API Security Tools

Aikido provides everything the average startup to mid-market company needs for security in a box - every code and cloud security scanner under the sun without much feature compromise, alongside a surprisingly robust runtime application solution for things like bot prevention. A no-nonsense replacement for a lot of more "specialized" solutions that tend to slow developers down.

Escape is doing amazing things with their approach to DAST. They thoroughly discover your APIs and schemas by searching your frontend code, and then test those APIs from the outside. They have great scanning support for modern languages, and also in depth testing configurations.

StackHawk is a developer-first DAST, and it shows every step of the way. They're built to scan quickly, in pipeline, and make it easy to attempt to reproduce issues. They're a major player in reshaping modern DAST and have really paved a way for the future with features like fuzzing API specific data.

Akto has created an open source flavored approach to next generation DAST and API security with features like looking at log data for API discovery, sensitive data flows, and customized scanning. A uniquely helpful feature is the ability to easily edit and tweak tests from the UI.

Pynt has created an elegant solution for running DAST type scanning against your APIs by running tests via a local proxy. This helps to bypass a lot of the pain with configuring DAST tools against your endpoints. They also do API discovery, drift detection, and testing via network integrations.

Levo does a ton of neat stuff with only a lightweight ebpf agent. They create full API schemas which can be real sources of truth, detect version changes, run DAST testing, and look for missing auth tokens. This covers areas where I most commonly see misconfigurations lead to actual exploits - accidental configs of public APIs without authentication. They are more on the testing side of API security.

Ghost Security provides external API first DAST scanning combined with integrations for API discovery. They're leaning more into agentic AI for discovery and fixing.

42 Crunch has built a very OpenAPI focused API security solution. It can scan for endpoints, offer suggestions on basic WAF like protections, and enforce that runtime via sidecar. They have a pretty robust VSCode extension for building custom tests. They are more on the testing side of API security.

Nighvision creates API docs based on scanning your code, and then tests those endpoints from the outside based on the docs they created.