Each safety staff has a folder of CVEs it is aware of about and may’t repair. Not as a result of no one assigned the ticket, however as a result of the repair carries extra operational threat than the vulnerability itself. A dependency bump pulls in a brand new main model, which breaks an inner API contract, which implies a dash of regression testing no one budgeted for. A base picture improve jumps from Debian 11 to 12, and half the construct scripts choke on a package deal that not exists within the new repo. So the ticket sits. The vulnerability stays open. And the org quietly accepts threat it by no means meant to just accept, as a result of the choice is worse within the brief time period.
That is the precise failure mode behind most unpatched CVEs in manufacturing — not negligence, however a cost-benefit calculation that retains popping out in favor of “later.” It is also the hole Aikido is now constructing straight into its platform by means of Aikido Libraries and Aikido Photos.
Three unhealthy choices, and why groups maintain choosing the worst one
Traditionally, a staff that finds a susceptible open-source part has three paths. Improve to a patched model and threat breaking manufacturing. Migrate to a vendor’s hardened, locked-down substitute and tackle new dependencies and workflows. Or do nothing and carry the publicity. None of those are good, which is why AppSec backlogs develop sooner than they shrink virtually in all places.
Upgrading is not simply “run npm replace” — a model bump can drag in dozens of unrelated adjustments, depend upon releases that do not exist but for older ecosystems, or introduce recent vulnerabilities of its personal. Groups which have lived by means of a foul Log4j-adjacent improve know this instinctively: the repair occasion is scarier than the exploit occasion.
The size of the issue is documented independently of Aikido’s framing, not simply asserted by it. VulnCheck’s 2025 monitoring of identified exploited vulnerabilities discovered that just about 29% had been exploited on or earlier than the day their CVE was printed — up from roughly 24% the 12 months earlier than, and a part of a broader pattern of exploitation outpacing disclosure that Mandiant, CrowdStrike, and Google’s Menace Intelligence Group have all reported independently in their very own 2025-2026 datasets.
And Log4Shell, disclosed in December 2021, hasn’t gone away: Sonatype discovered roughly 13% of Log4j downloads in 2025 had been nonetheless susceptible, and Distinction Safety reported round 12% of Java purposes had been nonetheless operating exploitable variations three years after disclosure. Not as a result of groups do not learn about it, however as a result of ripping it out means touching code no one needs to the touch.
What truly modified: patch the model you are already on
Aikido Libraries and Aikido Photos take a narrower, extra mechanical method than “improve or migrate.” As a substitute of pushing you to a more recent package deal or a unique base picture, Aikido backports the safety repair into the precise model already pinned in your lockfile or Dockerfile. The package deal title stays the identical. The model string stays primarily the identical — Aikido appends a suffix (+aikido.1 for many ecosystems, a hyphenated variant for npm) so a patched starlette 0.27.0 turns into starlette 0.27.0+aikido.1. The general public API does not transfer. Nothing forces a rewrite.
For container pictures, the identical logic applies on the OS layer. Aikido Photos swap the bottom picture tag for a hardened construct on the identical distro household and main model — Debian stays Debian, Alpine stays Alpine — as a substitute of forcing a distro or major-version bounce that may in any other case cascade by means of each downstream picture that inherits from it.
This issues most for precisely the workloads safety groups dread touching: legacy companies on frameworks no one actively maintains anymore, pinned transitive dependencies no one controls straight, and something previous its official end-of-life the place the seller has stopped delivery fixes in any respect. For actively developed repos the place a standard model bump is low-risk, a normal AutoFix improve continues to be the sooner and extra wise path — Aikido’s personal positioning is express that Libraries is for when the improve itself is the impediment, not a common substitute for regular dependency hygiene.
The mechanics: brokers generate, people confirm, upstream will get the repair too
The patch era is constructed on an agent pipeline inherited from Root — a system designed to supply giant volumes of verified CVE patches reasonably than counting on handbook backporting, which is the standard (and unscalable) manner distro maintainers have dealt with long-term assist. Aikido states it ships greater than 100 new patches a day throughout Libraries and Photos, with a response SLA of beneath 48 hours for actively exploited or important/high-severity CVEs and beneath seven days for medium-to-low severity ones. Each patch is described as human-verified earlier than launch, and every is scoped as a minimal, inspectable diff restricted to the CVE repair — not a broader refactor bundled in beneath the identical commit.
The half price noting for anybody skeptical of vendor lock-in dressed up as safety: Aikido says important fixes for actively exploited vulnerabilities are additionally contributed again upstream, throughout ecosystems, reasonably than held completely for paying prospects. Whether or not that dedication holds at scale over years is one thing solely time and the open-source group will truly confirm. It is also price being clear-eyed that the framing of competing hardened-image distributors as requiring full migration is Aikido’s personal characterization, not an independently audited comparability — some opponents on this house additionally supply drop-in suitable tags reasonably than forcing a rebase. The excellence Aikido is drawing (patch-in-place vs. migrate) is actual and issues operationally, but it surely’s truthful to deal with the particular aggressive distinction as advertising framing reasonably than verified truth.
What this implies for a way groups truly function
The sensible shift is that “patch” and “improve” cease being the identical motion. A staff can shut a CVE at present with out opening the bigger, riskier dialog a few framework migration or an OS model bounce — and have that separate dialog by itself timeline, with its personal testing funds, when it is truly warranted. Safety can be steady reasonably than one-time: as soon as a repo or picture is enrolled, new CVEs found later get folded into day by day automated pull requests with out anybody re-running the method.
None of this eliminates the underlying debt of operating outdated software program. A patched CVE on an unsupported framework continues to be technical debt, simply debt that is not actively bleeding. However for safety and platform groups measured on imply time to remediation reasonably than on how fashionable their stack appears, that distinction is the entire level — and it is a extra trustworthy description of how CVE backlogs truly get cleared in actual organizations than most vendor pitches admit.
