Aikido buys Root to patch vulnerabilities in-place without requiring upgrades

Cybersecurity platform Aikido Security has acquired Root, a startup that remediates known security flaws directly within the open source package versions teams currently deploy, eliminating the need to force full version upgrades. The transaction, valued at $70 million, brings Root's patching capabilities into a new Aikido offering called Aikido Libraries.

As part of the deal, Aikido is pledging to freely backport security fixes for critical, in-the-wild exploited vulnerabilities to the broader open source ecosystem at no cost. This commitment covers major package repositories including npm, PyPI, and Maven.

Backporting critical flaws#

The free backporting initiative focuses specifically on vulnerabilities listed on the Cybersecurity and Infrastructure Security Agency (CISA)'s Known Exploited Vulnerabilities catalog — a curated set of security gaps that have demonstrably been weaponized in real attacks. While this represents only a fraction of all disclosed vulnerabilities, these are the ones posing the highest immediate risk.

Aikido co-founder and chief growth officer Madeline Lawrence notes that this free tier operates independently from the company's paid offerings. The distinction matters because regulatory frameworks increasingly require organizations to patch a far broader range of vulnerabilities beyond just the actively exploited ones. "This sits apart from our paid capability, which covers the long tail of CVEs that regulators now require companies to remediate, not just the actively exploited ones, and demand there is exploding," Lawrence explained. The same internal infrastructure that generates free fixes also powers the commercial product, avoiding any budget trade-off.

A different approach to remediation#

Root CEO Ian Riopel characterizes the acquisition as a fundamental choice about how the industry should manage vulnerability response. Rather than locking fixes within proprietary vendor ecosystems, the company has opted to return solutions directly to the open source projects and teams that need them. "The industry is still stuck on triage, taking a giant list of CVEs and arguing over which ones to fix first. Or worse, telling teams to throw out their images and start over with someone else's. We built Root to skip the argument and just fix the problem in place," Riopel said in a statement.

The strategic direction reflects Aikido's broader mission to compress the timeline between vulnerability discovery and remediation. Founded in 2022, Aikido achieved unicorn status in January following a $60 million Series B funding round, and this acquisition marks the company's fourth major acquisition in roughly sixteen months.