Web application and API security
Web Application Firewalls (WAF), API protection, and DDoS mitigation platforms protecting web applications from OWASP Top 10 vulnerabilities, credential stuffing, and bot attacks.
Key Technical Considerations Before Procuring
Examine automated OpenAPI spec ingestion, schema validation, and behavioral API anomaly detection, alongside DDoS mitigation capacity at the edge.
Documented Solutions in this Category
Showing 21 published solutions with verified evidence
Akamai API Security
Akamai API Security from Akamai focuses on API discovery and behavioral threat detection. It is API security technology used for understanding and protecting application interfaces. Capabilities - API inventory and discovery: Identifies APIs so teams can establish which interfaces are included in their security review. - API behavior analysis: Uses observed API behavior to investigate activity that differs from expected usage. - API posture assessment: Highlights API configuration or exposure issues for further assessment. - Sensitive data visibility: Helps identify where protected information appears in the APIs covered by the platform. - Runtime API attack protection: Protects or inspects live API traffic according to the product's enforcement model. - API authentication risk assessment: Brings authentication and authorization behavior into the API security review. - OWASP API risk coverage: Supports evaluating the API risk classes described in the vendor's documentation. Use and operational context Akamai API Security gives teams a way to establish API visibility and investigate API activity. The evaluation should follow an API from discovery through risk review, including what traffic context is available when authentication or sensitive-data exposure becomes a concern. Deployment and evaluation Deployment: Cloud service / SaaS. Before adoption, review API discovery coverage, traffic collection, authentication context and the enforcement model for live applications. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Akamai API Security focuses on understanding and protecting application interfaces. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
App & API Protector
App & API Protector from Akamai focuses on web application and API attack protection. It is web application protection technology used for applying security rules to application requests. Capabilities - Web request filtering: Applies protection rules to requests reaching the web applications covered by the deployment. - OWASP attack coverage: Targets application attack classes referenced in the product's protection documentation. - Bot traffic controls: Adds controls for automated traffic that can create application abuse or availability problems. - API traffic protection: Brings API traffic into the application protection scope where included in the selected offering. - Behavior-based analysis: Uses behavioral context in addition to straightforward signature matching. - DDoS mitigation integration: Can be evaluated within the vendor's documented application availability and attack mitigation scope. Use and operational context App & API Protector sits in Akamai's application protection portfolio and brings application and API protection into the web-traffic workflow. Validate how rules are applied to the applications in scope and how legitimate requests are distinguished during policy tuning. Deployment and evaluation Deployment: Cloud service / SaaS. Before adoption, review application onboarding, rule tuning, false-positive handling and behavior under representative legitimate traffic. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? App & API Protector focuses on applying security rules to application requests. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
AWS WAF
AWS WAF from Amazon Web Services focuses on web request filtering and application attack protection. It is web application firewall service used for applying access rules to requests received by supported AWS web resources. Capabilities - Web ACL administration: Organizes web request protection through the web access control lists documented by AWS. - Managed rule groups: Supports evaluating vendor-managed rules alongside the organization's own web traffic policies. - Web request filtering: Applies protection rules to requests reaching the web applications covered by the deployment. - DDoS mitigation integration: Can be evaluated within the vendor's documented application availability and attack mitigation scope. Use and operational context AWS WAF is relevant to teams protecting AWS application endpoints when the requirement centers on applying access rules to requests received by supported AWS web resources. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Before adoption, review web ACL association, rule groups, request inspection settings and legitimate-traffic testing before enforcement. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? AWS WAF focuses on applying access rules to requests received by supported AWS web resources. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Arkose Bot Manager
Arkose Bot Manager from Arkose Labs focuses on automated abuse prevention and challenge orchestration. It is automated traffic protection technology used for distinguishing and controlling abusive automated requests. Capabilities - Automated traffic detection: Identifies automated requests within the traffic processed by the service. - Challenge and verification workflows: Applies the verification mechanisms documented for suspicious traffic or users. - Account abuse protection: Addresses the automated account attacks included in the vendor's protection scope. - Scraping abuse controls: Applies the documented controls for automated extraction or scraping activity. - Application integration: Provides the supported mechanisms for bringing bot controls into application traffic flows. Use and operational context Arkose Bot Manager addresses automated abuse through the bot assessment and challenge mechanisms documented by Arkose Labs. Evaluate an actual account or application abuse scenario, including how a legitimate user proceeds when additional verification is required. Deployment and evaluation Before adoption, review integration paths, treatment of legitimate automation, challenge behavior and the effect on real users. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Arkose Bot Manager focuses on distinguishing and controlling abusive automated requests. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Cequence Unified API Protection
Cequence Unified API Protection from Cequence Security focuses on API risk discovery and automated attack protection. It is API security technology used for understanding and protecting application interfaces. Capabilities - API inventory and discovery: Identifies APIs so teams can establish which interfaces are included in their security review. - API posture assessment: Highlights API configuration or exposure issues for further assessment. Use and operational context Cequence Unified API Protection is relevant to security teams responsible for externally or internally exposed APIs when the requirement centers on understanding and protecting application interfaces. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Cloud service / SaaS; Self-managed / on-premises option documented by the vendor. Before adoption, review API discovery coverage, traffic collection, authentication context and the enforcement model for live applications. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Cequence Unified API Protection focuses on understanding and protecting application interfaces. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Cloudflare WAF
Cloudflare WAF from Cloudflare focuses on web application request inspection and attack filtering. It is web application protection technology used for applying security rules to application requests. Capabilities - Web request filtering: Applies protection rules to requests reaching the web applications covered by the deployment. - OWASP attack coverage: Targets application attack classes referenced in the product's protection documentation. - Bot traffic controls: Adds controls for automated traffic that can create application abuse or availability problems. - Rate limiting: Restricts request volume according to the limits defined by an administrator. - Attack signatures: Matches requests against the attack signatures or rule sets supplied for the product. - DDoS mitigation integration: Can be evaluated within the vendor's documented application availability and attack mitigation scope. - Virtual patching: Uses protective rules to reduce exposure while application remediation is being arranged. Use and operational context Cloudflare WAF is relevant to application owners and security teams protecting web services when the requirement centers on applying security rules to application requests. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Cloud service / SaaS. Before adoption, review application onboarding, rule tuning, false-positive handling and behavior under representative legitimate traffic. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Cloudflare WAF focuses on applying security rules to application requests. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
DataDome Bot Protection
DataDome Bot Protection from DataDome focuses on automated threat detection and bot mitigation. It is automated traffic protection technology used for distinguishing and controlling abusive automated requests. Capabilities - Automated traffic detection: Identifies automated requests within the traffic processed by the service. - Challenge and verification workflows: Applies the verification mechanisms documented for suspicious traffic or users. - Account abuse protection: Addresses the automated account attacks included in the vendor's protection scope. - Scraping abuse controls: Applies the documented controls for automated extraction or scraping activity. - Application integration: Provides the supported mechanisms for bringing bot controls into application traffic flows. Use and operational context DataDome Bot Protection addresses automated traffic affecting applications. Evaluate the integration point and the behavior of the protection under a realistic abuse scenario, while measuring the experience of legitimate users and any automation the organization intends to permit. Deployment and evaluation Before adoption, review integration paths, treatment of legitimate automation, challenge behavior and the effect on real users. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? DataDome Bot Protection focuses on distinguishing and controlling abusive automated requests. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
F5 BIG-IP Advanced WAF
F5 BIG-IP Advanced WAF from F5 focuses on web application firewall and attack protection. It is web application protection technology used for applying security rules to application requests. Capabilities - Web request filtering: Applies protection rules to requests reaching the web applications covered by the deployment. - Bot traffic controls: Adds controls for automated traffic that can create application abuse or availability problems. - API traffic protection: Brings API traffic into the application protection scope where included in the selected offering. - DDoS mitigation integration: Can be evaluated within the vendor's documented application availability and attack mitigation scope. - Virtual patching: Uses protective rules to reduce exposure while application remediation is being arranged. Use and operational context F5 BIG-IP Advanced WAF is relevant to application owners and security teams protecting web services when the requirement centers on applying security rules to application requests. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Before adoption, review application onboarding, rule tuning, false-positive handling and behavior under representative legitimate traffic. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? F5 BIG-IP Advanced WAF focuses on applying security rules to application requests. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
F5 Distributed Cloud API Security
F5 Distributed Cloud API Security from F5 focuses on API discovery and API attack protection. It is API security technology used for understanding and protecting application interfaces. Capabilities - API inventory and discovery: Identifies APIs so teams can establish which interfaces are included in their security review. - Sensitive data visibility: Helps identify where protected information appears in the APIs covered by the platform. - Runtime API attack protection: Protects or inspects live API traffic according to the product's enforcement model. - API authentication risk assessment: Brings authentication and authorization behavior into the API security review. - OWASP API risk coverage: Supports evaluating the API risk classes described in the vendor's documentation. Use and operational context F5 Distributed Cloud API Security is relevant to security teams responsible for externally or internally exposed APIs when the requirement centers on understanding and protecting application interfaces. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Cloud service / SaaS; Self-managed / on-premises option documented by the vendor. Before adoption, review API discovery coverage, traffic collection, authentication context and the enforcement model for live applications. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? F5 Distributed Cloud API Security focuses on understanding and protecting application interfaces. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
F5 Distributed Cloud Bot Defense
F5 Distributed Cloud Bot Defense from F5 focuses on automated abuse detection and bot mitigation. It is automated traffic protection technology used for distinguishing and controlling abusive automated requests. Capabilities - Automated traffic detection: Identifies automated requests within the traffic processed by the service. - Application integration: Provides the supported mechanisms for bringing bot controls into application traffic flows. Use and operational context F5 Distributed Cloud Bot Defense is relevant to application teams dealing with bots and automated abuse when the requirement centers on distinguishing and controlling abusive automated requests. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Before adoption, review integration paths, treatment of legitimate automation, challenge behavior and the effect on real users. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? F5 Distributed Cloud Bot Defense focuses on distinguishing and controlling abusive automated requests. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
F5 Distributed Cloud Web Application Firewall
F5 Distributed Cloud Web Application Firewall from F5 focuses on cloud-delivered web application traffic inspection and attack protection. It is web application protection technology used for applying security rules to application requests. Capabilities - Web request filtering: Applies protection rules to requests reaching the web applications covered by the deployment. - OWASP attack coverage: Targets application attack classes referenced in the product's protection documentation. - API traffic protection: Brings API traffic into the application protection scope where included in the selected offering. - Attack signatures: Matches requests against the attack signatures or rule sets supplied for the product. - Behavior-based analysis: Uses behavioral context in addition to straightforward signature matching. - DDoS mitigation integration: Can be evaluated within the vendor's documented application availability and attack mitigation scope. - Virtual patching: Uses protective rules to reduce exposure while application remediation is being arranged. Use and operational context F5 Distributed Cloud Web Application Firewall is relevant to application owners and security teams protecting web services when the requirement centers on applying security rules to application requests. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Cloud service / SaaS. Before adoption, review application onboarding, rule tuning, false-positive handling and behavior under representative legitimate traffic. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? F5 Distributed Cloud Web Application Firewall focuses on applying security rules to application requests. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
FortiWeb
FortiWeb from Fortinet focuses on web application traffic inspection and protection. It is web application protection technology used for applying security rules to application requests. Capabilities - Web request filtering: Applies protection rules to requests reaching the web applications covered by the deployment. - API traffic protection: Brings API traffic into the application protection scope where included in the selected offering. Use and operational context FortiWeb is relevant to application owners and security teams protecting web services when the requirement centers on applying security rules to application requests. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Cloud service / SaaS. Before adoption, review application onboarding, rule tuning, false-positive handling and behavior under representative legitimate traffic. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? FortiWeb focuses on applying security rules to application requests. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
HUMAN Bot Defender
HUMAN Bot Defender from HUMAN Security focuses on bot detection and automated abuse protection. It is automated traffic protection technology used for distinguishing and controlling abusive automated requests. Capabilities - Automated traffic detection: Identifies automated requests within the traffic processed by the service. - Behavioral traffic analysis: Uses request behavior as part of the automated-traffic assessment. - Application integration: Provides the supported mechanisms for bringing bot controls into application traffic flows. Use and operational context HUMAN Bot Defender is relevant to application teams dealing with bots and automated abuse when the requirement centers on distinguishing and controlling abusive automated requests. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Before adoption, review integration paths, treatment of legitimate automation, challenge behavior and the effect on real users. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? HUMAN Bot Defender focuses on distinguishing and controlling abusive automated requests. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Imperva API Security
Imperva API Security from Imperva focuses on API discovery and risk assessment. It is API security technology used for understanding and protecting application interfaces. Capabilities - API inventory and discovery: Identifies APIs so teams can establish which interfaces are included in their security review. - API behavior analysis: Uses observed API behavior to investigate activity that differs from expected usage. - API posture assessment: Highlights API configuration or exposure issues for further assessment. - Runtime API attack protection: Protects or inspects live API traffic according to the product's enforcement model. - API authentication risk assessment: Brings authentication and authorization behavior into the API security review. - OWASP API risk coverage: Supports evaluating the API risk classes described in the vendor's documentation. - Shadow API visibility: Finds undocumented API endpoints that can otherwise escape routine security review. Use and operational context Imperva API Security is relevant to security teams responsible for externally or internally exposed APIs when the requirement centers on understanding and protecting application interfaces. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Self-managed / on-premises option documented by the vendor. Before adoption, review API discovery coverage, traffic collection, authentication context and the enforcement model for live applications. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Imperva API Security focuses on understanding and protecting application interfaces. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Imperva Web Application Firewall
Imperva Web Application Firewall from Imperva focuses on web application request filtering and attack protection. It is web application protection technology used for applying security rules to application requests. Capabilities - Web request filtering: Applies protection rules to requests reaching the web applications covered by the deployment. - OWASP attack coverage: Targets application attack classes referenced in the product's protection documentation. - Bot traffic controls: Adds controls for automated traffic that can create application abuse or availability problems. - API traffic protection: Brings API traffic into the application protection scope where included in the selected offering. - Behavior-based analysis: Uses behavioral context in addition to straightforward signature matching. - DDoS mitigation integration: Can be evaluated within the vendor's documented application availability and attack mitigation scope. Use and operational context Imperva's WAF entry addresses protection of web request paths. Assess the application's traffic pattern and deployment architecture, then evaluate rule configuration, false-positive investigation and the policy outcome for requests that resemble known application attacks. Deployment and evaluation Deployment: Cloud service / SaaS. Before adoption, review application onboarding, rule tuning, false-positive handling and behavior under representative legitimate traffic. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Imperva Web Application Firewall focuses on applying security rules to application requests. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
NSFOCUS WAF
NSFOCUS WAF from NSFOCUS focuses on web application traffic inspection and attack filtering. It is web application protection technology used for applying security rules to application requests. Capabilities - Web request filtering: Applies protection rules to requests reaching the web applications covered by the deployment. - API traffic protection: Brings API traffic into the application protection scope where included in the selected offering. - DDoS mitigation integration: Can be evaluated within the vendor's documented application availability and attack mitigation scope. Use and operational context NSFOCUS WAF is relevant to application owners and security teams protecting web services when the requirement centers on applying security rules to application requests. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Before adoption, review application onboarding, rule tuning, false-positive handling and behavior under representative legitimate traffic. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? NSFOCUS WAF focuses on applying security rules to application requests. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Bot Manager
Bot Manager from Radware focuses on automated traffic classification and bot mitigation. It is automated traffic protection technology used for distinguishing and controlling abusive automated requests. Capabilities - Automated traffic detection: Identifies automated requests within the traffic processed by the service. - Account abuse protection: Addresses the automated account attacks included in the vendor's protection scope. - Scraping abuse controls: Applies the documented controls for automated extraction or scraping activity. - Application integration: Provides the supported mechanisms for bringing bot controls into application traffic flows. Use and operational context Bot Manager is relevant to application teams dealing with bots and automated abuse when the requirement centers on distinguishing and controlling abusive automated requests. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Before adoption, review integration paths, treatment of legitimate automation, challenge behavior and the effect on real users. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Bot Manager focuses on distinguishing and controlling abusive automated requests. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Cloud WAF
Cloud WAF from Radware focuses on cloud-delivered web application attack protection. It is web application protection technology used for applying security rules to application requests. Capabilities - Web application request protection: Applies Radware's documented application protection controls to the traffic paths included in the service. - Application policy management: Provides the documented means of defining and administering request-protection behavior. - Web request filtering: Applies protection rules to requests reaching the web applications covered by the deployment. Use and operational context Cloud WAF is relevant to application owners and security teams protecting web services when the requirement centers on applying security rules to application requests. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Cloud service / SaaS. Before adoption, review application onboarding, rule tuning, false-positive handling and behavior under representative legitimate traffic. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Cloud WAF focuses on applying security rules to application requests. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Salt Security API Protection Platform
Salt Security API Protection Platform from Salt Security focuses on API inventory and behavioral attack detection. It is API security technology used for understanding and protecting application interfaces. Capabilities - API discovery and inventory: Builds the API visibility used to understand the interfaces included in the platform's protection scope. - API posture and exposure assessment: Assesses the API configuration and exposure concerns covered by the selected service. - Behavioral API attack detection: Uses the documented API behavior context to assess potential attack activity. - API risk prioritization: Brings the available API security findings into a risk-review workflow. - API inventory and discovery: Identifies APIs so teams can establish which interfaces are included in their security review. - API posture assessment: Highlights API configuration or exposure issues for further assessment. - OWASP API risk coverage: Supports evaluating the API risk classes described in the vendor's documentation. Use and operational context Salt Security API Protection Platform is relevant to security teams responsible for externally or internally exposed APIs when the requirement centers on understanding and protecting application interfaces. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Before adoption, review API discovery coverage, traffic collection, authentication context and the enforcement model for live applications. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Salt Security API Protection Platform focuses on understanding and protecting application interfaces. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Traceable API Security
Traceable API Security from Traceable focuses on API discovery and threat detection. It is API security technology used for understanding and protecting application interfaces. Capabilities - API inventory and discovery: Identifies APIs so teams can establish which interfaces are included in their security review. - API posture assessment: Highlights API configuration or exposure issues for further assessment. - Sensitive data visibility: Helps identify where protected information appears in the APIs covered by the platform. - Runtime API attack protection: Protects or inspects live API traffic according to the product's enforcement model. - OWASP API risk coverage: Supports evaluating the API risk classes described in the vendor's documentation. Use and operational context Traceable API Security is relevant to security teams responsible for externally or internally exposed APIs when the requirement centers on understanding and protecting application interfaces. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Self-managed / on-premises option documented by the vendor. Before adoption, review API discovery coverage, traffic collection, authentication context and the enforcement model for live applications. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Traceable API Security focuses on understanding and protecting application interfaces. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Wallarm API Security
Wallarm API Security from Wallarm focuses on API discovery and attack protection. It is API security technology used for understanding and protecting application interfaces. Capabilities - API inventory and discovery: Identifies APIs so teams can establish which interfaces are included in their security review. - API behavior analysis: Uses observed API behavior to investigate activity that differs from expected usage. - API posture assessment: Highlights API configuration or exposure issues for further assessment. - Sensitive data visibility: Helps identify where protected information appears in the APIs covered by the platform. - Runtime API attack protection: Protects or inspects live API traffic according to the product's enforcement model. - API authentication risk assessment: Brings authentication and authorization behavior into the API security review. - OWASP API risk coverage: Supports evaluating the API risk classes described in the vendor's documentation. - Shadow API visibility: Finds undocumented API endpoints that can otherwise escape routine security review. Use and operational context Wallarm's API security entry addresses visibility into APIs and the protection of their traffic. Review a representative interface from discovery through a detected attack condition, including the evidence supplied to operators and the enforcement action configured for that interface. Deployment and evaluation Before adoption, review API discovery coverage, traffic collection, authentication context and the enforcement model for live applications. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Wallarm API Security focuses on understanding and protecting application interfaces. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.