Aikido Security

Overview

A scanner finding with no owner is the one your auditor asks about. Scrut connects to Aikido Security through Aikido’s Public REST API with read-only access and brings your findings into the Third-Party Scans page in Vulnerability Management. Each finding arrives with its severity, its CVE where one exists, and the assets it affects. Your team can assign an owner, track status, and close it out in the same platform that runs your compliance program. Scrut syncs every 24 hours, and you can run a manual sync whenever you need fresh data.

Why connect

• Work the critical findings first: Severity arrives with every finding, so your team can sort the queue and start each sprint with the issues that carry the most risk.
• Put a name on every critical finding: Assign an owner and track each finding through remediation, so critical issues don’t sit unclaimed between scans.
• Answer vulnerability questions from live data: When an auditor or a customer questionnaire asks how you manage vulnerabilities, answer from Scrut. Findings, owners, and status sit in one place, with no exports or spreadsheets.
• Read-only by design: Scrut requests read scopes only, so it can’t change anything in your Aikido workspace.

What syncs from Aikido

• Vulnerability findings from your Aikido workspace, including finding names
• Severity for each finding
• CVE identifier, where applicable
• Affected assets
• A Source: Aikido filter on the Third-Party Scans page, so you can view Aikido findings on their own

Go deeper with the enhanced vulnerability view 

• CVSS score and last scanned date, so you can show how current your data is
• A full treatment plan for each finding
• The complete list of affected resources, with a resource-level view
• Standardized severity across scanners, so Aikido findings sit alongside findings from your other scanners on one scale

How to connect

You’ll need an Aikido account that can create an API client, and Scrut Admin access or Contributor access to the Integration module.

1. In Aikido: Add a client under Settings → Integrations → Public REST API, with the three read scopes.
2. In Scrut: Open Integrations → Integrations Library, find Aikido under Vulnerability Scanners, and add your Client ID and Client Secret.
3. Authorize: Confirm your workspace and permissions in Aikido.

Aikido shows the client secret only once, so copy it before closing the dialog.‍

See the Aikido setup guide