Salt Security

Salt Security is an API security tools platform that uses behavioral ML to discover APIs, detect logic-based attacks, and enforce posture governance across cloud environments. The platform — called Salt Illuminate — works by analyzing live API traffic without adding latency to the request path.

Founded in 2016 and headquartered in Palo Alto, Salt was one of the first companies focused exclusively on API security. Co-founded by CEO Roey Eliyahu and COO Michael Nicosia. Enterprise customers include Alaska Airlines, Hyundai, Stryker, SoFi, Kingston Technology, and Standard Bank Group.

What is Salt Security?

Salt Security addresses a gap most security teams know about but struggle to close: you can’t protect APIs you don’t know exist. The platform combines API discovery, posture governance, and runtime threat detection under one product.

Salt deploys agentlessly. Connect your cloud accounts, API gateways, or traffic mirrors, and the platform starts mapping your API landscape within minutes. No inline agents, no added request latency, no architecture changes required.

Key Features

API discovery

Salt discovers APIs through multiple data sources simultaneously:

• Salt Connect — Pulls API metadata from AWS, Azure, GCP, and gateways like Kong, Apigee, and MuleSoft. Agentless, cloud-native discovery.
• Salt Surface — Scans your external attack surface from an adversary’s perspective, finding public-facing APIs that internal tools miss.
• Traffic analysis — Monitors live API traffic to identify undocumented endpoints, including shadow APIs and deprecated-but-still-active zombie APIs.
• GitHub Connect — Scans public and private GitHub repositories to identify shadow APIs and MCP servers in source code before they reach production. Launched November 2025.

The platform automatically tags each discovered API with metadata: risk score, authentication type, data classification (PII, PHI), environment, and service owner. You can filter and group by any of these in the dashboard.

Posture governance

The Policy Hub ships with nearly 100 pre-loaded posture rules. Categories include PCI DSS, HIPAA, GDPR, SOC 2, NIST, CMMC, FedRAMP, OAuth, access control, data security, and API architecture standards.

Each rule triggers a posture gap when violated. The dashboard groups gaps by severity (Critical, High, Medium) so you know where to focus first. You can also create custom posture rules in three clicks and export reports for auditors.

Behavioral threat detection

Salt Protect baselines normal API behavior over days and weeks, then flags deviations that match attacker patterns. This catches logic-based attacks that WAFs and signature tools miss — things like slow credential stuffing, BOLA exploitation, and gradual data scraping.

Attack types Salt detects:

• BOLA/IDOR — Broken Object Level Authorization, the #1 API vulnerability per OWASP
• Credential stuffing — Automated login attempts across API endpoints
• Data exfiltration — Systematic extraction of data through API responses
• Account takeover — Session and token manipulation attacks
• API abuse — Rate limiting bypasses and resource exhaustion
• Injection — SQL, NoSQL, and command injection through API parameters

AI agent and MCP security

Salt added agentic AI security capabilities in 2025, announced at CrowdStrike Fal.Con. Their own research shows only 37% of organizations using agentic AI currently deploy dedicated API security, while 48% operate 6-20 different agent types.

Three components cover the MCP lifecycle:

• MCP Protect — Discovers and monitors all MCP server interactions with AI agents in runtime, maps hidden connections, and assesses data exposure risk
• Agentic AI Governance — Out-of-the-box security controls enforcing safe AI agent behavior in MCP and A2A environments, enabled by default at first login
• GitHub Connect — Identifies risky MCP servers in source code repositories before they deploy to production

As Michael Nicosia, co-founder and COO, put it: “Most organizations’ first AI security gap isn’t model jailbreaks — it’s the invisible API connections powering agents.”

Sensitive data tracking

Salt identifies PII, PHI, payment card data, and custom data patterns flowing through API traffic in real time. The posture engine flags exposed sensitive data in query parameters, unauthenticated responses, and unencrypted channels.

Integrations

Salt connects to API gateways, cloud platforms, SIEM/SOAR tools, and developer platforms:

API Gateways & Service Mesh

Kong

Apigee

MuleSoft

NGINX

Istio

Cloud & Infrastructure

AWS

Azure

GCP

Kubernetes

Akamai

Cloudflare

F5

SIEM, SOAR & Observability

Splunk

CrowdStrike

Microsoft Sentinel

Jira

Slack

Developer & CI/CD

GitHub

Docker

Kafka

Getting started

Salt also offers a free external attack surface scan through their website, giving you an adversary-perspective view of public-facing APIs before committing to the platform.

When to use Salt Security

Salt fits organizations that need to find and protect APIs they don’t fully know about — especially in environments with fast-moving development teams, multiple cloud accounts, or third-party integrations.

It’s a good fit if:

• You suspect your actual API count is larger than what your gateway or documentation shows
• You need compliance mapping across PCI DSS, HIPAA, GDPR, or SOC 2 for API traffic
• You’re adopting agentic AI and need visibility into MCP server interactions
• You want threat detection that catches logic-based attacks (BOLA, credential stuffing) rather than just signature matches
• You need an agentless deployment that doesn’t add latency or require architecture changes

Consider other options if:

• You primarily need pre-production API testing rather than runtime protection — tools like 42Crunch focus on API security testing in CI/CD
• You’re looking for a free or open-source solution
• Your API estate is small and fully documented, making discovery less critical

Frequently Asked Questions