AquilaX is an application security platform built by AquilaX LTD, a London-based company. It targets DevSecOps teams and developers who need to cut through noisy, unranked vulnerability alerts. The platform runs 32 parallel scan engines across 12 scanner categories, including SAST, SCA, DAST, secrets, PII, IaC, containers, API security, malware and compliance.
AquilaX integrates at the Git layer through webhooks, GitHub Actions, GitLab CI, a REST API or a CLI. When code is pushed or a pull request opens, the 32 engines run simultaneously in under 60 seconds. Its self-learning engine, Securitron AI, then filters findings, removing 93.54% of false positives based on each customer’s codebase patterns, and generates ready-to-merge fix pull requests.
Beyond scanning, AquilaX offers an Application Security Posture Management (ASPM) command center that aggregates findings across repositories into one risk score. A Cloud Security Posture Management (CSPM) add-on extends monitoring to AWS, Azure, GCP and Kubernetes. A Model Context Protocol (MCP) server also feeds AquilaX findings directly into AI coding assistants such as Claude, Cursor and Windsurf.
The company reports backing from the NVIDIA Inception Program, Microsoft for Startups and a GitLab Technology Partner status. Named customers include Gruppo TIM, Prisma and Olidata. AquilaX suits teams evaluating a single platform for code, dependency, infrastructure and cloud security rather than stitching together separate point tools.
Pricing
AquilaX offers a permanent Free plan with unlimited scans, secrets and PII scanning, compliance auditing and REST API access, requiring no credit card. Premium costs $19 per month per organisation and adds SAST, SCA, DAST, container and IaC scanning across seven engines. Ultimate costs $99 per month per organisation and adds Securitron AI, malware detection, Vibe Code analysis, AI auto-remediation and on-premises deployment, with a 14-day free trial. Enterprise pricing is custom and covers SSO/SAML, dedicated AI models and volume discounts; the CSPM add-on is billed separately per cloud account or cluster on an annual commitment.
* Disclaimer: Please note that pricing information may not be up to date. For the most accurate and current pricing details, refer to the official website.
Key Features
-
✓
32 parallel scan engines complete a full scan in under 60 seconds
-
✓
Securitron AI removes 93.54% of false positives per customer codebase
-
✓
Autonomous fix patches open automatically as ready-to-merge pull requests
-
✓
ASPM dashboard aggregates findings across repositories into one risk score
-
✓
CSPM add-on monitors AWS, Azure, GCP and Kubernetes for drift
-
✓
MCP server surfaces security context inside Claude, Cursor and Windsurf
Use Cases
Securing Code Commits Before Merge
Developers push to GitHub or GitLab, triggering all 32 scanners in under 60 seconds without slowing the workflow. High-severity issues, such as SQL injection or hardcoded secrets, are caught before code reaches production.
Automated Fix Pull Request Generation
Once Securitron AI confirms a vulnerability, it writes a context-aware patch and opens a pull request on the correct branch. This removes manual triage and patch writing, letting teams merge fixes directly.
Live Cloud Posture and Drift Detection
With the CSPM add-on, security teams monitor AWS, Azure, GCP and Kubernetes deployments for configuration drift and IAM privilege escalation paths. This extends code-level scanning into live production infrastructure.
Real-Time Security Context in AI Coding Assistants
Developers using Claude, Cursor or Windsurf can query AquilaX findings through the MCP server inside their IDE. Security context reaches AI prompts directly, without switching tools or contexts.
Continuous Audit-Ready Compliance Mapping
Findings from code and infrastructure scans are mapped continuously to standards such as GDPR, SOC 2, ISO 27001 and PCI DSS. Teams get real-time compliance scores instead of manual spreadsheet tracking.
Strengths & Weaknesses
Strengths
Completes 32 parallel scans in under 60 seconds.
Eliminates 93.54% of false positives through Securitron AI.
Generates working fix pull requests without manual patch writing.
Charges a flat monthly fee per organisation with unlimited scans and no per-seat cost.
Supports both cloud-hosted SaaS and on-premises Docker or Kubernetes deployment.
Weaknesses
Securitron AI, auto-remediation and Vibe Code analysis require the $99 per month Ultimate plan.
CSPM is billed as a separate add-on requiring an annual commitment, not included in any base plan.
Free and Premium plans exclude engines such as malware detection, and the Free plan lacks SAST and DAST.
Annual billing with a discount is listed as coming soon, so only monthly billing is currently available.
Who Is This For?
DevSecOps Engineers: automate scanning across CI/CD pipelines and review aggregated findings in the ASPM dashboard instead of triaging alerts manually.
Software Developers: work inside Git, IDE plugins and AI coding assistants, receiving fixes as ready-to-merge pull requests via MCP.
Security Compliance Officers: rely on automated mapping across 15+ regulatory frameworks and audit-ready reporting instead of manual evidence gathering.
Engineering Leaders and CTOs: benefit from flat per-organisation pricing with unlimited scans that scales without per-seat penalties as teams grow.
Frequently Asked Questions
Is the AquilaX Free plan really free forever?
Yes. The Free plan has no expiry and requires no credit card, and includes unlimited scans, secrets scanning, PII detection and compliance auditing.
Does AquilaX charge per user or per seat?
No. Pricing is flat per organisation per month on every plan, so teams can add developers without extra cost.
What does Securitron AI actually do?
Securitron AI is a self-learning model trained on each customer’s codebase. It filters out 93.54% of false positives, ranks severity, and drafts fix patches.
How is the CSPM add-on priced and licensed?
CSPM is sold separately, only to Ultimate subscribers, priced per connected cloud account or Kubernetes cluster and billed on an annual commitment.
Can AquilaX be deployed on-premises?
Yes, on the Ultimate plan. It supports Docker and Kubernetes via Helm charts for organisations that cannot use the hosted SaaS version.
What happens after the 14-day Ultimate trial ends?
The trial gives full access to Ultimate features, including Securitron AI and auto-remediation. Afterward, the account reverts to the Free tier unless upgraded.
Which compliance frameworks does AquilaX map to?
The platform maps findings to more than 15 frameworks, including GDPR, SOC 2, ISO 27001, HIPAA, PCI DSS, NIST CSF, DORA and NIS2.
Can AI coding assistants access AquilaX findings directly?
Yes. The MCP server exposes AquilaX scanning and findings to assistants such as Claude, Cursor and Windsurf inside the IDE.
Is annual billing available for AppSec plans?
Not yet. Annual billing with a discount is listed as coming soon, so Premium and Ultimate are currently billed monthly.
AquilaX integrates with GitHub, GitHub Actions, GitLab, GitLab CI, Bitbucket, Azure DevOps, Jenkins, CircleCI and TeamCity for source control and CI/CD. It connects to Docker, Kubernetes and Helm for container and on-premises deployment, and to Terraform, Ansible and AWS CloudFormation for infrastructure as code scanning. OpenAPI and Swagger specifications are supported for API security analysis. The CSPM add-on connects to AWS, Azure and Google Cloud, and a Model Context Protocol server connects to AI coding assistants including Claude, Cursor and Windsurf.