Apisec
Founded in 2018, APIsec sells an AI-powered continuous API security testing platform for enterprises and DevSecOps teams. It maps API endpoints, simulates attacks, and detects business logic vulnerabilities across claimed 5,000+ organizations and 75% of Fortune 100 customers.
- Company typePrivate
- Founded2018
- HeadquartersSan Francisco, United States
- Headcount51–100
- GTM typeB2B
- OfferingSoftware
What Apisec does
APIsec (legal entity APIsec Inc., also operating as APIsec.ai) is a privately held application security company founded in 2018 and headquartered at One Sansome St, Suite 3500, San Francisco, California, with a Delaware incorporation. The company develops and sells an AI-powered continuous API security testing platform that automatically maps API endpoints, runs thousands of attack simulations, and detects business logic vulnerabilities — such as BOLA (Broken Object Level Authorization) and broken access control — that legacy DAST/SAST scanners cannot detect. The platform is delivered as multi-tier SaaS subscriptions: a Free tier ($0/month), a Pen Test tier (custom pricing for ad-hoc and certified reports), a Standard tier at approximately $690/month per 100 endpoints ($8,275/year per 100 endpoints), and a Pro tier at approximately $2,750/month per 100 endpoints ($33,075/year per 100 endpoints) with white-glove onboarding and on-premises deployment options. The product portfolio is supplemented by two sub-brands: APIsec Bolt, a free Chrome extension that captures live browser traffic to discover APIs and export OpenAPI specifications, and APIsec University, a free education and certification platform with over 100,000 registered students.
The company targets three primary customer segments: large enterprise organizations (with company claims that 75% of Fortune 100 use the product on its homepage and 80% on its About page), DevSecOps teams seeking shift-left CI/CD-integrated testing, and compliance-focused organizations mapping testing to PCI DSS, HIPAA, SOC 2, ISO 27001, and GDPR requirements. Named customer logos span retail (Nike, Home Depot), logistics (FedEx), payments (PayPal), healthcare (Johnson & Johnson, McKesson, Cigna), banking (Bank of America), automotive (Tesla), and beverages (Coca-Cola). Revenue mechanics are dominated by recurring SaaS subscriptions priced per 100 endpoints, with annual billing carrying a discount. Distribution combines product-led growth (free tier, Bolt extension, free University) for top-of-funnel, a community-led motion (APIsec University, 15,000+ Discord members, ambassador program) for developer relations, and a field sales motion targeting Fortune 100 customers on the Pro tier.
Capital structure is partially unresolved in the source materials: one block explicitly states no external funding rounds were disclosed and that the company appears bootstrapped, while a separate unverified data block references a single 2018 pre-seed of $2 million from Canaan Partners. No acquisitions, mergers, leadership changes, restructuring events, or regulatory actions are publicly disclosed.
Apisec firmographics
Firmographics- Name
- Apisec
- Legal name
- APIsec Inc.
- Website
- https://apisec.ai
- Company type
- Private
- Founded year
- 2018
- Operating status
- Operating
- Headcount range
- 51–100 employees
- Short description
- Founded in 2018, APIsec sells an AI-powered continuous API security testing platform for enterprises and DevSecOps teams. It maps API endpoints, simulates attacks, and detects business logic vulnerabilities across claimed 5,000+ organizations and 75% of Fortune 100 customers.
- Ownership category
- akta.pro rank
Apisec industry classification
Industry- Product category
- API Security Testing
- NAICS
- Computer Systems Design and Related Services (54151)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- API Security (Discovery, Testing, Runtime Protection) (HDADACAB)
- akta.pro secondary industries
- Application Security Testing (SAST/DAST/IAST/SCA) (HDADACAC), CI/CD & DevSecOps Security (Pipeline, Secrets, IaC Scanning) (HDADACAF), Vulnerability Management & Penetration Testing Services (BPAEADAD)
Keywords
Where Apisec is headquartered
LocationHeadquarters
- HQ city
- San Francisco
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
Apisec business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Marketing or Sales, Infrastructure, Operations
Revenue model
- API Security Testing SaaS Subscription: Subscription-based pricing tiers (FREE, PEN TEST, STANDARD, PRO) based on number of API endpoints tested; billed monthly or annually with discounts for annual commitments
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Monthly | Free tier for trying out APIsec |
| Subscription | Monthly | Ad-hoc testing and compliance snapshots |
| Subscription | Annual | Growing teams with automation |
| Subscription | Annual | Enterprise with deep integration |
Go-to-market motion3 records
Distribution channels4 records
Marketing channels6 records
Apisec product offering
Product offeringCore offering
APIsec provides an AI-powered continuous API security testing platform that automatically maps every API endpoint, runs thousands of attack simulations (including business logic flaws like BOLA and broken access control), and delivers verified vulnerabilities with remediation detail. It replaces manual annual penetration testing with continuous, automated testing integrated into CI/CD pipelines and enterprise API gateways, complemented by a free Chrome-based API discovery extension (Bolt) and a community education platform (APIsec University).
Product overview
APIsec offers a unified AI-powered API security platform centered on the APIsec Platform, which provides continuous, automated penetration testing and vulnerability detection across CI/CD pipelines. The portfolio includes APIsec Bolt, a free browser extension for API discovery and inventory generation, and APIsec University, a free educational platform with courses and certifications. The platform is designed to replace annual manual pen tests with continuous, AI-driven testing that covers OWASP API Top 10 and business logic vulnerabilities.
Differentiator
Problem solved
Functional benefit
Brands
- APIsec University: Free API security training platform offering courses, certifications, and educational resources for API security professionals.
- Bolt
Products and services
- APIsec Platform AI-powered continuous API security testing platform that automatically maps API endpoints, runs thousands of attack simulations, and uncovers real business logic flaws and data exposures across CI/CD pipelines, targeting enterprise security teams and DevSecOps organizations.
- APIsec Bolt Free Chrome browser extension for API discovery that captures live API traffic as users browse websites, generating a clean API inventory and OpenAPI specifications without proxies, agents, or setup, targeting developers and security engineers needing quick API inventory.
- APIsec University Free API security education platform offering courses, certifications, and community resources with over 120,000 registered students, including the Certified API Security Analyst Exam and APIsec Certified Practitioner Exam, aimed at AppSec professionals and developers.
Quantifiable outcome
- 75% of Fortune 100 companies trust APIsec for API security
- +3 more outcomes
Companies that use Apisec
Customer profileNamed customers10 records
Segments3 records
Ideal customer profiles3 records
Apisec technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Integration7 records
AI capability5 records
Feature6 records
Apisec partnerships and signals
Strategic signalPartnerships
Six partnerships are on record, tiered core.
- KongcoreAPIsec integrates with Kong API Gateway for automated security testing; tests APIs managed through Kong deployments
- Google Cloud Platform (Apigee)coreIntegration with Google Cloud's Apigee API management platform for security testing within GCP environments
- AWS API GatewaycoreNative integration with AWS API Gateway for testing APIs deployed on Amazon Web Services cloud infrastructure
- JiracoreIntegration to send vulnerability findings directly to Jira project management for streamlined remediation workflows
- ServiceNowcoreIntegration to push security findings into ServiceNow ticketing and IT service management workflows
- GitHubcoreIntegration with GitHub for CI/CD pipeline security testing and automated vulnerability scanning in development workflows
Scale indicators7 records
Recent moves5 records
Expansion highlights6 records
Apisec competitors and assessment
Company assessmentDirect peers
- Salt Security: Direct competitor offering API security posture management and runtime protection with AI-driven behavioral analysis. Targets the same enterprise security buyers with overlapping API discovery and vulnerability detection capabilities.
- Traceable AI: Direct API security and observability competitor combining threat detection, fraud prevention, and API testing. Competes head-to-head in enterprise AppSec deals with overlapping AI-based vulnerability detection.
- Noname Security (Akamai): API security platform acquired by Akamai in 2023; offers API discovery, posture management, and runtime protection. Competes directly with APIsec in Fortune 500 enterprise accounts, now backed by Akamai's distribution.
- 42Crunch: API security vendor focused on API contract testing, vulnerability scanning, and runtime protection across the SDLC. Closely comparable shift-left DevSecOps approach targeting enterprise API developers and security teams.
- DataTheorem: Application and API security SaaS offering mobile, web, and cloud API scanning with continuous testing. Competes in the same enterprise AppSec category with overlapping automated testing value proposition.
Emerging players
- StackHawk: Developer-focused DAST and API security testing platform integrated into CI/CD pipelines. Targets DevSecOps teams with similar shift-left testing philosophy, though with broader web app DAST scope than APIsec's API-only focus.
- Invicti (Netsparker): DAST platform with API scanning capabilities acquired from Netsparker. Adjacent competitor in enterprise vulnerability scanning with growing API testing functionality for DevSecOps pipelines.
Broad incumbents
- Contrast Security: Established application security platform with IAST, RASP, and API security testing capabilities. Competes in enterprise AppSec with a broader portfolio of code-level and runtime instrumentation rather than specializing purely in APIs.
- Imperva API Security: API security offering from Imperva (Thales), covering discovery, classification, and threat protection as part of a broader web application and data security portfolio. Targets the same large enterprise security buyers as a broad incumbent.
- Cloudflare API Shield: API discovery, schema validation, and runtime protection delivered as part of Cloudflare's edge security platform. Represents the platform-consolidation threat, bundling API security with WAF, DDoS, and Zero Trust services.
Market position
Strengths4 records
Weaknesses4 records
Competitive moat6 records
Key risks5 records
Key highlights6 records
Customer concentration
Apisec social profiles
Digital presenceApisec compliance and trust
Trust signalCompliance5 records
Apisec financial estimates
Financial estimateRevenue estimate
Valuation estimate
Apisec leadership team
Management profileNumber of profiles
Profiles7 records
Apisec funding detail
Funding detailFunding overview
Funding rounds1 record
Investors1 record
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Apisec M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Apisec
What does Apisec do?
APIsec provides an AI-powered continuous API security testing platform that automatically maps every API endpoint, runs thousands of attack simulations (including business logic flaws like BOLA and broken access control), and delivers verified vulnerabilities with remediation detail. It replaces manual annual penetration testing with continuous, automated testing integrated into CI/CD pipelines and enterprise API gateways, complemented by a free Chrome-based API discovery extension (Bolt) and a community education platform (APIsec University).
Is Apisec a public or private company?
Apisec is a private company. It is classified as venture growth investor backed and is currently operating.
When was Apisec founded?
Apisec was founded in 2018. It employs 51 to 100 people.
Where is Apisec based?
Apisec is headquartered in San Francisco, United States, in the North America region.
How does Apisec make money?
One revenue line is on record: API Security Testing SaaS Subscription.
Who are Apisec's main competitors?
Direct peers on record are Salt Security, Traceable AI, Noname Security (Akamai), 42Crunch and DataTheorem. Emerging players are StackHawk and Invicti (Netsparker). Broad incumbents are Contrast Security, Imperva API Security and Cloudflare API Shield.
Does Apisec have an API?
No public API is recorded for Apisec.
What industry is Apisec in?
Apisec's product category is API Security Testing. Its primary akta.pro industry code is HDADACAB, API Security (Discovery, Testing, Runtime Protection), with a secondary code of HDADACAC, Application Security Testing (SAST/DAST/IAST/SCA). Its NAICS code is 54151 and its SIC code is 7372.