Aikido acquires Root to patch open-source software without forced upgrades

Belgian cybersecurity company Aikido Security NV today announced that it has acquired Root.io Inc., a company that offers patching for vulnerable open-source software at the exact versions organizations are already running.

Founded in 2020 as Slim.AI Inc., the startup offered a popular open-source container tool called Slim Toolkit. It rebranded last year as its technology shifted from shrinking container images to securing them.

Root sells what it calls agentic vulnerability remediation. When a new vulnerability is published, swarms of specialized AI agents research, write, test and ship a patch in roughly 15 to 40 minutes, against the weeks the process can take by hand. The fixes go straight to the container images and software dependencies a company is already running, at the versions it has pinned, so there’s no rebuild and no migration.

In more than four out of five cases, Root makes no code changes at all, with a human reviewer signing off rather than writing the patch. The company says that approach let data security firm BigID Inc. clear more than 1,000 vulnerabilities, in excess of 300 of them rated high or critical, across six production images in two weeks without abandoning its Debian and Ubuntu-based stacks.

For Aikido, the appeal is that the technology sidesteps the choice most teams face when a dependency turns up vulnerable. Upgrading to a newer version of a package can break a working application or pull in fresh malware, while migrating to a vendor’s locked-down replacement swaps one dependency for another. Root’s patches, which Aikido is folding into its platform as a feature called Aikido Libraries, fix the specific flaw without the breaking changes a full version bump tends to bring and the company said the technology generates hundreds of verified patches a day.

“Open source needs patching and it needs it fast. Today you have two options and neither works for most companies: upgrade and likely break your application, or migrate to a vendor’s locked-down replacement,” said co-founder and Chief Executive Willem Delbare. “With Root, we fix what teams are actually running, generating hundreds of verified patches a day: no upgrades, no migrations, no breaking changes. That’s how supply chain security gets solved for everyone, not just the 1%.”

Coming into its acquisition, Root had raised $37.6 million, including a $31 million Series A in 2022 co-led by Insight Partners and StepStone Group. Gartner Inc. this year named Root an emerging vendor in the automated vulnerability remediation category.

Aikido said that alongside the acquisition, it will start back-porting fixes for critical, actively exploited open-source vulnerabilities to the wider community across the ecosystems it supports, contributing those patches upstream to the projects that maintain the code rather than keeping them locked behind a paywall.

The deal caps a busy run of acquisitions for Aikido, which over the course of 2025 snapped up the AI code-review startup Trag along with the autonomous penetration testing companies Allseek BV and Haicker SA. In January, the company raised $60 million in a Series B round that valued it at $1 billion and made it the fastest European cybersecurity company ever to reach unicorn status. Aikido says its platform is now used by more than 100,000 teams, among them the Premier League, Revolut Ltd. and SoundCloud.

Image: Root