Rheono vs Aikido: a flat monthly pentest, or pentest credits inside a security platform

Verdict

Rheono wins when the job is to prove what an attacker can do to one web app and its API, for a flat monthly price that more pentests do not raise. Starter is one full pentest a month for €99, and Growth tests continuously for €499 a month.

What Aikido is

Aikido Security lists its European HQ in Ghent, Belgium, and sells an application security platform. Its homepage groups the product into four areas: code (dependency and static analysis, secrets detection), cloud (posture management, container images, infrastructure as code), attack (AI pentesting, DAST, API scanning) and protect (runtime and bot protection). Pentesting is one of the four.

Aikido Pentest is described as an agentic, AI-powered penetration testing platform for applications, APIs and infrastructure. It maps the attack surface black-box, by scanning, or white-box, from your code and OpenAPI specs, and it runs additional agents to confirm that a finding is exploitable.

Aikido sells pentests for credits. On its pentest pricing page, one credit equals one US dollar and a Standard Pentest of one application and its main APIs costs 4,000 credits. The public pricing page lists a Typical Pentest of the same scope at €3,500. A rightsized pentest is priced from the repositories you link, and continuous pentesting charges 10 credits for each agent that runs.

What Aikido does better

More of the security program in one account. Aikido can scan your repositories, dependencies, containers and cloud accounts, protect the running app, and run a pentest. Rheono does the pentest part only.

Wider pentest scope. Aikido's homepage lists network, mobile and on-prem pentesting next to web apps and APIs. Rheono tests external web apps and APIs; internal networks and mobile binaries are outside its scope.

Nothing to pay before the first run. Aikido's run now, pay later starts a first full assessment of up to 8,000 credits on pending credits, and waives them if no High or Critical turns up. Rheono's guarantee works the other way round: you pay the flat fee first and get it back if the pentest finds no validated High or Critical in the agreed scope.

A free tier for the scanners. Aikido's Developer plan costs nothing and covers two users, ten repositories and one cloud account. Rheono's free offer is a short read-only check of a live site, which is much smaller than a pentest.

Where Rheono differs

The bill stays put when you ship more. Rheono charges a flat monthly price per surface, meaning one web app and its API. Starter is one full pentest a month at €99. Growth, at €499, runs a pentest after each release you approve and keeps a quieter watch in between. In Aikido's continuous mode the spend follows how many agents your changes trigger, and Aikido estimates it from the last 30 days of Git activity.

Scope is fixed in writing before anything runs. You prove you own the domain with a DNS TXT record or a well-known file, then sign an authorization with rules of engagement: hosts, techniques, rate limits, no-gos and a contact. It lasts 90 days, and the agents only talk to the hosts it names.

Each finding has a working exploit and three checks behind it. The agent that found it proves it once. A separate validator, which never saw that work, tries to break the proof. Where the bug class allows, a scripted replay runs the exploit again and captures the request and response. The signatory reviews the result before it goes into a report signed with an advanced electronic signature, with NIS2 / ISO 27001-ready evidence mapping. The verification bar has the detail, and the sample report shows one finding end to end.

Both companies have a European base. Rheono is run from Germany, stores customer data in the EU, signs a DPA under Art. 28 GDPR and prices in euros.