Track Progress and Findings

Follow an AI Code Analysis while it runs and read the findings it produces.

Once you've started an analysis, Aikido takes you to the assessment detail page. From there, you can watch progress and read findings as they land.

Tracking progress

Open an assessment from the AI Code Analysis home to see its detail page. The page has an Overview tab, an Issues tab (with a badge when there are open issues), and a Threat Model tab when one's available. See Threat Model for how to read it. Data Exposure Audits don't include a Threat Model tab. While the analysis is running, the Overview tab shows the current status and the header shows elapsed time and an estimated time remaining.

The AI Code Analysis Information block lists who requested the analysis and when it started. Code & documentation lists the repositories linked to the analysis.

Analysis statuses

The status on the Overview tab reflects where the analysis is in its lifecycle:

• Pending: The analysis is queued and waiting for agent capacity.
• Running: Agents are actively reasoning over your code. Findings can land in the Issues tab while this status is showing.
• Completed: The analysis finished. All findings are in the Issues tab and in your global feed.
• Failed: The analysis couldn't finish. Open the assessment for details, or reach out via Intercom chat.
• Cancelled: The analysis was stopped before it completed.

Reading findings

Findings appear in the Issues tab on the assessment and in your global issue feed alongside other Aikido findings. They follow the standard Aikido finding lifecycle. See Manage Findings for ignore, snooze, severity, and task-tracker integrations.

Click Attack Analysis on any finding to open the standard Aikido finding modal, with sections for summary, description, risk, root cause, remediation, and more.

The reproduction block is titled Evidence rather than Reproduction Steps. The content is code- and reasoning-based. It points at the specific files and logic that make the issue exploitable, rather than walking through a live HTTP exploit. Treat it as the developer-facing justification for the finding.

Once you've pushed a fix, click Re-test on the finding to have Aikido re-check it against your latest code.