Aikido Security acquires Israeli Root: AI fixes open source without breaking dependencies

Aikido Security from Ghent (Belgium) announced on July 6, 2026 the acquisition of Israeli startup Root, whose AI agents fix vulnerabilities in open source components without breaking the work of dependent applications — something most cybersecurity tools struggle with.

Why automatic patching of open source is an unsolved problem

Thousands of vulnerabilities are discovered in open libraries every year. Scanners have long learned to find them — detection is not the issue. The problem comes next. Modern applications are built on hundreds of dependencies, linked in complex graphs: library A requires library B, which requires library C, and so on. Updating a component at one level can break something at another.

This is why security teams face the same situation year after year: a vulnerability is found, a patch exists, but applying it without risking application failure — a task requiring manual work by an experienced engineer. Often it takes days, sometimes weeks. The vulnerability window stays open much longer than it should.

Root approaches this problem differently. The startup's AI agents don't simply apply an update — they analyze the dependency graph, understand the context, and form a patch that accounts for the entire chain. According to Aikido, this is what sets Root apart from competitors: other tools can find vulnerabilities, but they can't fix them.

• Aikido Security received a $1 billion valuation in January 2026 — faster than any other European cybersecurity company
• Aikido is based in Ghent (Belgium)
• Root is an Israeli startup specializing in automatic AI patching of open source components
• Key differentiator from competitors: AI fixes vulnerabilities without disrupting dependent applications

Why Aikido needs this deal

In January 2026, Aikido Security became the first European unicorn in cybersecurity, reaching a $1 billion valuation faster than any competitor on the continent. Now the company is expanding its technology stack. Acquiring Root is a step toward a platform that covers the full security lifecycle: from vulnerability discovery to applying a ready-made patch.

The commercial logic is clear. Most DevSecOps tools today stop at the "find and report" stage — further work falls on the engineer's shoulders. If Aikido can offer a "find, explain, and automatically fix" cycle — this is a fundamentally different value proposition, especially for large companies with thousands of dependencies in their codebase.

Context makes the deal even more significant. Open source today forms the infrastructure foundation of most corporate software — from clouds to banking systems. This makes the ecosystem a target: supply chain attacks are becoming increasingly popular, and attackers know that slow patching is their ally. Aikido + Root is a direct answer to this problem.

What this means

Aikido is consistently building a European answer to American cybersecurity giants. Acquiring Root adds to the platform a technology that competitors have not yet replicated: automatic AI patching with consideration for transitive dependencies. Success will depend on how reliably the agents work in real corporate environments with non-standard stacks. If the answer proves positive — Aikido will have a strong argument in competing for the corporate DevSecOps market both in Europe and beyond.