Aikido built its name on one idea: make application security simple enough that developers stop hating it. Yesterday it said that idea works on everyone else too.
The Ghent company disclosed it closed two acquisitions in September. Cyberly, out of Poland and founded in 2024, does AI-driven attack simulations and visibility into employee AI use. It covered more than 300,000 employees across 200-plus organizations. Outkept, from Belgium and founded in 2020, brings email security and phishing training for more than 1,000 organizations and 250,000 users in 100-plus countries. Together they’re now Noon, a workforce security business inside Aikido (per Aikido). Terms: Undisclosed.
What Noon is. Four things in one console. Email protection that catches phishing and business email compromise past native filters and pulls it out. Simulations that go beyond email: deepfake voice calls, SMS, QR codes, multi-step campaigns. Device protection against malicious packages and AI instructions. And AI governance, a history of the AI tools, models and connections employees use. It plugs into Microsoft 365, Google Workspace, Slack and Teams, and feeds GRC platforms for SOC 2, ISO 27001, NIS2 and DORA evidence (per Aikido).
Why a code-security company wants this. Distribution. Aikido says more than 150,000 teams use its platform. That’s a customer list with a security buyer already on the hook. Security awareness and email add-ons are the classic second product for a mid-market or MSP-led account. Outkept’s founders now run Noon’s global MSP partnerships. That tells you the channel plan.
It’s also cheap breadth. Two small companies with live customers beat a two-year build. Aikido gets a product, a team and a book of business on day one, and a story for its next round.
The technical bet worth watching. It’s not the email filter. It’s the device agent. An agent that sees malicious packages, AI instructions and the AI tools employees run is sitting on the same laptop where developers run coding agents and pull dependencies. That’s Aikido’s home turf. If Noon’s device layer and Aikido’s code and supply-chain scanning share context, a poisoned package or a rogue agent skill shows up once, not in two consoles. That’s the real platform argument. Not fewer invoices. Fewer blind spots between them.
Where best-of-breed still wins. Email security is a detection game, and the incumbents have years of BEC models trained on huge mail volumes. A new entrant bundling email into a broader platform has to prove catch rates, not features. Large enterprises with a mature secure email gateway or API-based email tool won’t rip it out for a bundle. Noon’s realistic landing zone is the mid-market and MSP-managed shop running native Microsoft or Google filtering plus a standalone training tool. Its real competitor there is “good enough” plus inertia.
Training is a different problem. Verizon’s 2026 DBIR, as cited in Aikido’s release, found mobile social engineering such as fraudulent texts and voice calls succeeded 40% more often than email phishing, and that employee use of unapproved AI tools tripled to 45%. If those numbers hold, an awareness product that only tests email is testing the wrong channel. That’s a fair hit on legacy simulation vendors.
The financial read. No price, no revenue, no ARR for either target. You can’t run a multiple. What you can see is the pattern: a well-funded platform buying small, cash-efficient point products at the seed-to-Series-A stage, before they get expensive, and pushing them through an existing base. Expect more of it. Awareness, email add-ons and AI-usage visibility are crowded, subscale categories. Consolidation is cheaper for the buyer than competing.
What to ask before you consolidate. Run Noon’s email detection side by side with what you have, on your own mail, for 30 days. Ask whether the device agent replaces or adds to your EDR. Ask what data from Aikido’s code scanning actually flows into Noon today, not on the roadmap.
Our take: this is a smart land grab dressed as a product launch. Aikido is betting that small and mid-sized teams want one security vendor for code and people. Many will. The ones with a real email security team won’t, and Noon shouldn’t try to win them first.