ARKO by DevSecAI

DevSecOps reasoning, all-in-one. Multi-layer AI validates and strengthens traditional SAST, IaC, SCA and threat modelling. In your IDE. Repos and CI/CD pipelines with Enterprise. On EU-hosted AI models.

Arko sits inside your IDE. It scores every repo from 0 to 100, surfaces the top risks worth fixing first, and proves they're gone. You stay in your editor. With Enterprise, the same engine extends to your repos and CI/CD pipelines, with no monthly scan allowance.

External AI users now find and chain vulnerabilities in your code faster than any human team can patch them. Arko finds and fixes them first.

See Arko in action

Hackable Score, AI-generated threat model diagram, and full-view panel — all in your IDE.

Mapped to OWASP, PCI DSS 4.0, DORA, and GDPR. Built for teams that need to know where their code goes. Analysis runs on AI models hosted by major cloud providers in the EU, your code stays in EU infrastructure, and the model makers never receive it.

How It Works

1. Scan

Click "Run Security Scan" in the sidebar. Arko analyses your project files (respecting your exclude patterns), then re-checks the open findings in the files it just scanned, so a fix made in place shows as verified on the next scan.

2. Architectural Reasoning & Control Analysis

A multi-stage AI pipeline:

• Maps endpoints, trust boundaries, and data flows
• Identifies authentication and access control patterns
• Detects application-layer vulnerabilities
• Identifies DevSecOps anti-patterns
• Builds a contextual threat model
• Evaluates exploitability based on architecture
• Detects implemented and missing security controls

3. Prioritise and Fix in Flow

Results appear directly in your IDE with:

• A Hackable Score (0 to 100)
• Architecture-aware threat explanations
• Exploitability-based prioritisation
• Plain-language remediation guidance
• "Check with AI" prompts for fixing without leaving your editor

4. Enterprise Dashboard & Policy Alignment

Findings, controls, and threat models are synchronised to the Arko enterprise dashboard, where teams can:

• View project-level security posture
• Assign and enforce security policies
• Track control implementation across repositories
• Map technical findings to compliance requirements
• Generate structured reports for security and governance teams

Coverage

Arko reasons across the full development surface — application code, dependencies, infrastructure-as-code, and CI/CD pipelines — in a single scan.

Application code

JavaScript, TypeScript, Python, Ruby, Go, Java, C#, PHP, SQL, HTML, Rust, Swift, Kotlin, Scala, Elixir, C, C++, Objective-C, Clojure, Dart/Flutter, Delphi / Object Pascal (.pas, .dpr, .dpk, .pp), and COBOL (.cob, .cbl, .cpy). Coverage spans modern stacks, legacy ERP, and mainframe / financial-services codebases in one tool.

Software Composition Analysis (SCA)

Arko parses dependency manifests across npm (package.json), Python (requirements.txt), Go (go.mod), Java (Maven pom.xml), Rust (Cargo.toml), Ruby (Gemfile), Swift (Package.swift), Scala (build.sbt), Elixir (mix.exs), Clojure (project.clj), and others — then resolves each package against known CVEs.

Findings Arko surfaces today include:

• lodash prototype pollution
• jsonwebtoken algorithm confusion
• axios SSRF
• Log4Shell (log4j CVE-2021-44228)
• dgrijalva/jwt-go CVE-2020-26160

Infrastructure as Code (IaC)

Arko scans Terraform (.tf, .tfvars, .hcl), Kubernetes manifests (.yaml), and Dockerfiles for security misconfigurations.

Findings Arko surfaces today include:

• RDS instances marked publicly_accessible = true
• KMS key policies granting Principal: "*"
• Pods with hostPID: true enabled
• Security groups open to 0.0.0.0/0
• Hardcoded credentials in Terraform default values

CI/CD pipeline security

Arko scans GitHub Actions workflows (.github/workflows/*.yml) for secrets and supply-chain issues.

Findings Arko surfaces today include:

• Hardcoded secrets in workflow env: blocks
• Unsafe pull_request_target triggers that check out untrusted PR code with elevated permissions
• Command injection via unquoted ${{ github.* }} context variables in run: steps
• Missing permissions: blocks (defaults to write-all)

Multi-layer AI decision engine

Every finding passes through Arko's proprietary decision engine before it reaches your IDE:

• Deterministic foundation — fast pattern detection for known vulnerability classes, paired with heuristic file scoring that decides what's worth deeper analysis
• Multi-stage AI reasoning — every candidate is evaluated against your architecture, exploitability, and trust boundaries before being shown
• Human-in-the-loop — your accept and dismiss decisions tune Arko's accuracy per tenant over time

Most SAST tools surface raw pattern matches and leave you to triage the noise. Arko's validation layer evaluates every candidate against your specific architecture before it reaches you — which is why developers actually triage Arko findings instead of ignoring them.

EU data residency

Contact DevSecAI to discuss your organisation's deployment requirements.

What Makes Arko Different

Most teams currently buy four separate security tools and still get noisy, context-free findings. Arko replaces all four with one IDE plugin and strengthens every finding with multi-layer AI validation.

Plus:

• All four categories run from your IDE in the free Community edition.
• Every finding goes through multi-layer AI validation that filters false positives, validates exploitability against your architecture, and prioritises by real attack feasibility.
• With Enterprise, the same engine runs across your repos and CI/CD pipelines, with no monthly scan allowance.
• Runs on AI models hosted in EU cloud infrastructure. The model makers never receive your code.
• All outputs unify into a single Hackable Score per repo. One number to track posture.
• All map to one set of compliance frameworks (OWASP, PCI DSS 4.0, DORA, GDPR).

Arko functions as a security architect inside the IDE, with governance visibility at the enterprise layer.

Core Capabilities

Four scanning categories

SAST (Static Application Security Testing) Detects vulnerabilities in your code as you write: SQL injection, XSS, command injection, path traversal, weak cryptography, exposed secrets, sensitive logging, insecure random, and modern AI-native risks like prompt injection and insecure LLM integrations. Combines deterministic pattern detection with AI-driven contextual reasoning.

IaC (Infrastructure as Code) Scans Terraform, CloudFormation, Kubernetes manifests, Docker configs, and serverless definitions for misconfigurations and policy violations.

SCA (Software Composition Analysis) Identifies known-vulnerable dependencies and supply chain risks across your package manifests (package.json, requirements.txt, go.mod, pom.xml, and others).

Threat Modelling AI-generated threat models specific to your stack, architecture, and integrations. Maps endpoints, trust boundaries, data flows, and authentication patterns. Identifies real attack paths.

Multi-layer AI validation

Every finding from the four scanning categories is reasoned over by a multi-stage AI pipeline before it ever reaches your screen. The pipeline:

• Maps endpoints, trust boundaries, and data flows
• Identifies authentication and access control patterns
• Validates whether each finding is exploitable in your specific architecture
• Filters false positives based on context
• Prioritises by realistic attack feasibility, not generic CVSS scores
• Detects implemented and missing security controls

This is the differentiator versus traditional SAST/IaC/SCA tools that produce raw findings without architectural context.

Cross-cutting features

• Hackable Score — A real-time 0 to 100 score representing overall system exposure, updating as posture improves.
• Security Control Validation — Detection of implemented and missing security controls across authentication, input validation, encryption, access control, logging, and DevSecOps workflows.
• Compliance & Regulatory Mapping — Maps controls and findings to OWASP, PCI DSS 4.0, DORA, GDPR, NIST CSF, and ISO 27001.
• Fix in Flow — Contextual remediation guidance, passable directly to your AI coding assistant.
• Exportable Reports & Badge — Structured security reports for auditors, plus an embeddable Hackable Score badge for your repos.

Editions

Need more than the free allowance? ARKO Pro is £9 a month (£84 a year): 30 full project scans a month, larger projects, and your choice of AI engine. Upgrade from the Upgrade Plan button in the sidebar. Teams and organisations: Enterprise, below. | Compliance reporting (OWASP, PCI DSS 4.0, DORA, GDPR, NIST CSF, and ISO 27001) | — | ✓ | | Team management, SSO, audit trails | — | ✓ | | Tenant isolation | — | ✓ | | Dedicated support and onboarding | — | ✓ |

For Enterprise pricing or a demo, book a 30-minute call or visit arkohq.com/contact.

Enterprise Control Plane

The Arko Enterprise Control Plane gives security and engineering leaders centralised visibility across every repository scanned through the IDE plugin, your repos, and your CI/CD pipelines.

What it does:

• Posture across the organisation — See the Hackable Score for every repo, with trends over time.
• Full scan history — Every scan from every developer, IDE, AI agent and pipeline, in one place.
• Tooling integration — Scan on every push and pull request with GitHub and GitLab, gate your CI/CD pipelines, and send findings to Jira and Slack.
• Policy push to developer IDEs — Define security policies centrally and enforce them in real time inside the developer's editor.
• Control coverage tracking — Monitor which security controls are implemented across teams and projects.
• Findings management — Triage, accept, or reject findings with full audit trail.
• Compliance reporting — Generate audit-ready reports mapped to OWASP, PCI DSS 4.0, DORA, GDPR, NIST CSF, and ISO 27001.
• Team visibility — See who's fixing what, with leaderboards and posture trends per developer and team.
• Tenant isolation — Each organisation operates in its own isolated environment with its own policy profile and accuracy tuning.

Get in touch:

For Enterprise pricing or a demo, book a 30-minute call or visit arkohq.com/contact.

How We Handle Your Code

Transparency is core to Arko.

During analysis:

• Project files are transmitted securely over HTTPS (TLS).
• Analysis runs on AI models hosted by major cloud providers in the EU. Code never leaves EU infrastructure, and every result names the provider that analysed it.
• The model makers never receive your code.

Stored only:

• Vulnerability snippets (the specific lines flagged as risky, not full files)
• Scan metadata (file counts, timestamps, duration)
• Generated threat models
• Recommendations
• Hackable Score history
• Control validation results

Never:

• Sold or shared with anyone
• Retained as full source files after analysis
• Accessed outside scans that you, or schedules and pipelines your organisation sets up, start

You control:

• When scans run: your manual scans, plus any automatic checks, schedules or pipelines you or your organisation turn on
• Exclusion patterns (.env*, secrets/**, *.pem, *.key by default)

Getting Started

1. Install the extension from the VS Code Marketplace or Open VSX.
2. Click the Arko icon in the Activity Bar.
3. Sign in with your account (or create one at devsecai.io).
4. Open a project and click Run Security Scan.

Configuration

Requirements

• Any VS Code-compatible IDE (VS Code, Cursor, Windsurf, VSCodium, Code-server) version 1.85+
• An Arko account (sign up free)

Links

• Website
• Privacy Policy
• Terms of Service
• Contact: info@devsecai.io