Doyensec independently benchmarked Aikido and XBOW at the same $4,000 price tier across two real open-source applications, selected at random from 442. Every finding manually validated by a senior researcher, with peer review. Aikido the research. Doyensec ran it.
Aikido found 49 verified vulnerabilities. XBOW found 31. Same price, same applications, 58% more coverage. High/Critical: 9 vs. 5. Low/Medium: 32 vs. 18. The two tools overlapped on only 3 findings across two randomly-selected open-source applications (Fider and Photoview). The advantage is broader detection, not just more volume.
Source code access determines what you can find. XBOW tests from the outside, with no code context. Aikido ingests your codebase before testing. IDORs, authorization failures, and logic abuse paths only become visible when you understand how the application works from the inside. That is what code access gives you.
Setup took 20 minutes. The report was same-day. Aikido was running on both applications in under 20 minutes, self-serve. No contracts, no calls. XBOW required a sales representative and a DocuSign contract before scanning could start. The Fider report arrived 11 days after the engagement began.
One retest or unlimited: the gap is significant. XBOW includes one retest within 30 days. Aikido offers unlimited retests, free, with results in minutes. XBOW's engagement also required 22+ support emails, three scan restarts, and two infrastructure outages. Aikido had none.
Both tools found real vulnerabilities. Aikido found more verified issues, delivered results faster, and required materially less effort. The gap is not in false positives or severity accuracy, which were nearly identical at 4% vs. 3% and 69% vs. 68%. It is in coverage and what you have to go through to get there.
What independent benchmark data reveals AI pentesting coverage, setup complexity, and what your money actually buys.
Aikido found 49 verified vulnerabilities. XBOW found 31. Same price, same applications, 58% more coverage. High/Critical: 9 vs. 5. Low/Medium: 32 vs. 18. The two tools overlapped on only 3 findings across two randomly-selected open-source applications (Fider and Photoview). The advantage is broader detection, not just more volume.
Source code access determines what you can find. XBOW tests from the outside, with no code context. Aikido ingests your codebase before testing. IDORs, authorization failures, and logic abuse paths only become visible when you understand how the application works from the inside. That is what code access gives you.
Setup took 20 minutes. The report was same-day. Aikido was running on both applications in under 20 minutes, self-serve. No contracts, no calls. XBOW required a sales representative and a DocuSign contract before scanning could start. The Fider report arrived 11 days after the engagement began.
One retest or unlimited: the gap is significant. XBOW includes one retest within 30 days. Aikido offers unlimited retests, free, with results in minutes. XBOW's engagement also required 22+ support emails, three scan restarts, and two infrastructure outages. Aikido had none.
Both tools found real vulnerabilities. Aikido found more verified issues, delivered results faster, and required materially less effort. The gap is not in false positives or severity accuracy, which were nearly identical at 4% vs. 3% and 69% vs. 68%. It is in coverage and what you have to go through to get there.
What independent benchmark data reveals AI pentesting coverage, setup complexity, and what your money actually buys.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
