API Security Tools

Aikido provides everything the average startup to mid-market company needs for security in a box - every code and cloud security scanner under the sun without much feature compromise, alongside a surprisingly robust runtime application solution for things like bot prevention. A no-nonsense replacement for a lot of more "specialized" solutions that tend to slow developers down.

Upwind has built CNAPP from the ground-up around runtime insights provided from a network focused endpoint agent. They provide unique features like API security, alongside vulnerability prioritization and scanning, and the more generic CNAPP feature sets.

Cloudflare is the traditional leader in API for good reason. They offer great in depth protection that is quick to respond to threats. The platform has grown overly complex for simple use cases.

The core of Sweet Security is powerful incident detection and response capabilities for cloud environments. They have since created a larger CNAPP platform expanding more into vulnerability management, posture, and identity capabilities

Escape is doing amazing things with their approach to DAST. They thoroughly discover your APIs and schemas by searching your frontend code, and then test those APIs from the outside. They have great scanning support for modern languages, and also in depth testing configurations.

StackHawk is a developer-first DAST, and it shows every step of the way. They're built to scan quickly, in pipeline, and make it easy to attempt to reproduce issues. They're a major player in reshaping modern DAST and have really paved a way for the future with features like fuzzing API specific data.

Operant has focused their application defense solution on securing AI workloads, providing features like runtime detection and redaction for production applications. They excel at securing Kubernetes workloads, and are especially strong at network detections.

Acquired by Akamai. noname built an API security tool the way a network engineer would, and the Akamai acquisition makes sense. They build maps of API's based on network logs, and alert with anomaly detection. That puts them in an awkward middle position compared to eBPF based solutions like Impart, or more developer focused tools like StackHawk or Escape. The response actions are building WAF rules and they're building testing functionality.

Akto has created an open source flavored approach to next generation DAST and API security with features like looking at log data for API discovery, sensitive data flows, and customized scanning. A uniquely helpful feature is the ability to easily edit and tweak tests from the UI.

Acquired by Harness. Traceable has built some amazing API security capabilities thanks to starting with tracing as their beginning. They do a great job patching information together in a way that makes it relevant for investigations

Impart has everything you'd want in an API security platform - they provide discovery, testing, and protection all in a single platform based on eBPF for network detection and prevention. They are more on the runtime side of API security.

Wallarm is one of the most robust and mature of API security vendors. They offer a ton of features - from API like runtime protection, to secrets detection, to static security testing.

F5 is a close second to Cloudflare for dedicated providers. Their load balancers and API's are able to scale to cloud native levels, but their pricing is often prohibitive for startups.

Pynt has created an elegant solution for running DAST type scanning against your APIs by running tests via a local proxy. This helps to bypass a lot of the pain with configuring DAST tools against your endpoints. They also do API discovery, drift detection, and testing via network integrations.

AWS WAF offers amazing out of the box protection with numerous rule packs, and integrates with more advanced rules if necessary. The only essential consideration and downside is their 16KB limit on request size which can be a breaking downside for some applications.

Levo does a ton of neat stuff with only a lightweight ebpf agent. They create full API schemas which can be real sources of truth, detect version changes, run DAST testing, and look for missing auth tokens. This covers areas where I most commonly see misconfigurations lead to actual exploits - accidental configs of public APIs without authentication. They are more on the testing side of API security.

AppSentinels is a robust runtime oriented API security platform that builds robust service mappings and has very good detection and response features. It's a very competitive offering to those like NoName, Salt, and Traceable.

I've requested a couple demos from Salt and they never replied ¯\_(ツ)_/¯. Based on an article from a couple years ago it seems like they mirror all your network traffic into their environment to model your APIs, but their marketing does say AI a few more times. It's funny that their marketing image has 1699 total events and 1696 of them were suspicious.

Ghost Security provides external API first DAST scanning combined with integrations for API discovery. They're leaning more into agentic AI for discovery and fixing.

Firetail offers API discovery via cloud logs or code scanning, can do log enrichment and anomaly detection, and a library that can wrap your application.

Fortinet's API security offering gets the job done, but we wouldn't recommend buying it as a standalone product. It's a good addition to their other offerings, but doesn't stand out on its own.

Like AWS, the GCP WAF offering is quite substantial. They also have an 8KB limit, but offer a great solution for GCP native applications.

42 Crunch has built a very OpenAPI focused API security solution. It can scan for endpoints, offer suggestions on basic WAF like protections, and enforce that runtime via sidecar. They have a pretty robust VSCode extension for building custom tests. They are more on the testing side of API security.

Nighvision creates API docs based on scanning your code, and then tests those endpoints from the outside based on the docs they created.