An explicit evidence level
Findings tell detected, reachable and confirmed apart. A reachable flow carries a witness anchored in the code, and a confirmation shows where it comes from: a pentester, a runtime test or DAST.
Tamis vs Aikido
Aikido and Tamis cover the same scope: code, dependencies, secrets, IaC, containers and DAST, with Opengrep among their engines. Tamis also installs fully on your premises, air-gapped included, tracks risk project by project and brings your other scanners' results together.
Updated 9 October 2026 · by the Tamis team
Written by the vendor of Tamis, from Aikido's public documentation (sources below). Method and full comparison.
Why choose Tamis
- An explicit evidence level
- Whole platform on premises, air-gapped included
- Risks and evidence per project
Comparison
Reachability scopes differ across vendors (method, languages). “Partly”: open-source engine, proprietary platform.
| Criterion | Tamis | Aikido |
|---|---|---|
| What is scanned | ||
| Code (SAST) | Yes | Yes |
| Dependencies (SCA) | Yes | Yes |
| Secrets | Yes | Yes |
| Infrastructure as code | Yes | Yes |
| Containers | Yes | Yes |
| Deployed app (DAST) | Yes | Yes |
| SBOM export | Yes | Yes, paid |
| License policies | Yes | Yes |
| Prioritisation | ||
| Dependency reachability | Yes, 8 ecosystems | Announced |
| AI fixes | Yes | Yes |
| Import from other tools | Yes, SARIF and 4 formats | Limited |
| Correlation | ||
| Deduplication across scanners | Yes | Not established |
| Code linked to the deployed app (SAST and DAST) | In development | Not established |
| Attack chains across findings | Yes, MITRE ATT&CK | Partly, cloud and containers |
| One flaw, every affected project | Yes | Not established |
| Hosting | ||
| SaaS in the EU | Yes | Yes |
| Whole platform on premises | Yes | Not established |
| Scanner on your side, SaaS results | In development | Yes |
| Open-source engine | Partly | Partly |
| Governance | ||
| SSO | Yes | Yes, paid |
| Reports per framework | Yes | Yes |
| Risks and evidence per project | Yes | Not established |
| Beyond scanning | ||
| Threat modelling (DFD, STRIDE) | Yes | Not established |
| Architecture linked to findings | Yes, C4 and DFD | Not established |
| Manual pentest tracking (WSTG, ASVS) and report | Yes | Not established |
| Autonomous AI pentesting | Yes | Yes, Aikido Attack |
| Retest of a fixed finding | Yes, supported scanners | Yes, AI pentest |
| EBIOS RM workshops | Yes | Not established |
What Tamis does differently
AI fixes that are re-scanned
For supported cases, the proposed fix is re-scanned on a copy of the code to check that the targeted finding is gone. The pull request only opens behind an approval bound to that fix.
Your data, your AI
A local model can give the first triage verdict; the cloud provider is optional and chosen by your administrators. Every suggestion stays a proposal until you decide.
One vulnerability, every affected application
When a shared component is vulnerable, Tamis shows the projects that use it and tracks, project by project, the decision, the fix and its evidence. The same risks and evidence feed your NIS2, DORA or ISO 27001 files.
SaaS at OVHcloud or Scaleway or on premises
SaaS run at OVHcloud or Scaleway in the European Union, or the whole platform on your infrastructure, air-gapped included.
Keep your current scanners
SARIF, Snyk, SonarQube, Nessus and Qualys reports are imported and tracked with the rest, without replacing what already works.
Questions
Do both use Opengrep?
Yes, among other engines. Rules and the rest of the analysis differ.
Do both host in the EU?
Yes: Aikido on AWS in its EU region, Tamis at OVHcloud or Scaleway.
How can I judge Tamis on my code?
With the free 14-day POC: three projects of your choice, and success criteria agreed together before the first scan.