Goshawk compared with Aikido, Semgrep and HackerOne

If you already run one of them, here is what a Goshawk audit adds, what it does not do, and when to keep what you have.

Aikido and Semgrep sit in the developer's day: in the IDE, in CI, on every pull request, with fixes proposed as code. Goshawk does not, and is not meant to. HackerOne's Code Security Audit and Aikido's own Code Security Audit are closer to what Goshawk is, an audit of the whole codebase with a model reasoning over it, and HackerOne's checks each finding in a way close to ours: a second pass without shared context, told to attack the claim.

Where Goshawk differs is in what the report has to survive. Severity is a CVSS v4.0 vector computed by a library rather than estimated, the standard is OWASP ASVS 5.0 with a coverage table that says what was not verified, each finding carries the control it touches in NIS2, ISO 27001 or the Portuguese RJC, and a complete tier puts a senior human over the result.

Reviewed on 26 September 2026. Every statement about another product cites the vendor's own page, read that day; the sources are at the end. "Not described on the pages we read" means exactly that, and not that the product cannot do it.

Question Goshawk Aikido Semgrep HackerOne Code Security Audit
What it is A source-code security audit delivered as an application: an automated audit with its limits printed on the report, and a complete tier with senior human verification. A security platform for code, cloud and runtime, with its own AI Code Security Audit among the products.[1][2] SAST, SCA, secrets and malware protection on one platform, over an open-source engine.[11] An agentic audit that reasons across the codebase and returns a prioritised report.[21]
How a finding is checked Each finding goes to a blind second reviewer, who sees only the claim and its location and is instructed to refute it. What survives goes in the report. AI triage that prioritises findings and dismisses false positives.[4] Semgrep Multimodal combines AI reasoning with the rules to reduce what has to be triaged.[12] Close to ours: two passes that do not share context, the second directed to attack the claim.[22]
Severity A CVSS v4.0 vector per finding, scored by a deterministic library. No model estimates a score. Its own risk score from 0 to 100.[10] For dependencies, the CVSS score assigned to the CVE[27]; for code findings, not described on the pages we read. A qualitative scale, Critical to Informational.[22]
Standard measured against OWASP ASVS 5.0, with a coverage table chapter by chapter: verified, passed, failed, or could not be confirmed. An OWASP Top 10 report; ASVS not described on the pages we read. An OWASP Top 10 page; ASVS not described on the pages we read. OWASP Top 10 2025 and NIST SSDF, with a coverage map and the limits stated in the report.[22]
Regulation Each finding mapped to the controls of ISO 27001, NIS2 or the Portuguese RJC, whichever you answer to. NIS2 and DORA among the frameworks of its compliance reports.[9] FedRAMP, NIST 800-171, HIPAA, GDPR, PCI DSS, ISO 27001/27017 and SOC 2 listed; NIS2 and DORA are not.[19] Evidence for NIST, FS-ISAC and PCI DSS.[21]
Human review The complete tier adds senior human verification of the findings. Not described on the pages we read. Not described on the pages we read. Not part of the Code Security Audit; the separate H1 Code product has human-in-the-loop evaluation.[22][23]
Where it runs Fully managed, or hybrid with the scanning inside your perimeter; local model backends are supported. SaaS, with a local scanner that runs secrets, dependency and SAST scans inside your network.[5] In your CLI or CI; on-premises source-code management on Enterprise.[17][18] Connects to GitHub, GitLab, Azure DevOps and Bitbucket, SaaS and on-premises editions.[21]
In the developer's day None. Goshawk is an audit you run on demand, not a check on every commit. IDE plugins for VS Code, JetBrains, Cursor and Windsurf, and AutoFix pull requests.[3][6] CI for GitHub Actions, GitLab, Jenkins, Bitbucket and others, IDE plugins, and SARIF output.[16][17] Follow-up scans to confirm a fix holds; a report in hours.[21]
Beyond source code An SBOM of the dependencies; nothing outside the repository. Also containers, IaC, cloud posture, DAST and AI pentesting.[1] Also dependencies, secrets and malware.[11] SCA, IaC and secrets as well as SAST.[26]
Track record From DeltaCoders, which has built security software for regulated organisations since 2011. A Belgian company, ISO 27001, ISO 42001 and SOC 2 Type II.[1][8] SOC 2 Type II.[20] SOC 2 Type 2, ISO 27001 and FedRAMP; more than 1,300 companies as customers.[24][25]

When to pick them instead

If what you need is a check on every commit, pick Aikido or Semgrep: both live in CI and the IDE, and Goshawk does not. Pick Aikido if you want code, containers, cloud and runtime on one platform, fixes proposed as pull requests, and a free plan to start. Pick Semgrep if you want an open-source engine whose rules you can read and write yourself. Pick HackerOne if the audit has to feed a bug bounty or pentest programme, or you need FedRAMP, or reports in hours with retests after the fix.

When Goshawk is the better fit

When the report goes to an auditor, a supervisor or a board, and has to hold there. Goshawk scores each finding with a computed CVSS v4.0 vector, measures the code against OWASP ASVS 5.0 with a chapter-by-chapter coverage table, maps every finding to the NIS2, ISO 27001 or RJC control it touches, and delivers in English and Portuguese. When the code should not leave the building, the scanning can stay inside your perimeter. And when a machine's word is not enough, the complete tier adds a senior human to the verification.

Goshawk also sits beside a scanner you already run, rather than in place of it: the checks on every commit stay where they are, and the audit is what you hand over when someone asks whether the application is secure. See how Goshawk works, or the Security Audit if you would rather we run it.

Sources

  1. Aikido, home page, https://www.aikido.dev/, read on 26 September 2026.
  2. Aikido, Code Security Audit, https://www.aikido.dev/code/code-audit, read on 26 September 2026.
  3. Aikido, AutoFix, https://www.aikido.dev/code/autofix, read on 26 September 2026.
  4. Aikido, AI at Aikido, https://www.aikido.dev/use-cases/ai-at-aikido, read on 26 September 2026.
  5. Aikido, Local scanner, https://www.aikido.dev/code/local-scanner, read on 26 September 2026.
  6. Aikido, IDE integrations, https://www.aikido.dev/code/ide-integrations, read on 26 September 2026.
  7. Aikido, Pricing, https://www.aikido.dev/pricing, read on 26 September 2026.
  8. Aikido, Security, https://www.aikido.dev/security, read on 26 September 2026.
  9. Aikido Help, Security audit report, https://help.aikido.dev/compliance-and-reporting/reports/security-audit-report.md, read on 26 September 2026.
  10. Aikido Help, How the severity score is calculated, https://help.aikido.dev/getting-started/core-functionalities/how-is-severity-score-calculated.md, read on 26 September 2026.
  11. Semgrep, home page, https://semgrep.dev/, read on 26 September 2026.
  12. Semgrep, Semgrep Multimodal, https://semgrep.dev/products/semgrep-code/assistant, read on 26 September 2026.
  13. Semgrep, Community Edition, https://semgrep.dev/products/community-edition, read on 26 September 2026.
  14. Semgrep documentation, Licensing, https://semgrep.dev/docs/licensing, read on 26 September 2026.
  15. Semgrep documentation, Semgrep Pro and open source, https://docs.semgrep.dev/semgrep-pro-vs-oss.md, read on 26 September 2026.
  16. Semgrep documentation, Add Semgrep to CI, https://semgrep.dev/docs/deployment/add-semgrep-to-ci, read on 26 September 2026.
  17. Semgrep documentation, CLI reference, https://semgrep.dev/docs/cli-reference, read on 26 September 2026.
  18. Semgrep, Pricing, https://semgrep.dev/pricing, read on 26 September 2026.
  19. Semgrep documentation, Compliance, https://docs.semgrep.dev/compliance.md, read on 26 September 2026.
  20. Semgrep documentation, SOC 2, https://docs.semgrep.dev/compliance/soc2, read on 26 September 2026.
  21. HackerOne, Code Security Audit, https://www.hackerone.com/product/code-security-audit, read on 26 September 2026.
  22. HackerOne, Code Security Audit sample report (PDF), https://www.hackerone.com/sites/default/files/2026-09/H1-Code-Security-Audit.pdf, read on 26 September 2026.
  23. HackerOne, H1 Code, https://www.hackerone.com/product/code, read on 26 September 2026.
  24. HackerOne, Trust, https://www.hackerone.com/trust, read on 26 September 2026.
  25. HackerOne, home page, https://www.hackerone.com/, read on 26 September 2026.
  26. HackerOne, Code Security Audit solution brief (PDF), https://cdn.pathfactory.com/assets/11231/contents/1206962/ceb96584-9f91-4257-b4d8-d5c3062c2fea.pdf, read on 26 September 2026.
  27. Semgrep documentation, Understand severities, https://docs.semgrep.dev/kb/rules/understand-severities, read on 26 September 2026.

Aikido, Semgrep, HackerOne and H1 Code are trademarks of their owners, named here only to compare. Something here out of date or wrong about your product? Tell us and we will correct it.

Already running one of them?

Tell us which, and who the report has to satisfy, and we will say plainly whether a Goshawk audit adds anything.

Talk to Us