AppSecNews

API Security

API Discovery and Protection

Inventory APIs, test their authorization logic, and watch runtime traffic for abuse.

9 tools profiled

How it differs Discovers, tests and protects APIs specifically, often working from the OpenAPI contract or live traffic. General web scanning of the same endpoints is DAST.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals

9 tools

  • 42Crunch

    42Crunch

    API Security

    API security platform built around the OpenAPI contract, auditing definitions, scanning live endpoints for conformance, and enforcing the schema at runtime.

    Commercial, free tier +1
    Established

  • Akamai API Security (Noname)

    Akamai

    API Security

    API discovery, posture management and runtime threat detection built on the Noname platform, analyzing traffic out of band across gateways and clouds.

    Commercial
    Established

  • APIsec

    APIsec.ai

    API Security

    Automated API penetration testing that generates role aware test cases from a specification to probe authorization and business logic flaws.

    Freemium
    Growing

  • Cequence Security

    Cequence Security

    API Security

    Unified API protection platform combining external attack surface discovery, API posture analysis and machine learning driven bot and abuse defense.

    Commercial
    Established

  • Imperva API Security

    Imperva (Thales)

    API Security

    API discovery, risk classification and schema based protection delivered through Imperva's application security platform and cloud WAF.

    Commercial
    Established

  • 42Crunch

    42Crunch

    API security platform built around the OpenAPI contract, auditing definitions, scanning live endpoints for conformance, and enforcing the schema at runtime.

    Commercial, free tier +1 Established
    API Security

  • Akamai API Security (Noname)

    Akamai

    API discovery, posture management and runtime threat detection built on the Noname platform, analyzing traffic out of band across gateways and clouds.

    Commercial Established
    API Security

  • APIsec

    APIsec.ai

    Automated API penetration testing that generates role aware test cases from a specification to probe authorization and business logic flaws.

    Freemium Growing
    API Security

  • Cequence Security

    Cequence Security

    Unified API protection platform combining external attack surface discovery, API posture analysis and machine learning driven bot and abuse defense.

    Commercial Established
    API Security

  • Imperva API Security

    Imperva (Thales)

    API discovery, risk classification and schema based protection delivered through Imperva's application security platform and cloud WAF.

    Commercial Established
    API Security

  • Levo.ai

    Levo.ai

    API Security

    API security platform that uses eBPF sensors to catalog APIs from live traffic, trace sensitive data flows, and drive automated security testing.

    Commercial
    Growing

  • Salt Security

    Salt Security

    API Security

    API security platform that mirrors traffic to a cloud engine and correlates attacker behavior over extended periods to detect API abuse and discovery.

    Commercial
    Established

  • Traceable AI

    Harness

    API Security

    API security platform that uses distributed tracing to capture full request context, driving discovery, threat detection and API security testing.

    Commercial
    Established

  • Wallarm

    Wallarm

    API Security

    Inline API security and WAAP platform using grammar based payload parsing for detection, with traffic derived API discovery and attack replay testing.

    Commercial
    Established

  • Levo.ai

    Levo.ai

    API security platform that uses eBPF sensors to catalog APIs from live traffic, trace sensitive data flows, and drive automated security testing.

    Commercial Growing
    API Security

  • Salt Security

    Salt Security

    API security platform that mirrors traffic to a cloud engine and correlates attacker behavior over extended periods to detect API abuse and discovery.

    Commercial Established
    API Security

  • Traceable AI

    Harness

    API security platform that uses distributed tracing to capture full request context, driving discovery, threat detection and API security testing.

    Commercial Established
    API Security

  • Wallarm

    Wallarm

    Inline API security and WAAP platform using grammar based payload parsing for detection, with traffic derived API discovery and attack replay testing.

    Commercial Established
    API Security
Tick up to 4 tools above.