Oryon Flow vs Aikido Attack

1. 01

   Repairs against prior acceptance criteria

   Flow establishes criteria on the original and checks candidate security and legitimate behavior before delivery.

2. 02

   The laboratory belongs to the journey

   Flow prepares the application and its tests in ephemeral environments; documented Aikido setup uses a customer-provided test deployment.

3. 03

   From evidence to each requirement

   Flow evaluates retained evidence and shows technical changes projected from verified PRs, alongside the findings themselves.

Capabilities, side by side.

The table describes documented features; it does not measure performance or detection quality. Commercial features may depend on product, plan and configuration.

What you need	Oryon Flow	Aikido Attack
Repository investigation	✓Documented Source, packages, infrastructure and runtime connected in one investigation.	+Optional / plan dependent Connecting repositories is optional; it adds application logic, route and architecture context. ↗
Reconstructed test environment	✓Documented Rebuilds the application in ephemeral, isolated environments from the original repository.	—Not documented in this scope Documented setup asks the customer to provide a testing environment and accounts. ↗
Finding verification	✓Documented Independently reviewed proof method: confirmed, refuted or inconclusive. Missing proof remains an open question.	✓Documented Additional agents validate each finding and confirm exploitability. ↗
Fixes backed by tests	✓Documented Isolated candidates; checks security and legitimate behavior before an independent review.	+Optional / plan dependent AutoFix generates targeted changes; the documented flow confirms the repair through a retest after applying it. ↗
Reviewable pull requests	✓Documented Groups changes by cause and compatibility into reviewable PRs. Your team decides the merge.	+Optional / plan dependent AutoFix can create PRs for the team to review and merge; source context is needed. ↗
Traceable technical evidence	✓Documented Links proofs and changes to technical requirements; compares current evidence with the projection from verified PRs.	✓Documented Technical, auditor and management reports, post-remediation status and letters of attestation. ↗
Source + runtime analysis	✓Documented Connects source, dependency, infrastructure and dynamic observations in the same investigation.	↗Another suite product Attack uses source context and live testing; dedicated SAST and SCA belong to the code security suite. ↗
Authenticated role testing	✓Documented Checks legitimate sessions, roles and tenant boundaries; unreachable or expired sessions remain coverage gaps.	✓Documented Tests role boundaries, cross-tenant access, IDOR and authenticated business workflows. ↗
Separate validation	✓Documented The proposing agent does not approve its own conclusion or fix; a separate verification step evaluates retained evidence.	✓Documented Additional agents reproduce candidate findings against the target before reporting them. ↗
Functional regression checks	✓Documented Compares security proofs, legitimate controls and available functional tests with the original before delivery.	—Not documented in this scope Attack retests fixes and bypasses; pre-delivery functional regression controls are not established here. ↗
Dependency fixes	✓Documented Repair candidates can update the dependency graph and adapt application code, subject to validation.	↗Another suite product Dependency and bulk AutoFix are documented in Aikido code security, beyond a standalone Attack assessment. ↗
Technical requirement mapping	✓Documented Links retained evidence to selected technical requirements and shows current versus proposed coverage; this is not organizational certification.	↗Another suite product Attack provides audit reports; the wider suite adds compliance reports and GRC integrations. ↗

Product scope