AWS Partner Network (APN) Blog
Securing the AI development lifecycle with Aikido and Kiro
By: Len Gomes, Partner Solutions Architect – AWS
By: Akram Al Sheikh, Security Partner Solutions Architect – AWS
By: Alex Llobet, Global Cloud Alliances Lead – Aikido
By: Johan de Keulenaer, Head of Partnerships – Aikido
 |
| Aikido |
 |
Aikido Security and Kiro help development teams secure the AI development lifecycle and ship AI-generated code with confidence. Kiro is an AI-powered development environment from Amazon Web Services (AWS) that helps developers build and ship production-ready applications through spec-driven development. As AI agents take on more of the development workflow, from code to infrastructure to API integrations, organizations benefit from continuous security scanning that runs alongside every change. Aikido Security strengthens this workflow and now also through Kiro Powers with automated vulnerability detection, secrets scanning, and infrastructure as code (IaC) checks that run continuously as code is written keeping security in step with development velocity.
Aikido Security is a developer-first cybersecurity company trusted by more than 50,000 organizations. Aikido’s AI-first platform secures applications from code to cloud to runtime, replacing the fragmented tooling that creates alert fatigue and slows development teams.. Built to integrate where developers already work, Aikido operates inside integrated development environments (IDEs), continuous integration and continuous delivery (CI/CD) pipelines, and AI development environments.
In this post, we explain what Kiro powers are, how the Aikido power works, and how organizations can secure AI-generated code from day one.
The opportunity: Security that matches the speed of AI development
Development teams using AI assistants report five- to sevenfold productivity gains as AI agents handle code generation, infrastructure provisioning, and documentation. This acceleration creates an opportunity to rethink how security fits into the development lifecycle.
Rather than relying on security review as a final gate before deployment, organizations now embed security directly into the development workflow. Continuous scanning that runs alongside AI agents gives teams immediate visibility into vulnerabilities, exposed secrets, and infrastructure misconfigurations as code is written, not after it ships.
This shift from end-of-pipeline review to continuous, in-workflow security delivers measurable benefits: faster release cycles, fewer post-deployment remediations, and consistent security standards across every change an AI agent produces.
What are Kiro powers?
Kiro powers are specialized bundles that add expert-level context and tools to Kiro AI agents on demand. Rather than loading all tools at the same time (which overloads the context window), powers activate dynamically based on the task at hand. For example, the Aikido power activates when your conversation involves security-related topics such as scanning, vulnerabilities, or secrets detection. Each power packages three components working together:
- Model Context Protocol (MCP) server – Provides direct connectivity between the Kiro agent and external tools or services.
- Steering file (POWER.md) – Contains domain-specific best practices curated by technology experts.
- Optional hooks – Automatically verify code against best practices, providing immediate feedback.
This modular design means Kiro can access dozens of technologies without overwhelming the agent context. Only the relevant power loads when needed. AWS and partner teams have published powers across a growing range of domains and technologies, each bringing production-grade best practices directly into the development workflow. Browse the full catalog at Kiro powers.
Introducing the Aikido Kiro power
Aikido Security has built a Kiro power that creates a continuous security loop inside the development workflow. Every agent-generated code change is automatically analyzed for vulnerabilities, exposed secrets, and infrastructure misconfigurations, and Kiro’s agents act on Aikido’s findings to fix issues before they ship.
The Aikido Kiro power provides three categories of scanning:
- Static Application Security Testing (SAST) – Detects common vulnerability patterns such as SQL injection, path traversal, and cross-site scripting.
- Secrets detection – Identifies exposed API keys, tokens, and hardcoded credentials.
- IaC scanning – Finds misconfigurations in Terraform, AWS CloudFormation, and similar configuration files before they reach production.
When the power detects security issues, it explains each finding clearly (including title, severity, file location, and line numbers) and Aikido’s remediation engine guides the applied fixes. After applying fixes, the power rescans automatically to verify resolution, creating a self-correcting loop that operates without developer intervention.
How the hook configuration works
The key mechanism that provides continuous security is the Aikido hook. After it’s installed, a hook named “Aikido Scan on Write” triggers automatically after a file is written or modified by the Kiro agent. The hook activates the Aikido power and runs a full scan on all files created or modified in the current session.
The scan-fix-verify cycle works as follows:
- The Kiro agent writes or modifies code files.
- The hook triggers automatically and collects all affected file paths.
- Aikido runs SAST, secrets, and IaC scanning across those files.
- If issues are found, the agent explains each finding and applies fixes guided by Aikido’s remediation.
- The power rescans to verify fixes and resolve the issues without introducing new ones.
This approach means security validation runs in parallel with development, not after it. Developers avoid context switching since the Aikido Power handles security in the background. The following screenshot shows this scan-fix-verify cycle.
Figure 1: The Aikido Scan on Write hook configuration in the Kiro IDE
Business scenarios
The Aikido Kiro power addresses security challenges across different organizational contexts:
- High-growth startup shipping to production – A startup using Kiro to accelerate its first product generates IaC through AI agents. The Aikido power gives teams early visibility into misconfigured AWS Identity and Access Management (IAM) policies and storage bucket permissions, enabling remediation during development rather than post-deployment.
- ISV managing developer scale – An independent software vendor (ISV) with a distributed engineering team needs consistent security standards across AI-assisted development without adding headcount to a security team. The Aikido power runs on every agent-generated change, enforcing security baselines uniformly without slowing release velocity.
- Enterprise meeting compliance requirements – An enterprise in a regulated industry needs to demonstrate that AI-generated code meets security and compliance standards for audits. Aikido captures evidence continuously throughout the development lifecycle, replacing manual evidence-gathering with automated reporting across SOC 2, ISO 27001, Health Insurance Portability and Accountability Act (HIPAA), NIS2, DORA, and Payment Card Industry Data Security Standard (PCI DSS). Learn more about automated compliance checks in Aikido’s plataform.
Measured results
Production deployments of Aikido demonstrate measurable impact:
- 90% reduction in false-positive security alerts through reachability analysis and auto-triaging, so only exploitable risks surface
- Security fixes in under 30 seconds through AutoFix, which proposes and implements remediation automatically
- Developer onboarding in under 5 minutes with Aikido’s developer-native integrations (IDE, CI/CD, and issue management)
- Compliance coverage across SOC 2, ISO 27001, PCI DSS, DORA, NIS2, and HIPAA through automated evidence collection
Getting started with the Aikido Kiro power
Installing the Aikido Kiro power takes one click:
- Open the powers panel in the Kiro IDE or visit Kiro powers.
- Search for “Aikido Security” and choose Install.
- Configure your Aikido API key. You can find it by visiting Aikido and then choosing Settings, Integrations, and IDE Plugins.
- The power activates on demand, and the hook begins scanning automatically after every code change.
The following screenshot shows the powers panel in the Kiro IDE.
Figure 2: Installing the Aikido power from the Kiro IDE powers panel
After the Aikido Kiro power is installed, developers can also explicitly prompt Kiro to scan files (for example, “Scan my changed files for security vulnerabilities”) for on-demand assessment at any point during development. The following are some suggested prompts to use with the Aikido power.
Good for getting a baseline security posture on your whole project in one shot:
“Scan all Python files in the backend/ directory for security vulnerabilities and hardcoded secrets. Fix any issues you find and verify the fixes are clean.”
Good for a quick gate before pushing code to catch things that slipped through during development:
“Scan my staged git changes for security issues: secrets, SQL injection, path traversal, or any IaC misconfigurations. Summarize what you find with severity levels.”
Good for learning from the findings, not merely patching them blindly. This one is great for when you want to educate the team or write up security notes:
“List all open Aikido security issues for this repo, then fix the high-severity ones. For each fix, explain what the vulnerability was and why the fix resolves it.”
Source code and documentation: github.com/AikidoSec/aikido-kiro-power. Learn more about the integration at integrations.aikido.dev/integrations/kiro.
Video 1: Aikido Kiro power in action
Conclusion
AI-driven development is the new baseline for how fast-moving organizations build software. The Aikido Kiro power brings automated scanning directly into the agentic development workflow, helping teams ship securely at the pace AI development allows. Security runs continuously, findings surface in context, and fixes apply automatically, so teams ship with confidence at the pace AI enables.
Explore Aikido Security in AWS Marketplace. Activate the Aikido power in Kiro at Kiro powers. Learn more about Aikido’s compliance certifications at Aikido’s Trust Center.
Aikido Security – AWS Partner Spotlight
Aikido Security is a cybersecurity company that secures everything developers build, ship, and run. Its software security platform protects code, cloud infrastructure, devices, and runtime environments, providing real-time visibility and automatically identifying and remediating vulnerabilities. Trusted by more than 50,000 organizations, Aikido is purpose-built to integrate where developers already work: inside IDEs, CI/CD pipelines, and AI development environments. Founded in 2022, Aikido Security has grown to 300 employees, reached unicorn status faster than any other European cybersecurity company, and was among one of the first AWS Security ISVs in EMEA selected for the Kiro pilot program.