Arko finds and fixes what's hackable. Before external AI does.

DevSecOps reasoning, all-in-one. Multi-layer AI validates and strengthens traditional SAST, IaC, SCA and threat modelling. In your IDE. Repos and CI/CD pipelines with Enterprise. On private EU model hosting.

Arko sits inside your IDE. It scores every repo from 0 to 100, surfaces the top risks worth fixing first, and proves they're gone. You stay in your editor. With Enterprise, the same engine extends to your repos and CI/CD pipelines, with unlimited scans.

External AI users now find and chain vulnerabilities in your code faster than any human team can patch them. Arko finds and fixes them first.

See Arko in action

Hackable Score, AI-generated threat model diagram, and full-view panel — all in your IDE.

Mapped to OWASP, PCI DSS 4.0, DORA, and GDPR. Built for teams that can't send code to third-party AI APIs. Arko runs on private EU model hosting. Your code stays in EU infrastructure, end to end.

How It Works

1. Scan

Click "Run Security Scan" in the sidebar. Arko analyses your project files (respecting .gitignore and exclude patterns).

2. Architectural Reasoning & Control Analysis

A multi-stage AI pipeline:

• Maps endpoints, trust boundaries, and data flows
• Identifies authentication and access control patterns
• Detects application-layer vulnerabilities
• Identifies DevSecOps anti-patterns
• Builds a contextual threat model
• Evaluates exploitability based on architecture
• Detects implemented and missing security controls

3. Prioritise and Fix in Flow

Results appear directly in your IDE with:

• A Hackable Score (0 to 100)
• Architecture-aware threat explanations
• Exploitability-based prioritisation
• Plain-language remediation guidance
• "Check with AI" prompts for fixing without leaving your editor

4. Enterprise Dashboard & Policy Alignment

Findings, controls, and threat models are synchronised to the Arko enterprise dashboard, where teams can:

• View project-level security posture
• Assign and enforce security policies
• Track control implementation across repositories
• Map technical findings to compliance requirements
• Generate structured reports for security and governance teams

Coverage

Arko reasons across the full development surface — application code, dependencies, infrastructure-as-code, and CI/CD pipelines — in a single scan.

Application code

JavaScript, TypeScript, Python, Ruby, Go, Java, C#, PHP, SQL, HTML, Rust, Swift, Kotlin, Scala, Elixir, C, C++, Objective-C, Clojure, Dart/Flutter, Delphi / Object Pascal (.pas, .dpr, .dpk, .pp), and COBOL (.cob, .cbl, .cpy). Coverage spans modern stacks, legacy ERP, and mainframe / financial-services codebases in one tool.

Software Composition Analysis (SCA)

Arko parses dependency manifests across npm (package.json), Python (requirements.txt), Go (go.mod), Java (Maven pom.xml), Rust (Cargo.toml), Ruby (Gemfile), Swift (Package.swift), Scala (build.sbt), Elixir (mix.exs), Clojure (project.clj), and others — then resolves each package against known CVEs.

Findings Arko surfaces today include:

• lodash prototype pollution
• jsonwebtoken algorithm confusion
• axios SSRF
• Log4Shell (log4j CVE-2021-44228)
• dgrijalva/jwt-go CVE-2020-26160

Infrastructure as Code (IaC)

Arko scans Terraform (.tf, .tfvars, .hcl), Kubernetes manifests (.yaml), and Dockerfiles for security misconfigurations.

Findings Arko surfaces today include:

• RDS instances marked publicly_accessible = true
• KMS key policies granting Principal: "*"
• Pods with hostPID: true enabled
• Security groups open to 0.0.0.0/0
• Hardcoded credentials in Terraform default values

CI/CD pipeline security

Arko scans GitHub Actions workflows (.github/workflows/*.yml) for secrets and supply-chain issues.

Findings Arko surfaces today include:

• Hardcoded secrets in workflow env: blocks
• Unsafe pull_request_target triggers that check out untrusted PR code with elevated permissions
• Command injection via unquoted ${{ github.* }} context variables in run: steps
• Missing permissions: blocks (defaults to write-all)

Multi-layer AI decision engine

Every finding passes through Arko's proprietary decision engine before it reaches your IDE:

• Deterministic foundation — fast pattern detection for known vulnerability classes, paired with heuristic file scoring that decides what's worth deeper analysis
• Multi-stage AI reasoning — every candidate is evaluated against your architecture, exploitability, and trust boundaries before being shown
• Human-in-the-loop — your accept and dismiss decisions tune Arko's accuracy per tenant over time

Most SAST tools surface raw pattern matches and leave you to triage the noise. Arko's validation layer evaluates every candidate against your specific architecture before it reaches you — which is why developers actually triage Arko findings instead of ignoring them.

EU data residency

Contact DevSecAI to discuss your organisation's deployment requirements.

What Makes Arko Different

Most teams currently buy four separate security tools and still get noisy, context-free findings. Arko replaces all four with one IDE plugin and strengthens every finding with multi-layer AI validation.

Plus:

• All four categories run from your IDE in the free Community edition.
• Every finding goes through multi-layer AI validation that filters false positives, validates exploitability against your architecture, and prioritises by real attack feasibility.
• With Enterprise, the same engine runs across your repos and CI/CD pipelines, with unlimited scans.
• Runs on private model hosting in EU infrastructure. No third-party AI APIs.
• All outputs unify into a single Hackable Score per repo. One number to track posture.
• All map to one set of compliance frameworks (OWASP, PCI DSS 4.0, DORA, GDPR).

Arko functions as a security architect inside the IDE, with governance visibility at the enterprise layer.

Core Capabilities

Four scanning categories

SAST (Static Application Security Testing) Detects vulnerabilities in your code as you write: SQL injection, XSS, command injection, path traversal, weak cryptography, exposed secrets, sensitive logging, insecure random, and modern AI-native risks like prompt injection and insecure LLM integrations. Combines deterministic pattern detection with AI-driven contextual reasoning.

IaC (Infrastructure as Code) Scans Terraform, CloudFormation, Kubernetes manifests, Docker configs, and serverless definitions for misconfigurations and policy violations.

SCA (Software Composition Analysis) Identifies known-vulnerable dependencies and supply chain risks across your package manifests (package.json, requirements.txt, go.mod, pom.xml, and others).

Threat Modelling AI-generated threat models specific to your stack, architecture, and integrations. Maps endpoints, trust boundaries, data flows, and authentication patterns. Identifies real attack paths.

Multi-layer AI validation

Every finding from the four scanning categories is reasoned over by a multi-stage AI pipeline before it ever reaches your screen. The pipeline:

• Maps endpoints, trust boundaries, and data flows
• Identifies authentication and access control patterns
• Validates whether each finding is exploitable in your specific architecture
• Filters false positives based on context
• Prioritises by realistic attack feasibility, not generic CVSS scores
• Detects implemented and missing security controls

This is the differentiator versus traditional SAST/IaC/SCA tools that produce raw findings without architectural context.

Cross-cutting features

• Hackable Score — A real-time 0 to 100 score representing overall system exposure, updating as posture improves.
• Security Control Validation — Detection of implemented and missing security controls across authentication, input validation, encryption, access control, logging, and DevSecOps workflows.
• Compliance & Regulatory Mapping — Maps controls and findings to OWASP, PCI DSS 4.0, DORA, GDPR, NIST CSF, and ISO 27001.
• Fix in Flow — Contextual remediation guidance, passable directly to your AI coding assistant.
• Exportable Reports & Badge — Structured security reports for auditors, plus an embeddable Hackable Score badge for your repos.

Editions

For Enterprise pricing, a demo, or design partner conversations, get in touch at info@devsecai.io.

Enterprise Control Plane

The Arko Enterprise Control Plane gives security and engineering leaders centralised visibility across every repository scanned through the IDE plugin, your repos, and your CI/CD pipelines.

What it does:

• Posture across the organisation — See the Hackable Score for every repo, with trends over time.
• Policy push to developer IDEs — Define security policies centrally and enforce them in real time inside the developer's editor.
• Control coverage tracking — Monitor which security controls are implemented across teams and projects.
• Findings management — Triage, accept, or reject findings with full audit trail.
• Compliance reporting — Generate audit-ready reports mapped to OWASP, PCI DSS 4.0, DORA, GDPR, NIST CSF, and ISO 27001.
• Team visibility — See who's fixing what, with leaderboards and posture trends per developer and team.
• Tenant isolation — Each organisation operates in its own isolated environment with its own policy profile and accuracy tuning.

Get in touch:

For enterprise pricing, a demo, or design partner conversations, contact info@devsecai.io or visit devsecai.io.

How We Handle Your Code

Transparency is core to Arko.

During analysis:

• Project files are transmitted securely over HTTPS (TLS).
• Runs on AI models in self-hosted infrastructure. Code never leaves EU infrastructure.
• The hosting layer is contractually private. Code is not shared with model providers, not used to train models, and not retained by the inference layer.

Stored only:

• Vulnerability snippets (the specific lines flagged as risky, not full files)
• Scan metadata (file counts, timestamps, duration)
• Generated threat models
• Recommendations
• Hackable Score history
• Control validation results

Never:

• Sold or shared with anyone
• Retained as full source files after analysis
• Accessed outside scans you initiate
• Used to train AI models

You control:

• Every scan, nothing runs without your action
• Exclusion patterns (.env*, secrets/**, *.pem, *.key by default)

Getting Started

1. Install the extension from the VS Code Marketplace or Open VSX.
2. Click the Arko icon in the Activity Bar.
3. Sign in with your account (or create one at devsecai.io).
4. Open a project and click Run Security Scan.

Configuration

Requirements

• Any VS Code-compatible IDE (VS Code, Cursor, Windsurf, VSCodium, Code-server) version 1.85+
• An Arko account (sign up free)

Links

• Website
• Privacy Policy
• Terms of Service
• Contact: info@devsecai.io