2023 SC Awards Finalists: Best API Security Solution

F5 Distributed Cloud API Security a comprehensive API security management and enforcement service that discovers unknown APIs, monitors them, and secures them through continuous learning, inspection, and schema enforcement. Machine learning tracks API endpoints, offering usage patterns and normal behaviors that can are correlated with anomalies for detecting and responding to suspicious activity.

The API offering from F5 aims to simplify the deployment and management of critical app and API security controls, allowing for centralized visibility and management from a unified console. Its in-line application security enforcement includes a web application firewall (WAF) with multiple layers of security functionality, which aids in promptly addressing potential security threats. The SaaS-delivered service looks to combine rapid global API discovery and learning with the in-line enforcement capabilities of WAAP, eliminating the need for additional in-line security tools.

F5’s products strives to deliver a cost-effective solution, requiring no hardware or software maintenance, which lowers the total cost of ownership (TCO). The service offers high-speed API security for apps regardless of their location. The SaaS model offers flexibility and greater budgetary predictability for organizations. F5 has been widely deployed at 80% of Fortune 500 companies and holds an 11% market share according to the IDC Worldwide Application Protection and Availability Market Shares 2021 report.

Imperva API Security offers organizations comprehensive API detection, protection, and testing for both legacy and modern microservice architectures. With APIs increasing faster than security teams can manage, Imperva offers an out-of-the-box machine-learning system that offers complete visibility into API changes and usage. It covers the detection and prevention of business logic attacks and the OWASP API Top 10, while also enabling developers to fuzz-test their APIs for vulnerabilities.

Imperva’s no-code, machine-learning approach helps mitigate risks associated with API proliferation and sensitive data exposure through continuous API discovery and schema changes. The platform offers visibility of all APIs using a patented microsensor design, without the need for agents or plugins. The product can detect sensitive PII and support the OWASP API Top 10.

Imperva API Security, which is integrated with the Web Application and API Protection (WAAP) platform, comes in two deployment options: SaaS and cloud-native protection. With more than 6,500 customers, Imperva holds a 21% market share in the global internet defense market, according to IDC.

Invicti Security offers comprehensive application security aimed at mitigating risks and securing web applications and APIs across a company’s portfolio. With over 15 years of experience, Invicti offers dynamic application security testing (DAST) that let DevSecOps teams continuously scan web applications and APIs, integrating security testing into existing workflows.

The product supports more than 50 integrations with popular CI/CD, issue tracking, and collaboration platforms, allowing for comprehensive vulnerability scanning in both development and production environments. The company’s API testing covers a wide range of application vulnerabilities and adheres to the OWASP API Top 10 categories. Invicti promises a confirmation accuracy of 99.98%, which allow its evidence-based scanning technology to significantly reduces false positives.

The average customer spends between $20,000 and $30,000 per year on Invicti products, which include flexible support and success options. By using Invicti’s services, businesses can discover their full application and API landscape, continuously test for vulnerabilities in-house, and prioritize effective fixes. This approach has led to significant cost savings for one broadcasting customer, which reduced its external penetration testing costs by 60% after partnering with Invicti. The company holds a 7% market share of the global DAST market, according to a recent Bain report.

APIs are essential to modern applications, connecting enterprises to crucial data and services. As the transmission of sensitive information through APIs becomes increasingly complex, robust API security has become vital. The Salt Security API Protection Platform offers protection throughout the API lifecycle, using cloud-scale big data, AI, and ML for real-time analysis and correlation across millions of APIs and users. Its API Context Engine (ACE) architecture allows for API design analysis in pre-production, API discovery, attack prevention, and runtime remediation insights.

Security teams can deploy Salt Security’s platform’s cloud-scale big data capabilities in any environment, supporting all API types and formats. It works with existing tools and workflows without adding complexity, helping security and DevOps teams respond to threats, stop attackers, and eliminate vulnerabilities. In light of the growing costs of API-related cyber loss, Salt Security aids organizations in identifying, protecting, and hardening APIs to reduce security expenses.

ThreatX’s API and application protection platform offers an integrated solution to safeguard APIs and applications from advanced threats, including botnets and DDoS attacks. With native API discovery capabilities, ThreatX promises full visibility into the API and application attack surface, allowing customers to understand and manage risk more effectively. The platform also features real-time blocking capabilities, which can eliminate the need for additional tools or third-party products.

The integrate design of ThreatX, combined with its managed Protection-as-a-Service offering promises to help customers reduce resource allocation to monitoring their API and application security environment. This results in significant cost savings and increased efficiency. ThreatX has been designed to scale for global customers, with the ability to analyze and process billions of requests across numerous applications.

ThreatX promises an average implementation time of 30 minutes and full blocking mode achieved in about 72 hours. By reducing false positives and false negatives, ThreatX can ensure that customers’ applications and APIs remain available and support their overall business goals. The platform’s integrated approach to API and application protection streamlines security processes and offers a comprehensive solution for businesses in the face of ever-evolving cyber threats. ThreatX protects a global beverage brand with more than 1,100 sites and APIs, with over 356m requests analyzed each month. Another customer, a global computer manufacturer, sees more than 15 billion requests processed across nearly 200 applications.