Akamai • Application security
Akamai API Security baselines normal API behavior across the customer's full traffic, discovers shadow APIs the security team did not know existed, and detects business-logic abuse that signature-based WAFs cannot see. Runs out-of-band on traffic so deployment is non-disruptive and discovery starts the day onboarding completes.
Merito sells Akamai API Security and runs the discovery beat, behavioral baselining, and threat-hunting workflow that turn the platform's findings into a working API security program.
What it is
Akamai API Security is the behavioral-analytics API security platform Akamai built from the Neosec acquisition (closed Q2 2023). The platform discovers all APIs the customer is actually serving, including shadow APIs that no one in security knew existed, baselines normal behavior per endpoint and per consumer, and detects business-logic abuse and data-exfiltration patterns that signature-based WAFs are blind to.
Discovery is the first move and the most actionable insight the platform produces. Most enterprise programs do not have a complete inventory of the APIs they serve. The platform sees real traffic, infers the API surface, and surfaces every endpoint with risk scoring against authentication, sensitive data handling, and consumer behavior. Customers Merito has worked with consistently find APIs in the discovery beat that no one had documented and no one was protecting.
Behavioral baselining is the second move. The platform learns normal request patterns per API and per consumer over time. Anomalies trigger alerts for security analysts. Business-logic abuse (account takeover, broken object level authorization, broken function level authorization, scraping, abuse of legitimate API contracts) is the category of attack that signature-based tools cannot catch because the requests are individually well-formed. The behavioral platform is the right tool for the category.
Akamai API Security pairs with Akamai App and API Protector for closed-loop blocking. When the behavioral analytics flag an abuse pattern, App and API Protector enforces the block in line at the edge. The two products layer rather than compete, and the dominant Merito recommendation for customers with significant API surface area is both products together.
Ideal use cases
What it is best at
The platform sees real traffic and surfaces every API the customer is serving, including shadow APIs that no one in security knew about. Most competing products require a known catalog as input. Akamai's depth here comes directly from the Neosec heritage.
Account takeover, BOLA, BFLA, scraping, and abuse of legitimate API contracts are the categories signature-based tools cannot catch because the requests are individually well-formed. Behavioral baselining is the right architecture for the category.
The platform runs on traffic mirrors rather than in line, so deployment does not change the request path. Discovery starts the day onboarding completes; the customer does not need to re-architect ingress to get value.
Core capabilities
Continuous identification of every API the customer is actually serving, with risk scoring.
Traffic-derived inventory
Real traffic produces the inventory rather than a customer-supplied OpenAPI catalog. Surfaces APIs that exist but were not documented and APIs that exist but were forgotten.
Shadow and rogue API detection
Identifies APIs serving from production infrastructure that are not in the customer's known inventory. Includes APIs that survived deprecation, APIs from acquired companies, and APIs spun up outside the security review process.
Per-API risk scoring
Each discovered API gets a risk score across authentication posture, sensitive-data handling, consumer behavior, and recent anomaly volume. Drives prioritization for the customer's security team.
Per-endpoint and per-consumer behavioral models that drive anomaly detection.
Endpoint baselines
Each API endpoint gets a normal-behavior baseline covering request rate, payload shape, response distribution, and error patterns.
Consumer baselines
Per-API-key and per-token baselines for consumer behavior. Catches a single consumer behaving abnormally even when total API traffic looks normal.
Anomaly clustering
Anomalous requests cluster into events for analyst review rather than producing per-request alerts. Reduces analyst toil compared with raw alert streams.
Detection of attack categories signature-based tools cannot catch.
Account takeover detection
Behavioral signals consistent with credential stuffing, session hijacking, and post-login lateral movement.
BOLA and BFLA detection
Broken Object Level Authorization and Broken Function Level Authorization patterns identified by anomalous object-id access patterns and unauthorized function invocation.
Scraping and data-exfiltration patterns
Behavioral indicators of large-scale enumeration, scraping, and bulk data extraction even when individual requests pass authentication.
Abuse of legitimate API contracts
Patterns where authenticated consumers use the API in ways consistent with abuse rather than the documented contract (price scraping, inventory exhaustion, refund manipulation).
Analyst-facing workflow for investigating anomalies.
Investigation queue
Anomaly clusters land in an analyst queue with full request context, behavioral baseline comparison, and recommended next steps.
Query workspace
Analysts query historical traffic to validate hypotheses about specific behavioral patterns and consumer behavior.
Case management
Cases include findings, evidence, and decision trail. Cases hand off cleanly to the customer's broader incident response process.
Where API Security findings flow back into runtime enforcement.
App and API Protector blocking
When API Security flags an abuse pattern, App and API Protector enforces the block in line at the edge. Closes the loop between detection and enforcement without manual policy authoring.
API gateway integrations
Findings flow into Apigee, Kong, MuleSoft, and AWS API Gateway for in-gateway enforcement on traffic that does not traverse Akamai.
SIEM and ticketing forwarding
Cases and high-severity findings flow into Splunk, Sentinel, ServiceNow, and Jira for cross-tool detection and incident response.
Where it fits in the stack
Deployment and implementation
Licensing and packaging
Akamai API Security
Discovery, behavioral baselining, business-logic abuse detection, threat-hunting workspace, and case management.
Best for: Programs needing comprehensive API security across discovered and known APIs.
Closed-loop with App and API Protector
Adds inline enforcement at the Akamai edge for abuse patterns API Security detects.
Best for: Customers running both Akamai API Security and App and API Protector wanting enforcement without manual policy authoring.
Merito services
Merito sells licenses and the delivery work around them. Pick the service that matches where you are in the lifecycle.
Traffic-mirror configuration, discovery beat against the customer's API surface, behavioral baseline tuning, and analyst onboarding.
Explore service02AppSec program scoping for API security adoption alongside Salt Security, Noname, and other behavioral-analytics platforms.
Explore service03API discovery findings flowing into developer ticketing and posture remediation in CI/CD. API gateway-side enforcement integrations.
Explore service04Named engineer, priority SLAs, and release-window coverage for Akamai API Security in production.
Explore service05Long-term run support including ongoing baseline tuning, threat-hunting case operations, and behavioral-analytics maturity progression.
Explore service06Merito-placed API security analysts embedded on long-running programs running the threat-hunting queue alongside the customer's team.
Explore serviceAkamai API Security licensing
Behavioral analytics pays back when discovery is run first and baselines are given time to stabilize. Buy the license through Merito and get the discovery, the analyst operating model, and the closed-loop integration with App and API Protector together.
Merito point of view
The customers Merito has worked with on Akamai API Security all find APIs in the discovery beat that no one had documented and no one was protecting. The platform sees real traffic, infers the API inventory, and surfaces shadow endpoints. The first month should be a discovery-led engagement with the customer's security team rather than a behavioral-detection rollout. Going straight to detection-and-response without that discovery beat skips the most actionable insight the product produces.
Behavioral baselining is the second move and pays back over a longer arc. The platform learns normal patterns per API and per consumer over weeks of traffic. Premature alerting against thin baselines produces noise. Merito's standard rollout treats the first eight to twelve weeks as baseline-tuning weeks during which the analyst operating model is built against ground-truth attack categories the customer's industry actually faces.
Akamai API Security is sometimes scoped as a replacement for the API protections inside App and API Protector. It is not. App and API Protector blocks known-bad signatures and rate-limits in line at the edge. API Security finds shadow APIs and detects behavioral patterns the inline WAF cannot see. Programs with significant API surface run both products together. The closed-loop integration where API Security findings drive App and API Protector enforcement is the right architecture.
What buyers usually underestimate
Related from Merito
Related solutions
Related services
Related products
Frequently Asked Questions
Consultation request
Share your API surface, current API security tooling, and the abuse categories you are most worried about. A Merito API Security specialist follows up within one business day.
Discovery first
The platform sees real traffic and surfaces every API the customer is actually serving. Customers consistently find APIs no one had documented.
Behavioral analytics
Account takeover, BOLA, BFLA, scraping, and abuse of legitimate API contracts. The categories where individual requests look legitimate but the pattern reveals abuse.
Next step
An Akamai API Security engagement with Merito starts with discovery against the customer's actual API surface. The shadow APIs surface in the first month. The behavioral baselines stabilize in the next two months. Then the program runs.