Akamai • Application security
App and API Protector is Akamai's in-line Web Application and API Protection (WAAP) platform. WAF, bot management, layer-7 DDoS, and inline API protections share one inspection plane at the edge, with the Adaptive Security Engine emitting one-click tuning recommendations against live traffic.
Merito sells App and API Protector and operates the rule design, bot policy, false-positive review, and Hybrid rollout that turn an edge property into a production WAAP program.
What it is
App and API Protector inspects every HTTP and HTTPS request at the Akamai edge in real time. Web Application Firewall rules cover the OWASP Top 10 and language-specific injection categories. Bot management ships with a directory of more than 1,700 known bots and supports custom bot definitions for traffic that should not be evaluated against the same rule set. Inline API protections cover rate limiting and basic abuse detection for customers not on the dedicated Akamai API Security product. The Adaptive Security Engine analyzes triggers continuously and emits one-click tuning recommendations that materially reduce the false-positive review backlog.
App and API Protector Hybrid (announced April 2025) extends the same WAF rules into multicloud and on-prem environments that cannot sit behind the Akamai edge. The Hybrid edition standardizes WAF policy across edge-fronted and non-edge-fronted environments under a single console. It is not a one-click rollout. Hybrid pairs with non-Akamai-edge architectures by deploying agents or proxies that need their own operational care.
Vendor-default policies are the wrong starting point. They generate noise that breaks legitimate traffic and erodes developer and customer trust before the program is six weeks old. Merito's standard rollout begins with rule design against the customer's traffic profile, runs a tuning beat against the first thirty days of real attack data, and stands up an operating model for ongoing rule changes (who authors, who reviews, where changes live in source control). The Adaptive Security Engine's recommendations are inputs to that workflow, not a replacement for it.
App and API Protector is the in-line layer of the Akamai runtime stack. Customers needing dedicated network-layer DDoS scrubbing add Prolexic for layer-3 and layer-4 protection. Customers with significant API surface area add Akamai API Security for behavioral analytics and shadow-API discovery the inline WAF cannot do. Customers with payment surfaces or heavy third-party-script footprints add Client-side Protection and Compliance.
Ideal use cases
What it is best at
Continuous machine-learning analysis of triggered rules emits one-click tuning recommendations with a published 5x reduction in false positives. On programs that have a real review queue, this is the difference between weekly tuning meetings and a backlog that drifts.
More than 1,700 known bots categorized as good, bad, or evaluating, plus custom bot definitions and adaptive scoring. The breadth matters for retail, media, and ticketing customers who fight credential stuffing and scraping at scale.
App and API Protector Hybrid (April 2025) standardizes WAF policy across edge and non-edge environments under one console. It is the answer to programs that cannot put every workload behind Akamai but still want one WAF policy.
Rate limiting, basic abuse detection, and OpenAPI-aware rule evaluation are baked into the WAAP plane. Customers with modest API surface get useful protection without buying the dedicated API Security product on day one.
Core capabilities
Inline rule evaluation against the OWASP Top 10, language-specific injection categories, and custom rule sets.
Adaptive coverage updates
Akamai's threat research team pushes rule updates against newly observed attack patterns. Customers receive coverage without manual rule authoring for each new CVE class.
Custom rule authoring
Per-property custom rules cover application-specific paths, headers, and cookies. Used for business-logic guardrails and customer-specific suppression of false positives.
Adaptive Security Engine
Continuous machine-learning analysis of rule triggers, with one-click tuning recommendations. Reduces false-positive review time on programs that operate the rule set actively.
Identification and policy enforcement against automated traffic, both benign and abusive.
Known bot directory
More than 1,700 categorized bots covering search, monitoring, scraping, and abuse. Customers select per-category enforcement (allow, monitor, challenge, deny).
Custom bot definitions
Customer-specific bot signatures for traffic patterns the directory does not cover (specific user-agent strings, behavioral signals, header combinations).
Adaptive scoring
Behavioral scoring for unknown automation, combining device, network, and request characteristics. Useful against credential stuffing, scraping, and inventory abuse.
Application-layer flood and abuse protections delivered inline at the edge.
Rate limiting
Per-path, per-API, and per-client rate controls with custom thresholds. Blocks application-layer floods that survive layer-3 and layer-4 scrubbing.
Slow-attack mitigation
Detection of slowloris and similar attacks that exhaust application threads without triggering rate thresholds.
Origin shielding
Edge-side caching and connection pooling reduce origin load during application-layer floods, keeping the application available even when the WAF is actively mitigating.
Baseline API protections inside the WAAP plane for customers not on the dedicated API Security product.
OpenAPI-aware enforcement
Rules evaluate against the customer's OpenAPI specifications so request structure is validated alongside payload content.
Per-API rate limiting
API-specific thresholds and abuse detection against common API attack patterns (enumeration, scraping, credential testing).
API discovery (basic)
Inline traffic analysis surfaces API paths the WAF sees. Customers needing comprehensive shadow-API discovery move to Akamai API Security.
Operational features that turn the console into a managed program.
App and API Protector Hybrid
Same WAF rules extended to multicloud and on-prem environments. Reduces operational gap between edge-fronted apps and apps that cannot sit behind Akamai.
Property as code
Akamai Pipeline and the EdgeWorkers configuration model let edge property and WAF policy live in version control alongside the application.
SIEM and ticketing forwarding
Findings flow into Splunk, QRadar, Sentinel, and ticketing systems through Akamai DataStream and SIEM connectors.
Where it fits in the stack
Deployment and implementation
Licensing and packaging
App and API Protector (Standard)
Edge-only WAAP coverage including WAF, bot management, layer-7 DDoS, and inline API protections.
Best for: Programs that can route the protected hostnames through the Akamai edge.
App and API Protector Hybrid
Standard plus extension into multicloud and on-prem environments through agents and proxies that share the same WAF policy plane.
Best for: Programs with non-edge workloads that still want one WAF policy across the footprint.
Merito services
Merito sells licenses and the delivery work around them. Pick the service that matches where you are in the lifecycle.
Property setup, WAF and bot rule design against the customer's traffic profile, Adaptive Security Engine adoption, and SIEM and ticketing integration.
Explore service02AppSec program scoping for App and API Protector adoption alongside Cloudflare, AWS WAF, F5, and other inline runtime tooling.
Explore service03WAF policy as code through Akamai Pipeline and the Terraform provider. Promotion across environments and rule-change review inside the customer's CI/CD.
Explore service04Named engineer, priority SLAs, and release-window coverage for App and API Protector in production.
Explore service05Long-term run support including ongoing rule tuning, false-positive review queue ownership, bot policy maintenance, and Adaptive Security Engine recommendation triage.
Explore service06Role-based training for AppSec engineers, edge platform engineers, and SOC analysts using App and API Protector output.
Explore serviceApp and API Protector licensing
Vendor-default rules erode trust by month two. Buy the license through Merito and get the rule design, bot policy, false-positive review, and Hybrid rollout together.
Merito point of view
App and API Protector is a strong inspection plane. The Adaptive Security Engine genuinely reduces tuning toil. The bot directory is the practical asset for retail and media. None of those features fix a program where vendor-default rules ship to production untouched and the false-positive review queue has no named owner. Merito's first thirty days on every Akamai engagement are rule design against the customer's traffic profile, a tuning beat against real attack data, and the operating-model decisions that decide whether the program runs.
Hybrid is real and useful, and it is not a one-click rollout. Programs that adopt Hybrid expecting parity with the edge-only deployment underestimate the operational care the agents and proxies need. Merito scopes Hybrid as a deployment-architecture project that pays back on programs with significant non-edge workloads.
App and API Protector layers with the rest of the Akamai runtime stack. Programs running App and API Protector without Prolexic for layer-3 and layer-4 are at risk of network-layer floods that overwhelm even a healthy WAF. Programs running App and API Protector without Akamai API Security on a significant API surface are blind to the behavioral patterns and shadow APIs the inline WAF cannot see. The right answer is layered defense, not a single product carrying the runtime program alone.
What buyers usually underestimate
Related from Merito
Related solutions
Related services
Related products
Frequently Asked Questions
Consultation request
Share your traffic profile, current WAF (if any), and the runtime risks you are most worried about. A Merito Akamai specialist follows up within one business day.
Inline WAAP
One inspection plane at the Akamai edge with the Adaptive Security Engine emitting tuning recommendations against live traffic.
Rule design first
Vendor defaults generate noise. Merito's first thirty days are rule design, bot policy authoring, and false-positive review operating model.
Next step
An Akamai App and API Protector engagement with Merito starts with rule design, bot policy, and the operating model. Day-one defaults are how runtime programs lose developer and customer trust.