The four products in scope are App and API Protector (in-line WAAP for WAF, bot, L7 DDoS, and inline API protections), Prolexic (dedicated network-layer DDoS scrubbing through global scrubbing centers), API Security (behavioral-analytics API security built from the Neosec acquisition), and Client-side Protection and Compliance (browser-side script monitoring with a PCI-DSS v4.0 compliance dashboard). All four defend the application after code ships, so they layer with shift-left tools rather than replace them.
Akamai portfolio
Akamai runtime protection for web apps, APIs, networks and the browser.
Web and API runtime defense, dedicated DDoS scrubbing, behavioral API security, and client-side script monitoring under one Akamai program. Merito brings the rule design, threshold tuning and incident-response discipline that turn a console into a working program.
Why Merito for Akamai
WAF rules that do not block your own customers, and DDoS thresholds that stay quiet during a marketing push.
Akamai is runtime protection. The four products in this catalog sit at the edge or inside the browser, after code has shipped, defending the running application against attackers in real time. Programs that need shift-left scanning (SAST, SCA, IaC) buy that elsewhere. Akamai is the layer below those tools that catches what code review and policy enforcement cannot.
App and API Protector is the in-line WAAP, with WAF rules, bot management, L7 DDoS controls, and basic API protections in a single inspection plane. Prolexic is the dedicated network-layer scrubbing platform, sized for the largest attacks and operated by a 24/7 SOCC team. API Security is the behavioral-analytics platform built from the Neosec acquisition that finds shadow APIs and detects business-logic abuse the WAF is blind to. Client-side Protection and Compliance is the browser-side script monitor that addresses PCI-DSS v4.0 requirements 6.4.3 and 11.6.1 and gives security teams visibility into the third-party JavaScript surface that no other tool sees.
Each Akamai product needs its own operating work. WAF and bot rules have to be designed so the program does not block its own customers. Prolexic thresholds have to trigger on a real attack without false alarms during marketing pushes. API Security needs a discovery beat to produce the actual API inventory, and Client-side Protection needs its compliance dashboard set against the customer's PCI scope. Ongoing false-positive review is what keeps developer and customer trust once the program is live.
The Akamai toolchain
Four Akamai products that defend the running application, from network to browser
Runtime protection
Edge-delivered, post-deploy defense across web, API, network, and browser surfaces. Layered with the customer's existing shift-left tools, not a replacement for them.
Runtime protection
Akamai App and API Protector
Edge-delivered Web Application and API Protection (WAAP) with WAF, bot management, L7 DDoS, and inline API protections under one policy. Hybrid edition extends the same WAF rules into multicloud and on-prem environments.
Runtime protection
Akamai Prolexic
Dedicated network-layer DDoS scrubbing through 32 global scrubbing centers with 20+ Tbps of capacity, always-on or on-demand routing, and a 24/7 SOCC. Pairs with App and API Protector for a layered L3 to L7 defense.
Runtime protection
Akamai API Security
Behavioral-analytics API security platform (built from the Neosec acquisition) that discovers shadow APIs, baselines normal behavior, and detects business-logic abuse no signature WAF will catch.
Runtime protection
Akamai Client-side Protection and Compliance
Browser-side script monitoring that addresses PCI-DSS v4.0 requirements 6.4.3 and 11.6.1, detects skimmer activity, and gives security visibility into the third-party JavaScript footprint.
What Akamai pricing is based on
Akamai products are annual subscriptions with usage bands, so the price follows traffic and attack exposure rather than seats. App and API Protector, Prolexic, API Security and Client-side Protection and Compliance can sit on one order, and Akamai's Zero Overage Fee Program gives App and API Protector predictable annual usage bands. The table shows the unit behind each product.
| Product or tier | What drives the price |
|---|---|
| App and API Protector | Traffic volume, protected properties and edition, Standard or Hybrid |
| Prolexic | Attack-volume band, prefix count and routing model, always-on or on-demand |
| API Security | API traffic volume and number of monitored APIs |
| Client-side Protection and Compliance | Traffic volume and protected payment pages |
Merito services
Akamai rule design, tuning and run services
01Service
Implementation
Akamai property setup, WAF and bot rule design, Prolexic routing, API Security discovery onboarding, and Client-side Protection compliance dashboard configuration.
02Service
MAPS Assessment
AppSec program scoping for runtime protection alongside the customer's existing WAF, DDoS, API gateway, and shift-left tooling.
03Service
DevOps Consulting
Edge property pipelines, version-controlled WAF policy in CI, and API Security findings flowing into the developer ticketing surface.
04Service
Premium Support
Named engineer, priority SLAs, and release-window coverage for Akamai programs Merito implements.
05Service
Managed Services
Ongoing rule tuning, false-positive review, threshold maintenance, and compliance-dashboard operating model.
06Service
Training and Enablement
Akamai console training, WAF and bot rule authoring, Prolexic runbook walkthroughs, API Security analyst onboarding.
07Service
Staff Augmentation
Merito-placed Akamai engineers embedded on long-running runtime-protection programs.
Akamai licensing
Buy Akamai from the partner that also writes the WAF rules and tunes the thresholds.
WAF rules, DDoS thresholds and incident runbooks all get tuned to your traffic before launch. The first question is what already sits in front of your application.
Related solutions
Where Akamai connects to the rest of the Merito program
Application Security
Akamai's runtime protection as the outer layer of a program that also runs code and dependency scanners.
DevOps Toolchain
Edge property and WAF policy under version control, with API Security findings flowing into developer ticketing.
Frequently Asked Questions
Akamai FAQs
Consultation request
Talk to Merito about Akamai
Describe the sites, APIs and networks you need to defend. A Merito Akamai specialist follows up within one business day.
Full Akamai runtime portfolio
Rule design, tuning and runbooks in one plan
App and API Protector, Prolexic, API Security and Client-side Protection on one order, with rule design, tuning and runbooks scoped alongside.
MAPS-driven scoping
AppSec program scoping by Merito
MAPS Assessment sizes the runtime program before implementation begins, including coverage gaps, integration points, and operating-model design.
Next step
Pick the Akamai product that fits the runtime gap.
An Akamai conversation with Merito starts with what is already in front of the application, what attack surface the customer is most worried about, and where Akamai actually fits relative to the existing stack. We recommend the layer that closes the right gap.