Apisec

What Apisec does

APIsec (legal entity APIsec Inc., also operating as APIsec.ai) is a privately held application security company founded in 2018 and headquartered at One Sansome St, Suite 3500, San Francisco, California, with a Delaware incorporation. The company develops and sells an AI-powered continuous API security testing platform that automatically maps API endpoints, runs thousands of attack simulations, and detects business logic vulnerabilities — such as BOLA (Broken Object Level Authorization) and broken access control — that legacy DAST/SAST scanners cannot detect. The platform is delivered as multi-tier SaaS subscriptions: a Free tier ($0/month), a Pen Test tier (custom pricing for ad-hoc and certified reports), a Standard tier at approximately $690/month per 100 endpoints ($8,275/year per 100 endpoints), and a Pro tier at approximately $2,750/month per 100 endpoints ($33,075/year per 100 endpoints) with white-glove onboarding and on-premises deployment options. The product portfolio is supplemented by two sub-brands: APIsec Bolt, a free Chrome extension that captures live browser traffic to discover APIs and export OpenAPI specifications, and APIsec University, a free education and certification platform with over 100,000 registered students.

The company targets three primary customer segments: large enterprise organizations (with company claims that 75% of Fortune 100 use the product on its homepage and 80% on its About page), DevSecOps teams seeking shift-left CI/CD-integrated testing, and compliance-focused organizations mapping testing to PCI DSS, HIPAA, SOC 2, ISO 27001, and GDPR requirements. Named customer logos span retail (Nike, Home Depot), logistics (FedEx), payments (PayPal), healthcare (Johnson & Johnson, McKesson, Cigna), banking (Bank of America), automotive (Tesla), and beverages (Coca-Cola). Revenue mechanics are dominated by recurring SaaS subscriptions priced per 100 endpoints, with annual billing carrying a discount. Distribution combines product-led growth (free tier, Bolt extension, free University) for top-of-funnel, a community-led motion (APIsec University, 15,000+ Discord members, ambassador program) for developer relations, and a field sales motion targeting Fortune 100 customers on the Pro tier.

Capital structure is partially unresolved in the source materials: one block explicitly states no external funding rounds were disclosed and that the company appears bootstrapped, while a separate unverified data block references a single 2018 pre-seed of $2 million from Canaan Partners. No acquisitions, mergers, leadership changes, restructuring events, or regulatory actions are publicly disclosed.

Name

Apisec

Legal name

APIsec Inc.

Website

https://apisec.ai

Company type

Private

Founded year

2018

Operating status

Operating

Headcount range

11–50 employees

Short description

Founded in 2018, APIsec sells an AI-powered continuous API security testing platform for enterprises and DevSecOps teams. It maps API endpoints, simulates attacks, and detects business logic vulnerabilities across claimed 5,000+ organizations and 75% of Fortune 100 customers.

Ownership category

akta.pro rank

Product category

API Security Testing

NAICS

Computer Systems Design and Related Services (54151)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

API Security (Discovery, Testing, Runtime Protection) (HDADACAB)

akta.pro secondary industries

Application Security Testing (SAST/DAST/IAST/SCA) (HDADACAC), CI/CD & DevSecOps Security (Pipeline, Secrets, IaC Scanning) (HDADACAF), Vulnerability Management & Penetration Testing Services (BPAEADAD)

Keywords

• API security testing
• Penetration testing automation
• Vulnerability scanning
• OWASP API compliance
• DevSecOps integration

Headquarters

HQ city

San Francisco

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Marketing or Sales, Infrastructure, Operations

Revenue model

1. API Security Testing SaaS Subscription: Subscription-based pricing tiers (FREE, PEN TEST, STANDARD, PRO) based on number of API endpoints tested; billed monthly or annually with discounts for annual commitments

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels6 records

Core offering

APIsec provides an AI-powered continuous API security testing platform that automatically maps every API endpoint, runs thousands of attack simulations (including business logic flaws like BOLA and broken access control), and delivers verified vulnerabilities with remediation detail. It replaces manual annual penetration testing with continuous, automated testing integrated into CI/CD pipelines and enterprise API gateways, complemented by a free Chrome-based API discovery extension (Bolt) and a community education platform (APIsec University).

Product overview

APIsec offers a unified AI-powered API security platform centered on the APIsec Platform, which provides continuous, automated penetration testing and vulnerability detection across CI/CD pipelines. The portfolio includes APIsec Bolt, a free browser extension for API discovery and inventory generation, and APIsec University, a free educational platform with courses and certifications. The platform is designed to replace annual manual pen tests with continuous, AI-driven testing that covers OWASP API Top 10 and business logic vulnerabilities.

Differentiator

Problem solved

Functional benefit

Brands

• APIsec University: Free API security training platform offering courses, certifications, and educational resources for API security professionals.
• Bolt

Products and services

• APIsec Platform AI-powered continuous API security testing platform that automatically maps API endpoints, runs thousands of attack simulations, and uncovers real business logic flaws and data exposures across CI/CD pipelines, targeting enterprise security teams and DevSecOps organizations.
• APIsec Bolt Free Chrome browser extension for API discovery that captures live API traffic as users browse websites, generating a clean API inventory and OpenAPI specifications without proxies, agents, or setup, targeting developers and security engineers needing quick API inventory.
• APIsec University Free API security education platform offering courses, certifications, and community resources with over 120,000 registered students, including the Certified API Security Analyst Exam and APIsec Certified Practitioner Exam, aimed at AppSec professionals and developers.

Quantifiable outcome

• 75% of Fortune 100 companies trust APIsec for API security
• +3 more outcomes

Named customers10 records

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration7 records

AI capability5 records

Feature6 records

Partnerships

Six partnerships are on record, tiered core.

• KongcoreTechnology or IntegrationAPIsec integrates with Kong API Gateway for automated security testing; tests APIs managed through Kong deployments
• Google Cloud Platform (Apigee)coreTechnology or IntegrationIntegration with Google Cloud's Apigee API management platform for security testing within GCP environments
• AWS API GatewaycoreTechnology or IntegrationNative integration with AWS API Gateway for testing APIs deployed on Amazon Web Services cloud infrastructure
• JiracoreTechnology or IntegrationIntegration to send vulnerability findings directly to Jira project management for streamlined remediation workflows
• ServiceNowcoreTechnology or IntegrationIntegration to push security findings into ServiceNow ticketing and IT service management workflows
• GitHubcoreTechnology or IntegrationIntegration with GitHub for CI/CD pipeline security testing and automated vulnerability scanning in development workflows

Scale indicators7 records

Recent moves5 records

Expansion highlights6 records

Direct peers

• Salt Security: Direct competitor offering API security posture management and runtime protection with AI-driven behavioral analysis. Targets the same enterprise security buyers with overlapping API discovery and vulnerability detection capabilities.
• Traceable AI: Direct API security and observability competitor combining threat detection, fraud prevention, and API testing. Competes head-to-head in enterprise AppSec deals with overlapping AI-based vulnerability detection.
• Noname Security (Akamai): API security platform acquired by Akamai in 2023; offers API discovery, posture management, and runtime protection. Competes directly with APIsec in Fortune 500 enterprise accounts, now backed by Akamai's distribution.
• 42Crunch: API security vendor focused on API contract testing, vulnerability scanning, and runtime protection across the SDLC. Closely comparable shift-left DevSecOps approach targeting enterprise API developers and security teams.
• DataTheorem: Application and API security SaaS offering mobile, web, and cloud API scanning with continuous testing. Competes in the same enterprise AppSec category with overlapping automated testing value proposition.

Emerging players

• StackHawk: Developer-focused DAST and API security testing platform integrated into CI/CD pipelines. Targets DevSecOps teams with similar shift-left testing philosophy, though with broader web app DAST scope than APIsec's API-only focus.
• Invicti (Netsparker): DAST platform with API scanning capabilities acquired from Netsparker. Adjacent competitor in enterprise vulnerability scanning with growing API testing functionality for DevSecOps pipelines.

Broad incumbents

• Contrast Security: Established application security platform with IAST, RASP, and API security testing capabilities. Competes in enterprise AppSec with a broader portfolio of code-level and runtime instrumentation rather than specializing purely in APIs.
• Imperva API Security: API security offering from Imperva (Thales), covering discovery, classification, and threat protection as part of a broader web application and data security portfolio. Targets the same large enterprise security buyers as a broad incumbent.
• Cloudflare API Shield: API discovery, schema validation, and runtime protection delivered as part of Cloudflare's edge security platform. Represents the platform-consolidation threat, bundling API security with WAF, DDoS, and Zero Trust services.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat6 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/apisec_ai
• LinkedInlinkedin.com/company/apisec

Compliance5 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles7 records

Funding overview

Funding rounds1 record

Investors1 record

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Apisec