Imperva API Security

Imperva API Security is a commercial API security platform that uses machine learning to automatically discover, classify, and protect APIs across cloud and on-premises environments. It combines API discovery, schema enforcement, runtime BOLA detection, and bot protection in a single platform.

Thales Group acquired Imperva in December 2023 for $3.6 billion. The combined operation now has 5,800+ security experts across 68 countries. The Imperva brand and product line continue under Thales’s cybersecurity division, with active API security development.

Imperva is recognized as a KuppingerCole Market Leader in API Security and has been named in the Gartner Magic Quadrant for Web Application and API Protection (WAAP) 9 consecutive times. Unlike tools that only monitor API traffic at the gateway level, Imperva analyzes traffic patterns using ML to find shadow and zombie APIs that organizations did not know existed.

Key Features at a Glance

Overview

Imperva API Security bundles discovery, risk assessment, and runtime defense in a single platform. Compared to point solutions that require stitching together separate discovery, testing, and protection tools, Imperva covers the full API security lifecycle in one product.

The platform handles four stages: discovering all APIs (including shadow and zombie endpoints), classifying the data flowing through them, assessing schemas for security gaps, and blocking threats in real time.

Key Features

API Discovery and Classification

The ML-powered discovery engine finds APIs that traditional inventories miss:

• Shadow APIs — Endpoints deployed without security team awareness
• Zombie APIs — Deprecated APIs still accessible and potentially vulnerable
• Internal APIs — Service-to-service communication within microservices
• Third-party APIs — External integrations and partner endpoints

Each discovered API is automatically classified by risk level. The platform identifies sensitive data types (PII, payment data, credentials) flowing through each endpoint without retaining the raw data itself.

Schema Assessment and Enforcement

Imperva goes beyond simple schema validation:

• Security gap analysis — Checks API definitions (OpenAPI/Swagger) for missing authentication parameters, weak validation rules, and other security anti-patterns
• Runtime enforcement — Applies schema protection at runtime to block malformed requests
• Selective enforcement — Lets teams apply schema protection only to well-defined, stable APIs to reduce false positives during development cycles

API Detection and Response

The ADR capability targets business logic attacks that signature-based tools miss:

• Behavioral baselining — Learns normal API usage patterns per endpoint
• BOLA detection — Identifies when users attempt to access objects belonging to other users
• Anomaly correlation — ML-based incident correlation groups noisy events into prioritized incidents
• Automated policy suggestions — Recommends protection policies based on observed traffic patterns

Bot Protection Integration

Imperva API Security works alongside Imperva’s bot protection to defend against automated threats:

• Credential stuffing and account takeover attempts
• API scraping and data harvesting
• Business logic abuse from automated scripts
• Rate limit evasion through distributed attack patterns

Use Cases

Microservices environments — Discover and protect the full mesh of service-to-service APIs that perimeter tools cannot see.

Regulated industries — Automatic PII and payment data classification helps meet compliance requirements for GDPR, PCI DSS, and CCPA.

API-first businesses — Organizations exposing APIs to partners and customers need continuous discovery and schema enforcement as APIs evolve.

Bot-targeted APIs — APIs facing automated abuse benefit from the integrated bot protection and behavioral analysis.

Strengths & Limitations

Strengths:

• ML-based discovery catches shadow and zombie APIs that manual inventories miss
• Single platform removes the need to stitch together separate discovery, testing, and protection tools
• Native bot protection integration provides defense against automated API abuse
• Flexible deployment (cloud-managed, self-managed, agent-based, agentless) fits diverse architectures
• Part of a large cybersecurity platform with shared threat intelligence across WAF, RASP, and DDoS products

Limitations:

• Enterprise-focused product with enterprise pricing — less suited for small teams or startups
• Full platform benefits require broader Imperva/Thales product adoption
• Self-managed deployments require infrastructure investment and operational expertise
• ML-based detection needs a baseline traffic period before it can effectively identify anomalies

Getting Started

How Imperva API Security Compares

Imperva API Security competes in the enterprise API security market alongside Salt Security, Noname Security (acquired by Akamai), and Traceable AI (merged with Harness).

Compared to Salt Security and Noname, Imperva’s main differentiator is the single-platform approach that combines API discovery, schema enforcement, runtime protection, and bot management under one vendor. Unlike standalone API security tools, organizations already using Imperva WAF or Imperva RASP get shared threat intelligence across all products without additional integration work.

For teams looking for open-source API security testing, Akto offers API discovery and testing with a community edition. For API-first security testing in CI/CD pipelines, consider APIsec or 42Crunch API protection.

For a broader overview of API security tools and how they compare, see the API security tools category page.

Frequently Asked Questions