Aikido Security integration

"Bring code, container and cloud security findings into Brainframe — and link them to your risks, assets and compliance controls."
Connect Aikido.dev to Brainframe GRC, review open vulnerabilities at a glance, and import findings or monitored assets as native documents you can govern, track and evidence.

The Aikido.dev integration connects Brainframe to your Aikido workspace through the Aikido REST API. Once configured, you get a live security overview of your findings and monitored assets — and you can import any issue or asset as a Brainframe document so it can be linked to risks, non-conformities, supporting assets, controls and compliance requirements.

📌 This integration complements Brainframe DEFEND, which maps Aikido automated control checks directly onto compliance framework requirements. See Brainframe DEFEND (Aikido) for automated maturity on ISO 27001 and other standards. The integration browser described here is for importing individual findings and assets into your GRC web.

1️⃣ Before You Begin

To configure the integration you will need:

• 🛠 A Brainframe workspace administrator account (integration configuration is admin-only).
• 🔐 An active Aikido.dev account with access to create REST API credentials in your organisation settings.
• 📡 The REST API scopes listed below enabled on your Aikido API client — without them, specific tabs or asset categories will return errors or empty results.

⚠️ Aikido enforces API rate limits. Heavy use — especially searching across all issue pages — may temporarily return a rate-limit error. Wait a moment and use Refresh or Load more again.

2️⃣ Configure the Integration

Step 1 — Create REST API credentials in Aikido

1. Log in to Aikido.dev.
2. Open Settings → Integrations → REST API and create a new client named e.g. Brainframe GRC.
3. Set the App Type to Private.
4. Enable the scopes below, then create the credentials.
5. Copy the Endpoint, Client ID and Client Secret.

Required REST API scopes

📌 These are read-only scopes for browsing and import (clouds:write is required by Aikido for cloud inventory sync). Brainframe does not remediate or change findings in Aikido.

Step 2 — Enter credentials in Brainframe

Go to Workspace Settings → Integrations → Aikido.dev → Configure and fill in:

• Endpoint — defaults to https://app.aikido.dev/api/ (change only if Aikido provides a different API base URL).
• Client ID
• Client secret

Then:

1. Click Test connection. Brainframe validates the credentials against the Aikido API. The test must succeed before you can save.
2. Click Save. Credentials are encrypted at rest and are never returned to the browser after saving.

📌 To change or remove the connection later, return to the same Configure screen (gear icon on the integration page). Removing the integration deletes the stored credentials but leaves any already-imported documents intact.

🪪 Plan & scope limitations

Unlike directory integrations, Aikido does not use Microsoft-style licence tiers inside Brainframe. What you see depends on your Aikido subscription and the scopes enabled on your API client:

💡 If a tab is empty, check first in Aikido that the asset or scan type is actually monitored, then confirm the matching scope is enabled on your API client.

3️⃣ Using the Integration

Open the integration from Workspace Settings → Integrations → Aikido.dev (or the Integrations tile grid). Any workspace user can browse and import; only admins can edit credentials.

The gear icon opens credential configuration.

📊 Top cards (security posture at a glance)

Six cards summarise your current view. On the Issues tab, the first five cards reflect the active filters (severity, status, type and search) — so the numbers always match the table below.

📌 Cards use colour cues: Critical (red), High (orange), Medium (yellow), Low (blue). Use them to decide where to start triage and what to import first.

🗂 Tabs & sub-menus

Two main tabs organise everything below the cards:

⚠️ Issues

Your live vulnerability and misconfiguration register from Aikido — grouped findings across code, dependencies, secrets, cloud, containers, IaC and more.

Filters

• 🔎 Search — matches finding title, ID, type or repository (searches across all pages when a term is applied).
• Severity — All / Critical / High / Medium / Low.
• Status — defaults to Open; also All / Closed / Snoozed / Ignored.
• Type — All / Open Source (SCA) / Leaked Secret / Cloud / SAST / IaC / Docker Container / Cloud Instance / Surface Monitoring / Malware / EOL / Mobile / SCM Security / AI Pentest / License.
• 🔄 Refresh — reload the current list.

Table columns

Actions

• Click a row to open the finding in Aikido (new tab).
• Use Import on a row, or select multiple rows and Import selected.
• Load more at the bottom fetches the next page of results (100 per page).

🗄 Assets

Monitored infrastructure and code surfaces registered in Aikido. Switch between six sub-menus:

Search is available on Cloud assets, Code repos, Containers and VMs (not on Clouds or Domains).

Actions

• Click a row to open the asset in Aikido.
• Use Import per row or bulk-import via checkboxes.
• Load more fetches additional pages (50 per page).

4️⃣ Importing into Brainframe

Browsing is read-only until you import. Importing turns an Aikido finding or asset into a native Brainframe document with a live link back to Aikido.

How to import

• Single item — click Import on any row.
• Bulk — tick checkboxes and use Import selected in the toolbar.

The folder selection modal opens so you can pick the destination folder and confirm the document type (pre-filled from the mapping below). On confirm, Brainframe reports an outcome per item: created, updated, skipped (already exists) or failed. Re-importing the same object updates or skips it — you won't create duplicates.

Imported documents include a formatted summary (severity, status, scan metadata) and an Open in Aikido link. Issue groups refresh live from Aikido when you open the document; assets display the snapshot captured at import time.

What each object becomes (document-type mapping)

🔗 Import directly linked to a document

You don't have to start from the settings page. From any Brainframe document — a risk, non-conformity, asset, control, etc. — open the integration / link action and choose Aikido.dev. The browser opens scoped to that document, and anything you import is automatically linked to it (bi-directionally).

💡 This is the recommended workflow. For example:

• From a general risk ("Critical dependency vulnerabilities in production services"), import the matching Critical/High open findings so the risk shows exactly which CVEs or secrets it covers.
• From a non-conformity ("Unpatched container images in scope"), import the affected container assets and their open issues as evidence.
• From a primary asset (customer-facing API), import its code repository, cloud infrastructure and domain to complete the dependency chain.
• From a control (secure SDLC / vulnerability management), import representative findings to demonstrate control operation during an audit.

🤖 Brainframe DEFEND — automated compliance checks

Separately from manual import, you can attach Aikido automated control sets to compliance framework requirements (e.g. ISO 27001). This gives you a combined maturity view of manual controls + automated Aikido checks on your compliance dashboard and in audit exports.

Go to Compliance → Frameworks, open a requirement, and add an Automated control mapped to Aikido control groups. Full setup is documented in Brainframe DEFEND (Aikido).

5️⃣ Best Practices

• 🎯 Start from the Open + Critical/High filters — import what matters for your risk register and audit scope first.
• 🔗 Import from the document, not the settings page, whenever a finding relates to a specific risk, asset or non-conformity — automatic linking saves manual work.
• 🗄 Register assets before findings when building a new scope — import clouds, repos and containers as supporting assets, then link the vulnerabilities that affect them.
• 🔄 Re-import to refresh — existing documents are updated, not duplicated, when Aikido data changes.
• 📋 Pair manual import with DEFEND — use imported vulnerabilities for granular remediation tracking, and DEFEND automated controls for framework-level maturity reporting.
• ⏱ Avoid rapid repeated searches — searching issues fetches all pages from Aikido; use filters first, then search within a narrowed set.

6️⃣ Troubleshooting

• Test connection fails → verify Endpoint, Client ID and Client Secret; confirm the API client is Private and scopes are enabled in Aikido.
• Issues tab is empty → check the Status filter (defaults to Open); switch to All Statuses or confirm scans have run in Aikido.
• An asset sub-menu is empty → confirm that asset type is connected and scanned in Aikido, and that the matching read scope is enabled on your API client.
• Rate limit exceeded → wait briefly and retry; avoid repeated full-text searches in quick succession.
• Imported issue looks outdated → open the document to trigger a live refresh from Aikido, or re-import the finding.
• DEFEND controls show no automated data → configure credentials via the automated-control flow on the requirement (see DEFEND article); the integration browser and DEFEND share the same Aikido credentials once saved.

🎯 Visual Checklist

• REST API client created in Aikido with required scopes
• Endpoint, Client ID and Client Secret entered in Brainframe
• Test connection passed and saved
• Critical/High open findings reviewed
• Key assets (repos, clouds, containers) imported and linked
• Findings imported and linked to relevant risks / non-conformities
• DEFEND automated controls mapped to framework requirements (optional)

💬 Need help? For Aikido REST API details, open Aikido REST API settings. For Brainframe DEFEND and automated controls, see Brainframe DEFEND (Aikido). For anything else, contact us at support@brainframe.com.

Updated on: 14/07/2026