Aikido Security has acquired agentic remediation startup Root for an estimated $70m–$100m, introducing AI-driven, backported patches that fix open-source vulnerabilities without requiring full library upgrades.
Belgian cybersecurity platform Aikido Security has acquired Israeli agentic vulnerability-remediation startup Root (Root.io Inc.) for an estimated $70 million to $100 million. This acquisition follows Aikido reaching a $1 billion “unicorn” valuation earlier in 2026, alongside its previous buyouts of AI code-review startup Trag and pen-testing firms Allseek and Haicker.
Root resolves a major software supply chain bottleneck by patching open-source vulnerabilities (CVEs) within older library versions without forcing a full version upgrade. Standard security alerts typically force development teams to upgrade entire libraries—often causing breaking changes, altered API contracts, or stability issues. Root solves this by using swarms of specialised AI agents to automatically research, write, test, and generate verified, backported patches tailored precisely to a company’s pinned production software versions.
The automated engine ships individual patches in 15 to 40 minutes, remediating over 80% of analysed cases without requiring manual code changes. Aikido is integrating this technology natively as Aikido Libraries and Aikido Images, enabling users to swap out vulnerable elements for hardened, drop-in replacements. To support the wider ecosystem, Aikido has committed to actively backporting and contributing these critical security fixes back to upstream open-source maintainers and community repositories.
