API security vendors
We list 28 companies active in API security, and 5 of them have it as their main focus. 4 are public, 3 are owned by another company and 21 are private. Most are based in the United States (21). The oldest, F5, was founded in 1996. By revenue from annual reports, the largest company here is F5 ($3.1bn in FY2025).
By countryUnited States 21
Companies focused on API security
5 companies| Company | Based in | Founded | Size | Ownership | Revenue |
|---|---|---|---|---|---|
Cequence Security Cequence Security protects applications, APIs, and AI agents from attacks and abuse. | Santa Clara, United States | 2014 | Private | ||
Data Theorem Data Theorem provides application security for mobile, API, cloud, and AI-driven applications. | Palo Alto, United States | 2013 | Private | ||
Salt Security Salt Security provides a platform to discover and secure AI agents, MCP servers, and APIs. | Palo Alto, United States | 2018 | Private | ||
42Crunch 42Crunch provides security governance for MCP servers and APIs used by AI agents. | London, United Kingdom | Private | |||
Wallarm Wallarm provides an AI security and API security platform for enterprises running AI on AWS. | Austin, United States | Private |
Also active in API security
23 companies| Company | Based in | Founded | Size | Ownership | Revenue |
|---|---|---|---|---|---|
F5 F5 provides application delivery and security solutions for hybrid multicloud environments. | Seattle, United States | 1996 | Public, FFIV | $3.1bn (FY2025) | |
Cloudflare Cloudflare provides a global network for security, performance, and full-stack development. | San Francisco, United States | 2009 | 2,440 staff | Public, NET | $2.2bn (FY2025) |
Fastly Fastly provides an edge cloud platform that helps businesses deliver, secure, and deploy applications and AI workloads. | San Francisco, United States | 2011 | Public, FSLY | $624.0m (FY2025) | |
A10 Networks A10 Networks provides secure, high-performance networking solutions for applications and AI workloads. | San Jose, United States | 2004 | Public, ATEN | $290.6m (FY2025) | |
Google World-renowned cybersecurity firm now part of Google Cloud, delivering threat intelligence-led penetration testing and red teaming informed by front-line incident response experience. | Mountain View, United States | 2004 | 500+ staff | Private | |
AISafe Labs AISafe Labs provides AI-powered penetration testing services for applications. | Timisoara, Romania | 2025 | Private | ||
Appdome Appdome provides a no-code platform for building security and anti-fraud defenses into mobile apps. | Redwood City, United States | Private | |||
Arcjet Arcjet provides runtime security for AI agents, enforcing policies at the action boundary. | San Francisco, United States | 2023 | Private | ||
Black Duck Black Duck provides application security testing tools for software development. | Burlington, Massachusetts, United States | 2002 | Owned by Clearlake Capital and Francisco Partners | ||
Checkmarx Checkmarx provides application security testing software that scans code for vulnerabilities. | Tel Aviv, United States | 2006 | Owned by Hellman & Friedman | ||
Cloudbric Cloudbric provides cloud-based security services including web application firewalls and VPNs. | Seoul, South Korea | 2015 | Private | ||
Darwinium Darwinium provides edge-based intent intelligence to prevent digital fraud and abuse across customer journeys. | San Francisco, United States | Private | |||
Harness Harness provides an AI-native software delivery platform for DevOps, testing, security, and cost optimization. | San Francisco, United States | 2017 | Private | ||
Imperva Imperva is a cybersecurity company that provides application security and data security. | San Mateo, United States | 2002 | Owned by Thales | ||
Intrudify Intrudify sells an AI-driven penetration testing platform for web applications and APIs. | Romania | 2025 | Private | ||
Link11 Link11 provides DDoS protection and web application security services for companies. | Frankfurt am Main, Germany | Private | |||
Mend.io Mend.io provides application security and AI security software for code and AI systems. | Burlington, United States | 2011 | Private | ||
Nowsecure NowSecure provides mobile app security and AI governance. | Chicago, United States | 2009 | Private | ||
O360 B.V. Offensive360 provides application security testing and risk management tools for enterprises. | Amsterdam, Netherlands | Private | |||
Orca Security Orca Security provides an agentless cloud security platform that scans workloads from the cloud control plane rather than by installing agents. | Israel | 2019 | Private | ||
Akto Akto provides a platform to secure AI agents, MCPs, and LLMs for enterprises. | San Francisco, United States | Private | |||
Contrast Security Contrast Security provides runtime application security that detects and blocks attacks from inside running applications. | Pleasanton, United States | Private | |||
Invicti Invicti provides web application and API security testing software for enterprises. | Austin, United States | 2005 | Private |
Recent deals in API security
All API security dealsAcquisitions come from SecurityWeek's monthly M&A round-ups from 2021 onwards, from Cybersecurity Ventures' quarterly M&A reports for 2020, and a few from Wikipedia lists. These are dated to the month. A few deals added from the news are dated to the day. Smaller deals may be missing. Amounts are in US dollars.
More in Application Security
See every category- Application security testing vendors 58 companies
- Software supply chain security vendors 47 companies
- WAF vendors 23 companies