Aikido Security launched Noon on Tuesday, a workforce security platform that rolls email defense, phishing training, device protection, and AI governance into a single product. The Belgian unicorn built Noon from two acquisitions it closed in September—Poland's Cyberly and Belgium's Outkept—pulling 550,000 protected employees and roughly 1,200 organizations into its fold.
The timing is notable. Aikido made its name in developer security, scanning code repositories and cloud infrastructure for vulnerabilities. Now it's pivoting toward the messier territory of human error: employees clicking links, installing dodgy browser extensions, or feeding proprietary data into unapproved chatbots.
"We started Aikido to make securing software radically simpler," CEO Willem Delbare said in a statement. "With Noon, we're bringing the same approach to workforce security: one platform, less complexity, and protection for every employee, not just those building software."
Whether that simplicity translates in practice remains to be seen. The workforce security market is dense with specialists, each staking claims to narrow slices of the problem.
What the Platform Actually Does
Noon bundles four capabilities. Email protection sits atop Microsoft 365 and Google Workspace, filtering phishing and business email compromise attempts that slip past native defenses. Simulations span email, voice deepfakes, SMS, and QR codes, with training delivered inside Noon itself or piped into Slack, Teams, and Google Chat. Device-level scanning blocks malicious npm packages, IDE plugins, browser extensions, and risky AI "skills" before employees install them. AI governance, meanwhile, offers visibility into what models, tools, and agents employees are running on their machines, paired with policy enforcement and data-loss safeguards.
Connectors pull data from Microsoft 365, Google Workspace, Slack, and Teams into dashboards tailored for SOC 2, ISO 27001, NIS2, DORA, HIPAA, and GDPR audits, the company said. In other words, Aikido is packaging compliance theater alongside the technical controls.
Two Deals in One Month
Aikido acquired Cyberly—a Warsaw startup founded in 2024—and Outkept, a Ghent-based phishing awareness firm founded in 2020, both in September. The speed suggests the deals were negotiated in parallel, though Aikido disclosed neither price nor structure.
Cyberly had protected 300,000 employees across 200 organizations with AI-driven attack simulations and shadow-AI visibility, according to Sunday's release. Outkept served roughly 1,000 organizations and 250,000 users in 100+ countries with email security and phishing training built around a community of "ethical phishers," whatever that means in practice.
All four Cyberly co-founders remain with Aikido. Alex Horlach now leads product development at Noon. Outkept co-founders Simon Bauwens and Thibaut De Maerteleire lead global managed-service-provider partnerships and email security engineering, respectively. Retention of the founding teams suggests Aikido may intend to keep the acquired products alive rather than gut them for parts.
Horlach framed the acquisitions as bridging a persistent gap. "Attackers don't always need to break into software when they can simply trick the people using it," he said. "Yet the security industry has long treated software and workforce security as two separate worlds."
Entering a Crowded Market
That separation exists for a reason, perhaps. The workforce security market fragments across competing specialists. Phishing training is dominated by KnowBe4, Hoxhunt, Proofpoint, Cofense, and SoSafe. Supplemental email filters like Abnormal Security, Tessian, IRONSCALES, and Material Security layer atop Microsoft 365 and Google Workspace. Device security spans traditional endpoint-detection tools from CrowdStrike, SentinelOne, and Microsoft Defender alongside mobile-device managers like Jamf.
Aikido positions Noon's device layer as distinct, focused on the software supply chain rather than malware signatures. The distinction matters, at least in theory. Developer machines bristle with third-party packages and extensions that traditional endpoint tools often miss.
The AI governance piece addresses shadow IT around models and agents, an area that spans data-loss-prevention vendors and newer AI-monitoring tools. Aikido's release cited Verizon's Data Breach Investigations Report, noting mobile social engineering attacks now succeed 40 percent more often than email phishing and that unapproved AI use at work has tripled to 45 percent. (The company cited the 2026 report, which covers 2025 data.)
Federal Ambitions
The Noon launch follows Aikido's FedRAMP Moderate authorization in early October, clearing the company to sell into U.S. federal agencies. That certification process typically takes months, suggesting Aikido has been eyeing government contracts for a while.
In April, Aikido launched endpoint protection for developer devices targeting malicious code packages and AI tools. That earlier product now feeds into Noon's org-wide device layer, according to company materials. The timeline suggests Aikido has been assembling the pieces of a workforce platform for at least half a year, with the September acquisitions filling gaps in email and training.
Aikido raised $60 million at a $1 billion valuation in January 2026 and serves more than 150,000 teams, the company said. Customers include SoundCloud, Niantic, Runway, Handshake, and Deel. Whether those teams stick around as Aikido expands beyond its developer-security core is an open question.
Bauwens said the combined platform rethinks training for the AI era. "AI has fundamentally changed how we need to train and protect employees," he said. "What worked five years ago simply isn't enough anymore."
Maybe so. But convincing security teams to swap established vendors for a newcomer bundling four products into one will require more than a better dashboard. Aikido is betting that simplicity sells. The market will decide whether buyers agree.
