Aikido Security buys Israel's Root: AI that patches open source without breaking dependencies

Aikido Security, based in Ghent, Belgium, announced on July 6, 2026 that it has acquired Israeli startup Root, whose AI agents fix vulnerabilities in open source components without disrupting the applications that depend on them. Most cybersecurity tools cannot do this.

Why automatic patching of open source remains an unsolved problem

Thousands of vulnerabilities are discovered in open libraries every year. Scanners have long been good at finding them, so detection is not the issue. The problem is the next step. Modern applications are built on hundreds of dependencies linked in complex graphs: library A requires library B, which requires library C, and so on. Updating a component at one level can break something at another.

That is why security teams have faced the same situation for years: the vulnerability is found and a patch exists, but applying it without risking a broken application takes manual work from an experienced engineer. This often takes days, sometimes weeks. The window of vulnerability stays open much longer than it should.

Root approaches the task differently. The startup's AI agents do not simply push an update. They analyze the dependency graph, understand the context and produce a patch that accounts for the entire chain. According to Aikido, this is what sets Root apart from competitors: other tools can find vulnerabilities but cannot fix them.

• Aikido Security was valued at $1 billion in January 2026, faster than any other cybersecurity company in Europe
• Aikido is based in Ghent, Belgium
• Root is an Israeli startup specializing in automated AI patching of open source components
• Key difference from alternatives: the AI fixes a vulnerability without disrupting the applications that depend on it

Why Aikido needs this deal

In January 2026, Aikido Security became Europe's first cybersecurity unicorn, reaching a $1 billion valuation faster than any competitor on the continent. Now the company is expanding its technology stack. Acquiring Root is a step toward a platform that covers the full security lifecycle, from detecting a vulnerability to applying a ready patch.

The commercial logic is clear. Most DevSecOps tools today stop at "find and report", leaving the remaining work to the engineer. If Aikido can offer a "find, explain and fix automatically" cycle, that is a fundamentally different value proposition, especially for large companies with thousands of dependencies in their codebase.

The context makes the deal even more significant. Open source is now the infrastructure foundation of most enterprise software, from clouds to banking systems. That makes the ecosystem a target: supply chain attacks are becoming more common, and attackers know slow patching works in their favor. Aikido plus Root is a direct response to that problem.

What this means

Aikido is steadily building a European answer to the American cybersecurity giants. The Root acquisition adds a technology that competitors have not yet reproduced: automated AI patching that accounts for transitive dependencies. Success will depend on how reliably the agents perform in real enterprise environments with nonstandard stacks. If the answer is positive, Aikido will have a strong argument in the fight for the enterprise DevSecOps market, both in Europe and beyond.