Drata and Aikido: audit-ready pentesting, built into your compliance workflow

New Drata customers on any tier — Foundation, Advanced, or Enterprise — can claim an Aikido AI Pentest worth up to $4,000 in credits, with findings and evidence syncing directly into Drata, the two companies announced. Aikido said setup takes less than 20 minutes and produces an auditor-ready report about a business day later, and each pentest through the offer includes 6 months of unlimited retesting. Aikido cited its State of AI in Pentesting report finding that 76% of leaders surveyed deploy significant production changes weekly or faster while only 21% validate security on every release, and that 42% delay retesting because of cost or scheduling.

Continuous control monitoring and a once-a-year, point-in-time pentest don't sit well together. A manual test means scoping, waiting for a slot, and holding up the audit window for the report. Teams choose Drata https://drata.com to get audit-ready quickly: controls monitored continuously, evidence collected automatically. The pentest is the part that doesn't move at that speed. And it stays a snapshot: in our State of AI in Pentesting report https://www.aikido.dev/state-of-ai-pentesting , 76% of leaders surveyed said they deploy significant production changes weekly or faster, but only 21% validate security on every release. Drata and Aikido are closing that gap. New Drata customers can now claim an Aikido AI Pentest, complete with verified findings, an auditor-ready report, and results that sync straight into Drata. What Drata and Aikido now do together Aikido runs the checks and generates the evidence behind Drata's technical controls, including SOC 2, ISO 27001, PCI DSS Payment Card Industry Data Security Standard , DORA the EU's Digital Operational Resilience Act , and HIPAA. Findings, and the evidence behind them, sync into Drata without anyone exporting a spreadsheet. Fix something in Aikido and the Drata side updates with it, so audit prep stops depending on someone remembering to do that the week before the audit. That now extends to pentesting specifically. Every Drata Tier Foundation, Advanced, and Enterprise includes an Aikido AI Pentest worth up to $4,000 see How to claim it for more information . That now extends to pentesting. New Drata customers on any tier Foundation, Advanced, or Enterprise get up to $4,000 in free Aikido AI Pentest credits, typically enough for a standard pentest https://www.aikido.dev/attack/aipentest of a smaller app. Larger apps still get meaningful findings and can add credits for full coverage. The setup takes less than 20 minutes, and about a business day later you get an auditor-ready report. Here’s a sample report https://26076760.fs1.hubspotusercontent-eu1.net/hubfs/26076760/Content%20Marketing/ACME-Corp-pentest-audit-report-5401.pdf so you can see exactly what you’d hand to your auditor. Why the report holds up with an auditor A pentest is only useful if an auditor actually accepts it. Aikido's agents test the app, its APIs, and the infrastructure behind them the way a human pentester would. The difference is what happens after a finding comes in: a separate agent re-exploits it before it's reported, so what makes it into the final write-up is a working proof of concept rather than a probabilistic guess. In the same report mentioned above, 40% of leaders said they'd feel more confident defending reproducible system evidence in an audit than a pentesting firm's reputation 26% , with a further 34% weighing both equally. Auditors increasingly want to see the work itself, rather than take someone's word for it. For context, an independent Doyensec benchmark https://www.aikido.dev/reports/aikido-vs-xbow found Aikido identified 58% more verified vulnerabilities than XBOW at the same price tier. Worth knowing if you're comparing pentest tools directly, though it's a product comparison rather than an audit-acceptance one. The fix needs proof too An auditor doesn't just want to see that an issue was found. They want evidence it was fixed. That's where most pentesting quietly falls apart: only 40% of leaders say they retest promptly after a fix, and 42% delay because of cost or scheduling, often past the audit deadline. Every Aikido AI Pentest through this offer includes 6 months of unlimited retesting, so a fix can be verified the same week it ships instead of waiting on the next scheduled engagement. How to claim it New Drata customers on a Foundation, Advanced, or Enterprise plan can claim an Aikido AI Pentest here https://www.aikido.dev/use-cases/drata-integration . Redeemable within the first 3 months of your Drata plan start date, or for Drata deals currently in progress. Existing Aikido customers aren't eligible. Not a Drata customer yet? Start with a demo https://drata.com/demo to learn more. Let’s get started Compliance evidence and security testing end up running on the same clock instead of two separate ones. If you want the fuller picture behind these numbers, our State of AI in Pentesting report https://www.aikido.dev/state-of-ai-pentesting has the rest of the data.