42Crunch
42Crunch provides an OpenAPI-native API security platform spanning design, testing, and runtime protection, serving Global 2500 enterprises, government agencies, and nearly one million developers through freemium, enterprise subscriptions, and partner channels.
- Company typePrivate
- Founded2017
- HeadquartersLondon, United Kingdom
- Headcount51–100
- GTM typeB2B
- OfferingSoftware
What 42Crunch does
42Crunch is an API security platform company founded in 2017 and headquartered in London (with operations across San Francisco, Dublin, Montpellier, and Sydney), serving Global 2500 enterprises, government agencies, and a public community of nearly one million developers. The platform uses the OpenAPI specification as a single source of truth to enforce security deterministically across the full API lifecycle — design, development, CI/CD testing, and runtime — through static API Audit (300+ contract checks), dynamic API Scan, a contract-driven Micro API Firewall for runtime enforcement, API Discovery, and Security Quality Gates integrated into IDEs (VS Code, JetBrains, Eclipse) and CI/CD pipelines (GitHub Actions, GitLab CI, Azure DevOps, Jenkins, Bitbucket, Bamboo, SonarQube).
The company's 2025–2026 product expansion extends the same contract-based enforcement to the agentic AI era via a Secure MCP Server that governs AI agent-to-API calls and guardrails embedded in GitHub Copilot and Anthropic's Claude Code. Go-to-market combines a freemium developer funnel (free IDE plugin, $7.50/month Single User, $375/month Team tier) with enterprise field sales for 20+ user, 250+ endpoint contracts at custom pricing, plus channel revenue from a reseller/integrator Partner Program, Microsoft Azure Marketplace listing, and OEM integrations into five major API gateways (Apigee, Kong, Microsoft Azure API Management, Axway, WSO2). Total disclosed funding is approximately $20.6M across seed rounds (2017, 2018, 2020) and a $17M Series A led by Energy Impact Partners with Adara Ventures in May 2021. The company holds ISO 27001 certification and is recognized as a Leader by KuppingerCole with endorsements from Gartner, Omdia, and EMA.
42Crunch firmographics
Firmographics- Name
- 42Crunch
- Legal name
- 42Crunch Ltd
- Website
- https://42crunch.com
- Company type
- Private
- Founded year
- 2017
- Operating status
- Operating
- Headcount range
- 51–100 employees
- Short description
- 42Crunch provides an OpenAPI-native API security platform spanning design, testing, and runtime protection, serving Global 2500 enterprises, government agencies, and nearly one million developers through freemium, enterprise subscriptions, and partner channels.
- Ownership category
- akta.pro rank
42Crunch industry classification
Industry- Product category
- API Security Software
- NAICS
- Computer Systems Design and Related Services (5415)
- SIC
- Services-Computer Programming, Data Processing, Etc. (7370)
- akta.pro primary industry
- API Security, Auth & Rate Limiting (BPAMAOAF)
- akta.pro secondary industries
- Secure Model Deployment & Runtime Protection (sandboxing, isolation) (HDAAAKAH), Edge Security Delivery (DDoS, WAF, Bot Mitigation at Edge) (HDABAGAH)
Keywords
Where 42Crunch is headquartered
LocationHeadquarters
- HQ city
- London
- HQ country
- United Kingdom
- HQ region
- Europe
Offices5 records
Markets served
42Crunch business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Marketing or Sales, Operations, Infrastructure
Revenue model
- Subscription - Team Tier: Team subscription starting from $375/month for 5 users and 75 endpoints; monthly or annual online subscriptions for teams of 5, 15 or 25 users with unlimited API security tests in IDE and CICD. SaaS platform account with customization options.
- Subscription - Enterprise: Custom-priced enterprise offering for 20+ users and 250+ endpoints with full flexibility on products and packages, including API Gateway and SIEM/SOC integrations.
- Freemium - Free Tier: Free single-user tier with up to 100 monthly operations for API Contract Generator, API Audit and API Scan; IDE only access; no platform account; self-service support only. Drives developer adoption and community growth.
- Subscription - Single User: Single user paid subscription starting from $7.50/month with increased usage allowances of up to 2,000 operations each for API Contract Generator, API Audit and API Scan per month, plus increased support.
- Partner/Reseller Channel Revenue: Revenue from reseller partners and integrators who incorporate the 42Crunch API security testing engine into their own platforms.
- Professional Services - Enterprise POC: Enterprise Free Trial (60-day period for up to 50 users and 50 APIs with unlimited audit and scans) plus introductory call with senior engineer to qualify-fit opportunities.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Monthly | Free - $0/month, single user with limited monthly operations and IDE-only access |
| Per seat | Monthly | Single User - from $7.50/month, increased allowances and support |
| Subscription | Monthly | Team - from $375/month, 5+ users and 75+ endpoints |
| Subscription | Multi-year contract | Enterprise - custom pricing, 20+ users and 250+ endpoints |
Go-to-market motion6 records
Distribution channels7 records
Marketing channels9 records
42Crunch product offering
Product offeringCore offering
42Crunch provides an OpenAPI-native API security platform that delivers continuous protection across the entire API lifecycle — from design, development, and static/dynamic testing through CI/CD enforcement and runtime threat protection via a micro-API firewall. The platform performs 300+ static checks on OpenAPI contracts and dynamic scanning of live REST APIs to identify OWASP API Top 10 vulnerabilities (BOLA, BFLA, broken authentication, etc.), and extends the same contract-based deterministic enforcement to AI coding agents (GitHub Copilot, Claude Code) and AI agent consumers via the Secure MCP Server and Agentic AI Guardrails.
Product overview
42Crunch offers a single unified API Security Platform built around the OpenAPI specification as the single source of truth, combined with a portfolio of tightly integrated modules spanning the full API lifecycle. At the design and development stage, the API Design, API Contract Generator and OpenAPI Contract capabilities help teams author secure API contracts; API Security Audit and API Scan provide static and dynamic testing integrated into IDEs (VS Code, IntelliJ, Eclipse) and CI/CD pipelines (GitHub Actions, GitLab CI, Azure DevOps, Jenkins, Bitbucket, Bamboo, SonarQube); API Discovery builds a Living API Inventory; API Runtime Threat Protection and the API Protection (Micro API Firewall) module deliver runtime enforcement; OWASP API Security Top 10 Protection provides policy and compliance coverage; Guardrails for Agentic AI Coding and the Secure MCP Server extend the same deterministic contract-based enforcement to AI coding agents (GitHub Copilot, Claude Code) and AI agent consumers operating through the Model Context Protocol. The platform is supported by the APIsecurity.io community and newsletter.
Differentiator
Problem solved
Functional benefit
Products and services
- 42Crunch API Security Platform Unified end-to-end API security platform providing continuous protection across the entire API lifecycle — from design and development through testing and runtime protection — for AI-driven and traditional enterprises. Sold via Free, Single User ($7.50+/month), Team ($375+/month) and Enterprise (custom) tiers.
- Secure MCP Server Security-first control plane between AI agents and the APIs they invoke through the Model Context Protocol — validates inputs, blocks AI-to-API threats, controls AI agent interaction with APIs, and authenticates both user and agent identity with fine-grained per-tool/per-API/per-operation authorization.
- Guardrails for Agentic AI Coding
Quantifiable outcome
- Trusted by over 2 million developers and security teams at 1000s of enterprises
- +6 more outcomes
Companies that use 42Crunch
Customer profileNamed customers17 records
Segments12 records
Ideal customer profiles4 records
42Crunch technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration23 records
AI capability4 records
Feature10 records
42Crunch partnerships and signals
Strategic signalPartnerships
Nine partnerships are on record, tiered flagship - ai coding platform integration, flagship - ai coding agent integration, core - partnership for conversational commerce api security, core - analyst research partnership, flagship - multi-gateway integration partners, flagship - cloud siem integration and misa membership, minor - webinar partner, core - mobile api security integration and flagship - major api-first platform integration partner.
- GitHub Copilotflagship - ai coding platform integration42Crunch API Security Testing Plugin for GitHub Copilot announced June 16, 2026, enabling developers to audit, test, remediate and validate API security vulnerabilities directly within AI-assisted development workflows. Addresses the fundamental scaling challenge that human security review cannot keep pace with AI-generated code output.
- Anthropic Claude Codeflagship - ai coding agent integrationIntegration with Anthropic's Claude Code creating 'Agentic DevSecOps' announced May 25, 2026 - a fully automated security model where AI agents write and secure code simultaneously. Establishes a continuous 'detect-and-fix' loop that identifies API vulnerabilities, autonomously generates context-aware fixes, applies patches, and validates solutions in real time.
- Payemoji (Message My Customer Ltd)core - partnership for conversational commerce api securityPartnership announced July 12, 2023 in Dublin, Ireland. 42Crunch and Payemoji's conversational commerce solution will focus on identifying real-world enterprise use cases where conversational commerce platforms are susceptible to API attacks, and improving practitioner tools and best practices.
- Enterprise Management Associates (EMA)core - analyst research partnershipCo-hosted joint webinar 'Why API Security Should Not Wait Until Production' on May 11, 2023. EMA provided research survey data showing 32% of firms only implemented API security standards in production environment. Joint webinar explored why businesses cannot let API Security be an afterthought.
- API Gateway Partners (Apigee, Kong, Microsoft, Axway, WSO2)flagship - multi-gateway integration partnersOut-of-the-box integrations into market-leading API Gateway solutions from Apigee, Kong, Microsoft, Axway, and WSO2. Integration enables 42Crunch to feed validated OpenAPI specifications to API Gateways for runtime protection at the edge.
- Microsoft (Microsoft Azure Sentinel / MISA)flagship - cloud siem integration and misa membership42Crunch is a member of the Microsoft Intelligent Security Association (MISA). Integration with Microsoft Sentinel provides direct integration of API security platform with the Sentinel SIEM. 42Crunch Microsoft Sentinel marketplace plugin available on Microsoft Azure Marketplace. Recognition as a Microsoft Security Excellence Awards finalist (Security Software Innovator) in 2023.
- Manicode Securityminor - webinar partnerCo-hosted 2-part webinar series 'Defending APIs with Jim Manico' announced November 10, 2022. Manicode Security is the webinar partner - 100% of their focus is teaching developers to write secure code. Episodes cover CSRF and SSRF request forgery topics.
- Approovcore - mobile api security integrationJoint webinar 'How to Extend Protection of your Data from API to Mobile Application' announced March 8, 2022. Joint solution delivers shift-left API protection as well as run-time shielding that extends to mobile apps and the environments they run in. Approov shields mobile apps from cloning and modification and defends against manipulation of the client environment.
- Postmanflagship - major api-first platform integration partnerIntegration of 42Crunch's API security services with Postman's API collaboration platform announced June 23, 2021. Enables API developers and application security teams to implement API security design and testing as part of an API-First approach in Postman. Co-hosted webinars and joint marketing initiatives.
Scale indicators12 records
Recent moves6 records
Expansion highlights7 records
42Crunch competitors and assessment
Company assessmentDirect peers
- Traceable AI: Traceable AI is an API security and observability platform offering API discovery, threat detection, and runtime protection for enterprise APIs. It is a direct peer to 42Crunch in API security, with comparable enterprise customer profile and overlapping runtime and posture management features.
- Data Theorem: Data Theorem provides application security including API security, mobile app security, and cloud security with runtime protection and discovery. It is a direct peer to 42Crunch in the API security testing and runtime protection category, frequently co-listed in analyst and buyer guides.
- Salt Security: Salt Security is a leading API security platform specializing in API threat protection, discovery, and posture management. It is a direct peer to 42Crunch in the API security category, targeting the same enterprise buyer with overlapping runtime protection and discovery capabilities, and is consistently listed alongside 42Crunch in analyst and market guides.
- Cequence Security: Cequence Security provides API security, bot management, and fraud prevention for enterprise applications. It is a direct peer to 42Crunch in API security with overlapping runtime protection and discovery capabilities, and is co-listed alongside 42Crunch in API security market guides.
- Wallarm: Wallarm is an API and application security platform offering API discovery, runtime protection, and WAAP capabilities. It is a direct peer to 42Crunch in API security with overlapping runtime firewall and API discovery features, often positioned in the same analyst comparisons.
- APIsec: APIsec is an automated API security testing platform that scans APIs for vulnerabilities through continuous, scheduled testing. It is a direct peer to 42Crunch's API Scan dynamic testing capability, addressing the same enterprise pain point of finding vulnerabilities across the API estate.
Emerging players
- Akto: Akto is an API security platform focused on API discovery, sensitive data exposure detection, and runtime testing. It is an emerging player in API security with meaningful overlap with 42Crunch's discovery and runtime testing capabilities, particularly for engineering-led buyers.
Broad incumbents
- Microsoft Defender for APIs: Microsoft Defender for APIs is a cloud-native API security posture management and threat detection offering integrated into Defender for Cloud. As a broad incumbent and a MISA partner of 42Crunch, Microsoft is both an integration partner and a competitive threat — particularly for Azure-native enterprises that may consolidate onto Defender for APIs rather than a standalone platform.
- Imperva API Security: Imperva is an established cybersecurity vendor offering API Security as part of its broader application and data security portfolio. As a broad incumbent, Imperva bundles API security into platform deals that compete head-to-head with 42Crunch's standalone positioning in enterprise procurement.
- Akamai API Security (Noname): Akamai acquired Noname Security and now offers API security as part of its App & API Protection portfolio across its global edge platform. As a broad incumbent, Akamai is a key competitive threat to 42Crunch given its scale, distribution, and ability to bundle API security into edge and application delivery contracts.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat7 records
Key risks6 records
Key highlights7 records
Customer concentration
42Crunch social profiles
Digital presence42Crunch compliance and trust
Trust signalCompliance5 records
42Crunch financial estimates
Financial estimateRevenue estimate
Valuation estimate
42Crunch leadership team
Management profileNumber of profiles
Profiles6 records
42Crunch funding detail
Funding detailFunding overview
Funding rounds4 records
Investors2 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
42Crunch M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about 42Crunch
What does 42Crunch do?
42Crunch provides an OpenAPI-native API security platform that delivers continuous protection across the entire API lifecycle — from design, development, and static/dynamic testing through CI/CD enforcement and runtime threat protection via a micro-API firewall. The platform performs 300+ static checks on OpenAPI contracts and dynamic scanning of live REST APIs to identify OWASP API Top 10 vulnerabilities (BOLA, BFLA, broken authentication, etc.), and extends the same contract-based deterministic enforcement to AI coding agents (GitHub Copilot, Claude Code) and AI agent consumers via the Secure MCP Server and Agentic AI Guardrails.
Is 42Crunch a public or private company?
42Crunch is a private company. It is classified as venture growth investor backed and is currently operating.
When was 42Crunch founded?
42Crunch was founded in 2017. It employs 51 to 100 people.
Where is 42Crunch based?
42Crunch is headquartered in London, United Kingdom, in the Europe region.
How does 42Crunch make money?
Six revenue lines are on record. Subscription - Team Tier is the primary driver. The others are subscription - Enterprise, freemium - Free Tier, subscription - Single User, partner/Reseller Channel Revenue and professional Services - Enterprise POC.
Who are 42Crunch's main competitors?
Direct peers on record are Traceable AI, Data Theorem, Salt Security, Cequence Security, Wallarm and APIsec. Akto is listed as an emerging player. Broad incumbents are Microsoft Defender for APIs, Imperva API Security and Akamai API Security (Noname).
Does 42Crunch have an API?
Yes. 42Crunch offers a platform with public-facing developer integrations including REST API dynamic security testing via GitHub Marketplace actions, IDE plugins/extensions for VS Code, JetBrains IntelliJ and Eclipse, CI/CD plugins for GitHub Actions, GitLab CI, Azure DevOps, Jenkins, Bitbucket, Bamboo and SonarQube, as well as REST API integrations with API Gateways. The 42Crunch Secure MCP Server is offered for governing AI agent interactions with enterprise APIs through the Model Context Protocol. Developer documentation is at docs.42crunch.com.
What industry is 42Crunch in?
42Crunch's product category is API Security Software. Its primary akta.pro industry code is BPAMAOAF, API Security, Auth & Rate Limiting, with a secondary code of HDAAAKAH, Secure Model Deployment & Runtime Protection (sandboxing, isolation). Its NAICS code is 5415 and its SIC code is 7370.