Teams, PagerDuty, Opsgenie, ServiceNow, Splunk, webhooks, Workato, REST API | Jira, ServiceNow, Linear, ClickUp, Azure DevOps Boards, GitHub and GitLab Issues, Asana, Slack, Microsoft Teams* |
| Free trial | 2 weeks | Free plan, with authenticated and API scanning on paid plans* |
Detectify helps 10,000+ users manage their attack surfaces
Which one fits your team
Detectify
Choose Detectify if
- Your biggest risk sits in internet-facing web apps, APIs and subdomains
- You want testing that goes beyond known CVEs
- You want attack surface monitoring and application testing in one platform
Aikido
Choose Aikido if
- You want code, cloud and runtime security in one platform, including SAST, SCA and CSPM
- You want AI agents to run pentests on demand, with pentest-style reports for SOC 2 and ISO
- You want an in-app firewall that blocks attacks at runtime
Why teams choose Detectify
400+
400+ ethical hackers in Crowdsource submit payloads for vulnerabilities they find in the wild
- Crowdsource ethical hackers submit payloads for vulnerabilities they find in the wild
- 1,765+ modules run against the assets you add
- New tests ship when a vulnerability is disclosed, as with Log4Shell on the same day
- Maps subdomains from certificate transparency logs, DNS enumeration and brute-forcing
- Checks your subdomains for takeover every 8 hours, including GCP bucket takeover
- DNS connectors pull in assets from AWS, Azure, GCP, Cloudflare and more
- Crawls your app in a real browser, so JavaScript and single-page apps get tested
- Basic access authentication, recorded login and recorded crawling
- Technology fingerprinting picks the tests that fit your stack
Crowdsource from submission to test
01
Ethical hacker submits a payloadCrowdsource · path traversal
GET /static/..%2f..%2f..%2fetc/passwd
02
Reviewed, then shipped as a test moduleJoins 1,765+ modules
03
Finding
trade.go-hack-yourself.netPath traversalHigh
Surface Monitoring subdomain takeover
01
New subdomain foundCertificate transparency logs
promo.go-hack-yourself.net CNAME deprovisioned cloud resource
02
Checked for takeoverEvery 8 hours
03
Finding
promo.go-hack-yourself.netSubdomain takeoverHigh
Application Scanning recorded login
01
Login recorded onceDetectify Recorder, a Chrome extension
RECtrade.go-hack-yourself.net/logindemo@go-hack-yourself.net••••••••••Sign in
02
Crawled like a person, still logged inHeadless Chrome · clicks buttons, fills forms
03
Finding
trade.go-hack-yourself.net/accountXSSHigh
“Our domains are part of our brand and our attack surface. Detectify gives us an outside-in view of every service running under them, including the ones vendors host for us.”
FAQs
Yes, for teams whose main risk is internet-facing web apps, APIs and subdomains. Detectify monitors your external attack surface and tests applications with payload-based tests. Aikido is an all-in-one platform for code, cloud and runtime security, with DAST, attack surface monitoring and AI pentesting as part of it.
How the tests are built. Detectify's tests come from its own research and from Crowdsource, a program of ethical hackers who submit payloads for real vulnerabilities. Aikido's DAST combines non-intrusive checks, API fuzzing and AI agents that run pentests.
Yes. API Scanning tests the operations you choose in an OpenAPI v2, v3 or v3.1 spec or a GraphQL schema that you import. It supports OAuth, Basic and API key authentication.
Yes. Internal Scanning runs inside your network and connects outbound only. You deploy it with Terraform on AWS or with Helm.
Yes. Application Scanning supports Basic authentication, Recorded Login and Recorded Crawling.
Pricing depends on the products you use and how many assets you cover. Surface Monitoring is priced by the number of domains in scope, and Internal Scanning by the number of internal apps. Start a 2-week free trial, or talk to sales for a quote.
Yes. They run independently, so you can use Aikido for code and cloud security and Detectify for your web apps, APIs and external attack surface.
See Detectify on your own domains
Start a free trial, or book a demo to walk through Detectify with our team.