The Security area on apis.io ranks 30 providers. It splits cleanly into two groups. The first is 21 API-security specialists: the companies that test, discover, protect and govern other people’s APIs. Twenty of them are scored, and they average 24.4 on the Kin Score. The second is 9 general platforms that do security as part of a broader business, and they average 75.4. All nine of those are exemplar. None of the specialists is.
The two halves
| Provider | Kin Score | Band | Agent Readiness |
|---|---|---|---|
| Cloudflare | 80.6 | exemplar | 72.5 |
| Paubox | 77.0 | exemplar | 63.3 |
| Aembit | 72.6 | exemplar | 54.6 |
| Upwind | 52.1 | developing | 41.5 |
| Pynt | 51.8 | developing | 25.7 |
| 42Crunch | 26.0 | emerging | 26.2 |
| Salt Security | 11.2 | emerging | 0.6 |
The specialists’ best is Upwind at 52.1, followed by Pynt (51.8), CyCognito (46.6) and Detectify (41.6). Below that the scores fall fast. Traceable is at 31.9, Imperva 31.5, Akto 28.2, 42Crunch 26.0. PortSwigger is at 20.1 with five APIs, Invicti 15.3, Salt Security 11.2, Signal Sciences 11.0. Seven specialists publish zero APIs on the catalog: Akto, Vorlon, Operant, CrossLayer Labs, Raspire, Hex Security and Tinfoil Security. tcell.io has no score at all.
Agent Readiness shows the same split, and it is sharper. Eight of the specialists, PortSwigger, Invicti and Salt Security among them, are at 0.6 or lower.
Why this is the tension worth naming
These are the companies that tell the market an API without an inventory, a contract and an auth model is a risk. 42Crunch’s whole category is OpenAPI contract auditing. Salt, Traceable, Akto and Imperva sell API discovery on the premise that undocumented APIs are where the breaches are. On their own public surfaces, most of them have not done for their APIs what they sell.
To be fair about it: many of these products are consoles bought by security teams, and their management APIs often sit behind a customer tenant. The Kin Score measures only the public surface, so a gated API reads as a thin one. Some of these companies, like Imperva and Signal Sciences, have also been absorbed into larger estates. Even so, Pynt and Upwind show that a specialist can reach the developing band with two to four public contracts. The gap is not a structural one.
The nine exemplars have something in common too. Elastic and the ELK stack (77.6 and 77.0), Snyk (79.1), OneTrust (71.7), Clerk (70.3), Amazon VPN (73.1) and the three in the table all publish contracts as a product, not as a sales asset.
A defect on our side
The area’s frontmatter says provider_count: 915 and lists 915 slugs, but only 30 providers are ranked rows, and the overview text says 30. Either the membership is 915 and the rankings are truncated, or the slug list is overbroad. One of those two numbers is wrong, and the page should not show both.
Takeaway
What would move this area is the specialists publishing what they would ask a customer to publish: an OpenAPI for the management API, documented auth scopes and an error model. A security vendor at 11.2 is a pitch that is hard to make. One at 60 is a reference architecture.
See the area at apis.io/areas/security/.