Aikido Cyberly Acquisition Takes Software Security Into Employee Protection

Aikido acquired Poland’s Cyberly to expand beyond software security, putting employee protection inside a business previously focused on securing code. The Aikido Cyberly acquisition, completed in September 2026 and announced alongside Noon on October 20, brings employee attack simulations into that expansion. Its central proposition is straightforward: protecting an application leaves an important gap when attackers can persuade someone authorized to use it.

Noon combines Cyberly with Belgian security company Outkept. Aikido says the new business brings together email protection, device protection, AI-use governance, and employee training. That combination challenges a divided approach in which separate teams handle software vulnerabilities, suspicious messages, employee behavior, and workplace AI tools.

The competitive reference is KnowBe4, which already markets automated, personalized security training. Aikido therefore enters a market with established alternatives, rather than discovering an unoccupied category. Its opportunity rests on connecting protection and training across everyday work. Its acquisition announcement establishes the strategy, but does not establish superior protection.

What the Aikido Cyberly Acquisition Adds

The acquisition gives Aikido a foundation for workforce security, extending its scope beyond the software development process.

According to the company’s workforce security launch, Cyberly contributed AI-driven attack simulations and visibility into employee AI usage. Outkept contributed email security and phishing awareness training. Phishing uses deceptive messages to induce actions such as revealing credentials or opening malicious links.

The company says it completed both acquisitions in September 2026. October 20 marks the public launch of Noon, rather than the transaction closing date. Keeping those dates separate matters when assessing how long the combined business has had to integrate its technology.

Aikido reports that Cyberly previously protected more than 300,000 employees across over 200 organizations. Outkept served more than 1,000 organizations and 250,000 users across over 100 countries. Those are company-reported historical figures, rather than independently verified measures of Noon adoption.

The figures should not simply be added together. Organizations can overlap, and “employees protected” does not necessarily describe the same measurement as “users served.” Neither figure reveals how many customers have adopted the combined platform.

The practical change is the scope of the security decision Aikido wants to influence. A software security purchase concerns the systems an organization builds and operates. Workforce protection also concerns how employees communicate, authenticate, install tools, and handle information.

That broader scope changes what buyers should expect from the company. A vulnerability finding can point to a specific software component requiring attention. An employee risk finding requires additional judgment about context, permissions, business needs, and appropriate intervention.

The acquisition also changes Cyberly’s strategic position. Its technology becomes part of a broader offering rather than carrying the entire customer proposition alone. In principle, that gives attack simulations a connection to protective controls and operational workflows.

However, ownership does not automatically create that connection. Buyers still need to distinguish shared branding from shared administration, coordinated responses, and consistent policies. A collection of acquired capabilities can remain a collection even when its marketing presents one product.

The Aikido Cyberly acquisition is therefore best understood as an expansion of responsibility. Aikido is asking customers to consider it for risks involving employees across the organization. That asks more of the company than adding another scanner to an existing software security workflow.

Security Teams Face a Broader Employee Protection Decision

Noon puts pressure on buyers to evaluate employee protection as an operational system, rather than a training requirement alone.

The immediate audience includes security leaders who already coordinate several kinds of workplace protection. Email administrators, identity specialists, employee training owners, and device teams approach related risks from different directions. A combined product creates a reason to reconsider those divisions.

That does not mean every organization should consolidate its vendors. Specialized tools can meet specific requirements better than a broader platform. The relevant question is whether separation creates gaps that a combined system can actually close.

Consider a hypothetical finance employee receiving an urgent request to change a supplier’s payment details. The message might look plausible, arrive during a busy period, and refer to familiar business activity. The employee’s decision matters, but so do approval rules and the ability to verify the request independently.

A training platform can help the employee recognize suspicious pressure. An email control can attempt to stop the message. A payment workflow can prevent an unverified change from becoming a completed transaction.

Those interventions address different points in the same potential incident. Treating any one of them as sufficient leaves the others unexplored. That is the strongest interpretation of Aikido’s expansion into employee protection.

It also explains why the announcement matters to people outside security departments. Finance, human resources, and support teams can become decision points in an attack without writing or administering software. Their everyday permissions make their workflows relevant to security.

The pressure on buyers is immediate at the evaluation stage, even before they consider replacing anything. A broader platform proposal requires them to identify who owns the combined outcome. Otherwise, a new console can become another responsibility without resolving existing coordination problems.

For smaller organizations, the potential attraction is fewer administrative handoffs. For larger organizations, the challenge is fitting a combined product into established responsibilities and controls. These are different buying situations, and the same consolidation argument will not suit both.

Workplace AI adds another layer to that decision. An employee can expose information through ordinary productivity activity without encountering a fraudulent message. Connecting AI-use policies with workforce protection therefore broadens the problem beyond recognizing scams.

That expansion deserves careful boundaries. Not every employee mistake is an attack, and not every unauthorized tool signals malicious intent. A security program that treats all unusual activity alike risks burdening legitimate work.

For employees, accessible guidance remains part of the operational picture. A searchable knowledge base can help people locate approved procedures when a request feels unusual. It supports a clear response process, while the organization remains responsible for defining that process.

Aikido’s proposition reaches this organizational boundary. Its success depends partly on whether customers can connect technical controls with decisions people make under pressure. Selling a wider set of features does not settle that question, but it makes the question unavoidable.

Noon Connects Simulations With Protection and AI Policies

The proposed mechanism is coordination: use protective controls, employee exercises, and AI policies to address related risks within one operating model.

Aikido’s employee protection capabilities describe personalized simulations spanning email, voice, text messages, and deepfakes. Deepfakes are synthetic audio or visual media that can imitate real people. The company also describes lessons delivered through workplace messaging tools.

Its announcement presents email threat removal, device protection, and controls over workplace AI use as complementary capabilities. These are company descriptions of the product’s intended scope. They should not be mistaken for independent findings about detection accuracy or prevention effectiveness.

The underlying logic is understandable. An exercise can reveal where an employee needs support. A policy can define an approved action. A protective control can intervene when the employee encounters a risky situation.

The value would come from making those elements reinforce each other. Training disconnected from actual workflows can teach an abstract rule without resolving the pressure employees face. Protection disconnected from employee feedback can miss useful context about confusing or suspicious activity.

A hypothetical support scenario illustrates the distinction. Someone impersonating an employee asks for an urgent account recovery action. A realistic exercise would test whether the support worker follows an approved verification process, rather than judging whether the caller sounds convincing.

That exercise would be more useful if the organization had a clear, workable verification process. Without one, the training merely asks employees to compensate for a missing control. The same limitation applies regardless of which vendor supplies the simulation.

The Aikido Cyberly acquisition makes this relationship central to the product story. Cyberly supplies experience in constructing employee-facing attack scenarios. The combined business must turn those scenarios into improvements that extend beyond the exercise itself.

AI-use visibility introduces another coordination problem. Knowing that employees use a tool is different from knowing whether a particular activity violates policy. Blocking that activity is a further capability, requiring reliable context and appropriate authority.

For that reason, buyers should separate discovery, interpretation, and enforcement when evaluating the announcement. A platform can offer visibility without delivering precise intervention. A policy dashboard can describe an intended rule without showing how consistently the rule operates.

The distinction also matters for employee trust. A person receiving a security prompt needs to understand the requested action. If the instruction conflicts with an established workflow, the organization needs a clear way to resolve that conflict.

A hypothetical employee handling confidential customer notes might receive guidance against submitting them to an unapproved AI service. The useful outcome is an approved path for completing the task. Repeated warnings without that path can create friction while leaving the underlying business need unresolved.

This is where the mechanism becomes more demanding than the headline. Generating realistic exercises is one task. Maintaining a coherent relationship between employee guidance, protective actions, and business processes is another.

Aikido’s expansion makes sense as an attempt to connect those tasks. The available announcements explain the intended combination. They leave customers to examine how much coordination exists in the deployed product.

KnowBe4 Already Offers Adaptive Training

Aikido’s competitive challenge is demonstrating a better combined workflow in a market where personalized, automated training already exists.

KnowBe4 announced adaptive security training through its AIDA Orchestration product on February 24, 2026. The company says it creates and schedules personalized phishing tests and training based on individual risk profiles. It also describes administrator controls over the automated program.

That provides an important reference for interpreting Noon. Personalization and automated campaign administration are already part of a competitor’s stated offering. Their presence in Aikido’s strategy does not, by itself, demonstrate a unique technical advantage.

Both companies’ effectiveness claims require the same scrutiny. A product announcement describes intended behavior and commercial positioning. It does not provide a controlled comparison showing which product reduces incidents more effectively.

The primary contest is broader than Aikido against KnowBe4. It is the case for coordinated workforce protection against the reality of separately managed controls. KnowBe4 supplies competitive context, while Aikido’s proposed integration remains the main issue.

For a buyer, that shifts the comparison away from counting features. Several products can advertise simulations, personalization, and administrative automation. The more useful distinction is what work remains after those features are enabled.

An administrator might still need to reconcile conflicting employee records, interpret separate risk scores, or move findings between systems. A combined platform earns its place when it reduces those burdens without weakening the controls customers need.

Aikido also faces a scope problem inherent in its strategy. Broad coverage creates more opportunities to simplify administration. It also creates more responsibilities involving deployment, permissions, support, and product consistency.

A specialist can concentrate its development effort on a narrower problem. A broader vendor must explain how its wider coverage improves the outcome enough to justify the additional scope. Neither approach wins automatically.

The same reasoning applies to existing customer relationships. A company already using Aikido for software security has a reason to examine Noon. That relationship can create access to a conversation, but it does not establish suitability for employee protection.

Different departments may own the decision, and different evidence may be required. Confidence in software vulnerability handling does not automatically transfer to employee monitoring, training design, or workplace policy enforcement.

The competitive opportunity is therefore practical. Aikido can make its argument through deployment clarity, useful coordination, and evidence that customers can operate the system effectively. Generic claims about using AI will carry less explanatory weight.

This comparison also tempers the idea that older vendors are necessarily standing still. KnowBe4’s announcement shows an established provider pursuing automation and personalization. Aikido enters an active contest over how employee protection should work, rather than a market awaiting its first AI product.

Realistic Simulations Do Not Establish Lower Incident Risk

The central uncertainty is whether the combined product improves real security outcomes beyond producing convincing exercises and easier administration.

A simulation measures performance in a constructed situation. An incident involves changing circumstances, business pressures, and systems outside the exercise. Improvement in one setting needs careful interpretation before it supports a claim about the other.

For example, a lower failure rate can reflect better employee judgment. It can also reflect easier scenarios, familiar templates, or changes in who received the exercise. Meaningful comparisons require enough context to distinguish those explanations.

This is an analytical limitation, rather than evidence against Cyberly’s technology. The reviewed launch materials do not provide an independent comparative evaluation establishing Noon’s effectiveness. That leaves an evidence gap around outcomes, even though the acquisition itself is confirmed.

A documented attack provides a useful reference. Microsoft’s investigation of payroll account attacks described compromised university employee accounts used to redirect salary payments. Attackers also hid notification emails by creating inbox rules.

Microsoft attributed the activity to Storm-2657 and explained that it did not represent a vulnerability in Workday itself. The case connects employee deception, account access, mailbox activity, and a consequential business action. It demonstrates why training represents only part of the defensive problem.

That case does not show that Noon would have prevented the attack. It supplies a concrete example against which a broad workforce security proposition can be examined. Any prevention claim would require additional evidence about deployed controls and the attack conditions.

Authentication remains a separate consideration. Microsoft’s phishing-resistant authentication guidance emphasizes methods such as passkeys and security keys. These use cryptographic credentials rather than relying solely on codes employees can disclose to deceptive sites.

Training and authentication address different failure modes. An employee can recognize a suspicious request and still need a safe way to respond. A technical control can block a credential theft attempt without teaching the employee how to handle another kind of fraud.

The combined product should therefore be evaluated alongside existing controls. A reduction in training administration does not establish stronger authentication. A more realistic simulated call does not establish safer account recovery or payment approval.

Privacy and employee trust create additional evaluation questions. Personalized programs necessarily make decisions about which interventions people receive. Buyers need understandable explanations of the information used, access permissions, and ways to correct inaccurate assumptions.

Those questions do not establish that Noon mishandles employee information. They identify areas where a broad employee protection platform needs clear documentation. The scope of the promise creates the need for that clarity.

The Aikido Cyberly acquisition also creates integration uncertainty. Existing customer relationships demonstrate prior use of the acquired businesses, but not successful migration to a combined product. Customers need concrete information about support, configuration continuity, and changes to their workflows.

A cautious reading preserves both sides of the story. Aikido has acquired relevant capabilities and articulated a coherent expansion. The public evidence reviewed here does not establish that combining them has already produced better protection than alternative arrangements.

What to Watch After Noon’s Launch

The most useful signals are deployment clarity, measurable customer outcomes, and evidence that the acquired products operate together.

First, watch for specific deployment information over the next several months. Buyers need to know which capabilities are available, what permissions they require, and how they interact with existing security tools. Clear boundaries would make the product easier to evaluate on its actual scope.

This signal strengthens Aikido’s case if customers can understand the offering without reconstructing it from separate announcements. It weakens the consolidation argument if essential functions remain ambiguous or require unrelated administrative processes.

Availability also deserves precise language. A public launch can describe an entire product direction while customers encounter staged access to individual capabilities. Buyers should judge the functions they can deploy, rather than assuming every announced feature has equal maturity.

Second, watch for customer evidence that explains how outcomes were measured. Useful reporting would identify the deployment context, the period observed, and the controls already in place. It would distinguish operational savings from changes in security performance.

Administrative time saved would support part of Aikido’s argument. More timely employee reporting, better handling of suspicious requests, or clearer incident coordination would support other parts. These outcomes should be described separately rather than collapsed into a single success label.

Evidence would be less informative if it offered only training completion rates or an unexplained risk score. Those measures can describe program activity without showing how employees and systems respond to actual threats.

Comparisons also need to account for changing conditions. A customer introducing a new training platform might simultaneously improve authentication or revise approval processes. Attributing every subsequent improvement to the platform would overstate what the evidence shows.

Third, watch how existing Cyberly and Outkept customers experience the combined business. Consistent policies, understandable administration, and continuity of support would substantiate the integration story. Persistent manual reconciliation would point to work still required.

The strongest version of Aikido’s strategy connects detection, employee guidance, and protective action through a workflow customers can understand. The weaker version groups useful products under a common name while leaving customers responsible for connecting them.

Neither outcome can be inferred from the acquisition announcement alone. The next evidence should come from deployments and customer experience, not simply from a broader feature list.

For organizations considering the Aikido Cyberly acquisition, begin with the incidents and decisions your current controls handle poorly. Compare the announced capabilities against those gaps, and ask which functions are available in your intended deployment. Request evidence that separates time saved from risk reduced, with enough context to assess both. Include employee-facing teams in that discussion, because they will live with the resulting prompts, policies, and response processes. Keep authentication, account recovery, and business approvals in view throughout the evaluation. The useful purchasing question is concrete: does the combined system help your organization stop a dangerous action, or respond to it more effectively, than its current arrangement?