Wallarm API Security

Overview

Wallarm API Security is software for discovering APIs and protecting them while they handle live traffic. It suits organizations with varied API protocols and security teams that need flexible deployment options. Its breadth is a strong fit for complex API estates, while the free tier’s quota and feature exclusions limit it as a long-term option.

Key features

Wallarm covers REST, GraphQL, gRPC, SOAP and WebSocket APIs without requiring an API specification. It can find shadow, zombie and rogue APIs and build OpenAPI specifications from live traffic. That helps teams bring undocumented endpoints into view, although discovery alone does not decide which endpoints should remain or how they should be governed.

Runtime protection blocks injection, BOLA, broken authentication and zero-day exploits. Behavior analysis detects credential stuffing, account takeover, malicious bots and L7 DDoS, giving teams defenses against both exploit attempts and abusive traffic. Sensitive-data detection identifies APIs handling personal, payment, credential or health data and maps them to compliance scope.

API Leak Management scans public sources for API keys, tokens and credentials associated with customer domains. Managed rule sets, rate limiting, bot management, API posture management and specification governance round out the controls. Event-routing integrations include Splunk, Sumo, QRadar, Jira, PagerDuty, OpsGenie and Slack, which can help connect API security events to existing operations workflows.

Deployment can use Wallarm’s managed Security Edge or self-hosted options, including Kubernetes, cloud VMs and API gateway connectors. The hybrid model gives teams a choice of operating environment, but the range of capabilities and deployment paths will suit organizations with security staff able to configure and manage API protection. Wallarm states that it is SOC 2 Type 2 compliant.

Pricing

The free tier gives small teams a way to start within a defined traffic budget, but its three-user cap and exclusion of API Abuse Prevention and vulnerability assessment leave meaningful gaps. Exceeding the quota also disables console access and integrations, so it is a poor fit for workloads that may regularly cross the limit. Both paid plans require a sales request; their six-month event storage and unlimited users are clear terms, but organizations must seek custom pricing to assess cost.

Platforms

Wallarm supports API, Linux, self-hosted and web environments. Managed Security Edge and self-hosted deployment options, including Kubernetes, cloud VMs and API gateway connectors, give teams deployment flexibility across hybrid environments.

Who it's for

Wallarm is best suited to organizations protecting APIs across multiple protocols and deployment environments, particularly those that need API discovery, runtime defenses and visibility into sensitive data in one product. Its paid plans are the more appropriate fit for teams needing API Abuse Prevention or vulnerability assessment, or whose request volume may exceed the free allowance. Smaller teams with limited traffic can use the free tier, provided three users and its feature exclusions are acceptable.

Pros and cons

Pros

• Broad protocol coverage without an API specification helps teams discover and protect APIs that lack current documentation.
• Discovery, runtime attack protection, behavior-based abuse detection and sensitive-data visibility cover several distinct API security needs.
• Managed and self-hosted deployment choices support different operating environments.
• The free tier allows up to 500,000 requests/month and includes three users/company.

Cons

• The free tier excludes vulnerability assessment and API Abuse Prevention, limiting its coverage for teams that need those controls.
• Console access and integrations are disabled after the monthly request quota is exceeded, which can disrupt oversight at the point traffic crosses the cap.
• Paid plans use custom pricing, so buyers need to contact sales to establish subscription cost.

Alternatives

42Crunch API Security Platform is an alternative for teams looking for OpenAPI audits, vulnerability scans and automatic fixes through its free plan, with a free trial also offered.

APISec Platform is worth considering for teams seeking a free public API testing plan with basic test simulations and community support, with no credit card required.

Cisco Panoptica is another option with a free tier; Cisco states that tier supports up to 10 nodes, one cluster and unlimited pods in a 2023 brochure.

F5 BIG-IP APM is an alternative for buyers considering a perpetual license across BIG-IP Virtual Editions, hardware or hybrid environments.

Haltdos offers a free Community WAF limited to one website and one security profile, as well as a Professional WAF plan for $30 a month.

Onam Security API Security offers a free plan for one cloud account and up to 500 resources, with 30-day finding history, and a Pro plan for $22 a month.

APIPosture is an alternative for self-hosted teams seeking a free open-source CLI with local analysis and eight authorization rules; its Pro Solo plan is $9 a month, billed annually at $108/year, for two seats.

Akto API Security Platform is another freemium API security option with usage-based pricing available by contacting sales.

Browse more options in API Security Software or compare products in Web Application Firewall Software.

Verdict

Wallarm API Security is a strong choice for organizations that need broad API discovery and runtime protection across varied protocols, with flexible managed and self-hosted deployment. Its main reason to choose it is the combination of discovery, attack and abuse defenses, and sensitive-data visibility. Look elsewhere if you need predictable paid pricing upfront or a free plan that includes API Abuse Prevention and vulnerability assessment.