Caido
Caido builds a lightweight Rust-based web security testing toolkit for penetration testers, security engineers, and bug bounty hunters, offering a client-server proxy with HTTPQL filtering, a plugin ecosystem, and AI integration via third-party LLM providers.
- Company typePrivate
- Founded2021
- HeadquartersMontreal, Canada
- Headcount1–10
- GTM typeB2B
- OfferingSoftware
What Caido does
Caido is a Montreal-based web security testing toolkit company founded in 2021 and operated as Caido Labs Inc. The company builds a lightweight, Rust-based web proxy with a client-server architecture and a Vue.js frontend, targeting professional penetration testers, security engineers, and bug bounty hunters. Its core product includes the proprietary HTTPQL query language for filtering HTTP traffic, a node-based Workflows automation system, full WebSocket support, and a plugin ecosystem of 67+ extensions (14 official, 53 community) authored by 33 contributors using HTML, CSS, and JavaScript. Caido integrates AI capabilities through the Shift plugin (acquired July 2025) and supports multiple LLM providers via OpenRouter, with a Client SDK, GraphQL API, and MCP server enabling programmatic and agentic control of the proxy.
The company operates a freemium product-led growth model with a free Basic tier, Individual licenses at $200/year, Team licenses at $300/year/user, and custom Enterprise pricing. It has localized pricing for Brazil and India based on purchasing power parity and offers a free one-year Student/Teacher plan. Distribution occurs through direct website download (Windows, macOS, Linux, CLI) and through pre-installation partnerships with Parrot Security OS, Exegol, Kali Linux, Athena OS, and Hack The Box's Pwnbox environment. As of mid-2026 Caido claims 8,000+ monthly users, 1,000+ paying customers, and a 4,500+ member Discord community.
Caido is 100% bootstrapped and 100% independent with no external funding and approximately eight team members. The company ships frequent product releases (v0.52.0 through v0.57.0 between September 2025 and June 2026), expanded into AI agent integrations via partnerships with Strix (June 2026) and the Caido Skill for AI agents (March 2026), and added an education offering through the labs.caido.io platform in partnership with HackingHub (December 2025). Advisors include Justin Gardner, Ben Sadeghipour, and Joseph Thacker.
Caido firmographics
Firmographics- Name
- Caido
- Legal name
- Caido Labs Inc.
- Website
- https://caido.io
- Company type
- Private
- Founded year
- 2021
- Operating status
- Operating
- Headcount range
- 1–10 employees
- Short description
- Caido builds a lightweight Rust-based web security testing toolkit for penetration testers, security engineers, and bug bounty hunters, offering a client-server proxy with HTTPQL filtering, a plugin ecosystem, and AI integration via third-party LLM providers.
- Ownership category
- akta.pro rank
Caido industry classification
Industry- Product category
- Web Application Security Testing Software
- NAICS
- Other Computer Related Services (541519)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Packet Brokers & Network Traffic Visibility (TAPs, NPBs) (HDADABAM)
Keywords
Where Caido is headquartered
LocationHeadquarters
- HQ city
- Montreal
- HQ country
- Canada
- HQ region
- North America
Markets served
Caido business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure
Revenue model
- Subscription Licenses: Four-tier subscription model: Basic (free with limits: 2 projects, 7 workflows, 3 plugins, 5 filter presets), Individual ($200/year for unlimited features), Team ($300/year/user with shared instances and centralized billing), and Enterprise (custom pricing with unlimited users and compliance features). Gift vouchers available for 1 month ($20), 3 months ($60), 6 months ($100), and 1 year ($200). Localized pricing implemented for Brazil (50% reduction) and India (65% reduction) based on purchasing power parity.
- Shift AI Plugin: Shift AI plugin was acquired in July 2025 and made free for all paid Caido users. Originally a separate subscription product.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Annual | Free tier for exploration |
| Subscription | Annual | For independent security researchers |
| Subscription | Annual | For pentesters and security teams |
| Subscription | Annual | For organizations with governance and compliance needs |
Go-to-market motion2 records
Distribution channels5 records
Marketing channels8 records
Caido product offering
Product offeringCore offering
Caido is a lightweight web security auditing toolkit built around a Rust-based intercepting proxy that enables security professionals to inspect, intercept, replay, and manipulate HTTP and WebSocket traffic during penetration tests and bug bounty engagements. It includes a proprietary query language (HTTPQL), a node-based workflow automation system, a plugin ecosystem, and AI-powered testing through the Shift plugin that integrates with Anthropic, Google, OpenAI, and OpenRouter. The platform is delivered as a desktop application, a CLI for headless deployment, and an enterprise tier for security teams needing centralized billing and custom integrations.
Product overview
Caido is a modern web security testing toolkit positioned as an alternative to Burp Suite, designed for pentesters, security engineers, and bug bounty hunters. The core platform is built in Rust with a Vue.js frontend and client-server architecture supporting both desktop app and CLI deployment. It integrates AI capabilities through the Shift plugin (acquired July 2025) and supports multiple LLM providers via OpenRouter (Anthropic, Google, OpenAI). The extensible plugin ecosystem includes 14 official and 53 community plugins for specialized testing. Developer access is provided via Client SDK, Backend SDK, Frontend SDK, and GraphQL API. Caido Labs offers hands-on learning environments in partnership with HackingHub. The product is 100% bootstrapped and independent with approximately 8 team members and 8,000+ monthly users.
Differentiator
Problem solved
Functional benefit
Products and services
- Caido Web Security Testing Toolkit Primary web security testing toolkit designed for pentesters, security engineers, and bug bounty hunters. Offers a lightweight, Rust-based proxy with AI-powered features, HTTPQL traffic filtering, workflow automation, and client-server architecture.
- Caido Desktop App Native desktop application for Windows, macOS, and Linux enabling direct local deployment of the Caido proxy or connection to remote instances, with full UI for traffic interception, replay, automation, and project management.
- Caido CLI Command-line interface for deploying Caido remotely on any platform without GUI dependency, enabling headless proxy deployment and API-first automation workflows for security teams.
- Shift AI Plugin AI-powered autonomous agent integration acquired in July 2025, now part of Caido core. Enables context-aware AI agents to draft payloads, execute security testing tasks, and automate workflows using natural language commands with visibility into project scope and findings.
- Caido Labs Hands-on security learning platform with practice labs covering vulnerabilities like SQL injections, XSS, and web security fundamentals. Partnership with HackingHub provides structured learning paths and secure practice environments.
- Caido Student/Education Plan Free one-year license program for students and teachers at accredited institutions, providing Individual plan access for educational purposes with automatic activation upon account verification.
- Caido Client SDK TypeScript/JavaScript SDK (@caido/sdk-client) enabling external scripts, CI/CD pipelines, and AI agents to programmatically connect to Caido instances, orchestrate plugin actions, seed scopes, and drive automation tasks.
Quantifiable outcome
- 80% of Caido users report working faster with workflows
- +3 more outcomes
Companies that use Caido
Customer profileNamed customers1 record
Segments4 records
Ideal customer profiles4 records
Caido technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration6 records
AI capability7 records
Feature7 records
Caido partnerships and signals
Strategic signalPartnerships
Seven partnerships are on record, tiered core.
- StrixcoreStrix is the autonomous offensive security platform that natively integrates Caido into its agentic engine. Strix brings a Caido proxy directly into an autonomous testing workflow, enabling purpose-built interface for agents to execute, replay, and chain requests with full human-in-the-loop visibility and control. The integration improved vulnerability detection accuracy from 82% to 96% in Strix's benchmarks.
- HackingHubcoreCaido partnered with HackingHub to build the next iteration of their labs platform (labs.caido.io). HackingHub provides the underlying infrastructure for secure, complex lab environments where users can practice web security testing with Caido. Future plans include learning paths tied to specific vulnerabilities and Caido 101 courses.
- Kali LinuxcoreCaido was added as one of 10 new security tools in Kali Linux 2025.3 release. Caido is included in the rolling distribution of Kali Linux for web application security testing.
- Shift (Shift Plugin)coreCaido acquired the Shift AI plugin and made it free for all paid Caido users. Shift provides AI-powered plugin integration with autonomous agents for security testing. Joseph Thacker (@Rez0), creator of Shift, joined Caido as an advisor for AI initiatives.
- Parrot Security OScoreCaido is pre-installed and fully optimized in Parrot Security OS, allowing users to start using the web application security testing tool right out of the box without manual installation or setup. This partnership brings Caido to Parrot's community of security professionals focused on penetration testing, digital forensics, and privacy protection.
- ExegolcoreCaido comes pre-installed in Exegol images, ready for container-based assessments. Exegol is a community-driven platform for security testing environments.
- Hack The Box (Pwnbox)coreCaido is available in the Pwnbox environment on the Hack The Box platform, integrated through the ParrotOS partnership.
Scale indicators8 records
Recent moves6 records
Expansion highlights7 records
Caido competitors and assessment
Company assessmentDirect peers
- Detectify: Detectify provides automated web application and API security testing as a SaaS platform with crowdsourced vulnerability intelligence. It competes for the same security testing budget as Caido's enterprise tier, with a focus on continuous scanning rather than proxy-based manual testing.
- Probely: Probely is a web application security scanner aimed at developers and security teams with CI/CD integration. It serves overlapping use cases with Caido's Security Engineer segment, particularly for organizations automating security testing in pipelines.
- OWASP ZAP: OWASP Zed Attack Proxy is an open-source web application security scanner and proxy widely used by security professionals and developers. It competes with Caido in the same intercepting-proxy category and is bundled with many of the same security distributions Caido targets.
- StackHawk: StackHawk provides DAST (dynamic application security testing) tools designed for developers and CI/CD pipelines. It overlaps with Caido on web application security testing automation and developer-friendly workflows, though focused more on scanner-as-a-service than proxy tooling.
- PortSwigger: PortSwigger develops Burp Suite, the dominant commercial web application security testing platform and Caido's primary competitor. Both products target pentesters, security engineers, and bug bounty hunters with HTTP interception proxies, plugin ecosystems, and scanner capabilities.
- Invicti (Netsparker): Invicti (formerly Netsparker) offers enterprise web application security scanning, including DAST and API security testing. It targets similar application security testing use cases as Caido but at enterprise scale with proof-based scanning rather than proxy-centric workflows.
- Mitmproxy: Mitmproxy is an open-source interactive HTTPS proxy used for security testing and traffic interception. It targets the same pentester and security engineer audience as Caido with a focus on scripting and programmability, though without Caido's AI/Workflow layer.
Emerging players
- Traceable AI: Traceable AI focuses on API security testing and runtime protection, an adjacent category to Caido's web proxy focus. As APIs become the dominant attack surface, it represents an emerging player in the broader application security testing market that overlaps with Caido's API-focused use cases.
Broad incumbents
- Tenable (Nessus / WAS): Tenable offers Web App Scanning within its broader exposure management platform alongside Nessus vulnerability scanning. It serves enterprise customers seeking consolidated security testing capabilities, competing with Caido's enterprise tier at a portfolio level rather than as a dedicated proxy tool.
- Rapid7 (InsightAppSec / tCell): Rapid7 is a broader security platform offering InsightAppSec for dynamic application security testing alongside vulnerability management, SIEM, and orchestration. It overlaps with Caido's enterprise web testing capabilities but as part of a much wider portfolio rather than a specialist proxy tool.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks7 records
Key highlights7 records
Customer concentration
Caido social profiles
Digital presenceCaido financial estimates
Financial estimateRevenue estimate
Valuation estimate
Caido leadership team
Management profileNumber of profiles
Profiles11 records
Caido funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Caido M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Caido
What does Caido do?
Caido is a lightweight web security auditing toolkit built around a Rust-based intercepting proxy that enables security professionals to inspect, intercept, replay, and manipulate HTTP and WebSocket traffic during penetration tests and bug bounty engagements. It includes a proprietary query language (HTTPQL), a node-based workflow automation system, a plugin ecosystem, and AI-powered testing through the Shift plugin that integrates with Anthropic, Google, OpenAI, and OpenRouter. The platform is delivered as a desktop application, a CLI for headless deployment, and an enterprise tier for security teams needing centralized billing and custom integrations.
Is Caido a public or private company?
Caido is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was Caido founded?
Caido was founded in 2021. It employs 1 to 10 people.
Where is Caido based?
Caido is headquartered in Montreal, Canada, in the North America region.
How does Caido make money?
Two revenue lines are on record. Subscription Licenses are the primary driver. The others are shift AI Plugin.
Who are Caido's main competitors?
Direct peers on record are Detectify, Probely, OWASP ZAP, StackHawk, PortSwigger, Invicti (Netsparker) and Mitmproxy. Traceable AI is listed as an emerging player. Broad incumbents are Tenable (Nessus / WAS) and Rapid7 (InsightAppSec / tCell).
Does Caido have an API?
Yes. Caido offers a GraphQL API and multiple SDKs for plugin development and programmatic control. The Client SDK (TypeScript/JavaScript via @caido/sdk-client) enables external scripts and AI agents to connect to Caido instances, orchestrate plugin actions, seed scopes, and drive automation tasks. The Backend SDK allows plugin developers to create server-side extensions. The Frontend SDK provides UI customization for plugins. A Client CLI enables remote deployment. The AI SDK enables plugins to perform AI actions using the user's own API keys. MCP (Model Context Protocol) server integration is available via community contribution (caido-mcp-server), allowing AI agents to instantiate authenticated client connections and control Caido programmatically. Developer documentation is at docs.caido.io.
What industry is Caido in?
Caido's product category is Web Application Security Testing Software. Its primary akta.pro industry code is HDADABAM, Packet Brokers & Network Traffic Visibility (TAPs, NPBs). Its NAICS code is 541519 and its SIC code is 7372.