Security is one of the API Evangelist areas on the APIs.io network — a focused corner of the API landscape. The full area lives at security.apievangelist.com.
30 providers on the network work in this area, including detectify, Upwind, Pynt, CyCognito, Chaitin Tech, Imperva, and 24 more — each links out to that provider’s APIs, schemas, and governance artifacts.
Related areas: API Evangelist Search, Authentication, Containers, and DNS. Browse every area at areas.apis.io.
About this area
An index and topic collection covering API security, identity, access management, secrets management, encryption, and threat protection. API security spans the full lifecycle of…
Related providers (1149)
Top 30 of 1149 network providers tagged for this area — search the full set on apis.io.
| Provider | Description | APIs | Rating |
|---|---|---|---|
| detectify | Detectify is an External Attack Surface Management (EASM) and Dynamic Application Security Testing (DAST) platform that continuously discovers an organization's internet-facing ... | 1 | strong |
| Upwind | Upwind is a cloud and AI security platform (CNAPP) that secures cloud infrastructure, workloads, and applications in real time — spanning cloud security posture management (CSPM... | 2 | strong |
| Pynt | Pynt is an API security testing platform that discovers and secures APIs, LLM endpoints and MCP servers. It wraps a team's existing functional tests — or proxies live traffic — ... | 2 | developing |
| CyCognito | CyCognito is a cybersecurity company providing an external attack surface management (EASM) and exposure management platform. Its cloud-native platform continuously discovers, m... | 1 | developing |
| Chaitin Tech | Chaitin Tech (长亭科技) is a Chinese cybersecurity company best known for SafeLine (雷池), a self-hosted, semantic-analysis Web Application Firewall and reverse proxy with 22k+ GitHub... | 6 | thin |
| Imperva | Imperva (a Thales company) is a cybersecurity company providing cloud-based and on-premises application security, data security, and network security solutions. Their developer ... | 2 | thin |
| Traceable | Traceable is an API security and observability platform that provides API discovery, threat detection, and protection across the full application lifecycle. It uses context-awar... | 1 | thin |
| CYBRET | CYBRET provides continuous black, grey, and white‑box penetration testing services, delivering authorized target coverage, exploit evidence, and remediation guidance. Their plat... | 2 | thin |
| Akto | Akto is a proactive API security platform that discovers, tests, and protects APIs and AI systems across an organization's infrastructure. Its open-source core (MIT, Java) deliv... | 0 | thin |
| 42Crunch | 42Crunch is a leading API security company that specializes in protecting and securing APIs. They provide innovative solutions that help organizations safeguard their sensitive ... | 6 | thin |
| Impart Security | Impart Security is a runtime security platform that unifies WAF, API security, and AI/LLM/agent/MCP protection on one inline enforcement engine. It analyzes the full request/res... | 1 | emerging |
| PortSwigger | PortSwigger is the UK-based security research company behind Burp Suite, the industry-standard web and API security testing platform used by penetration testers and enterprise A... | 5 | emerging |
| Vorlon | Vorlon is an agentic ecosystem security platform that helps enterprises deploy AI agents and SaaS applications safely by protecting sensitive data in real time. The platform map... | 0 | emerging |
| Invicti | Invicti is an enterprise web application security solution providing automated vulnerability scanning, DAST, and API security testing. The Invicti platform includes API Discover... | 1 | emerging |
| Operant | Operant AI is a San Francisco-based runtime security company (founded 2021, backed by Felicis) that protects cloud and AI applications with real-time, Kubernetes-native "3D Runt... | 0 | emerging |
| Crosslayer Labs | Crosslayer Labs is a network and web-infrastructure security company spun out of a Princeton University security research lab. Its founding team invented Multi-Perspective Issua... | 0 | emerging |
| Salt Security | Salt Security provides an AI-powered API security platform that discovers all APIs, stops API attacks in real-time, and provides remediation insights. The platform delivers full... | 2 | emerging |
| Signal Sciences | Signal Sciences is a web application and API protection (WAAP) company whose Next-Gen Web Application Firewall (WAF) and Runtime Application Self-Protection (RASP) defend web ap... | 1 | emerging |
| Raspire | Raspire (RASPIRE) provides runtime security for mobile applications, positioning itself as the first line of defense for Android and iOS apps against AI-powered fraud attacks, A... | 0 | minimal |
| Hex Security | Hex Security is a Y Combinator (W26) security startup building autonomous AI agents that perform continuous penetration testing against web applications, APIs, and infrastructur... | 0 | minimal |
| Tinfoil Security | Tinfoil Security was a web application and API security scanning company that provided automated dynamic (DAST) vulnerability testing for web apps and REST APIs. It was acquired... | 0 | minimal |
| Tcell Io | Tcell Io (tCell.io) was surfaced as a portfolio company of Menlo Ventures and added to the API Evangelist network as a lead for enrichment. As of this enrichment pass the compan... | 0 | |
| Cloudflare | Cloudflare is a global network designed to make everything you connect to the Internet secure, private, fast, and reliable. | 25 | exemplar |
| Snyk | Snyk is a developer-first security platform covering code, open-source dependencies, container images, and infrastructure-as-code. The Snyk REST API and V1 API expose groups, or... | 3 | exemplar |
| Elastic Stack | The Elastic Stack (formerly known as the ELK Stack) is the collection of open-source products from Elastic — Elasticsearch, Logstash, Kibana, and Beats/Elastic Agent — designed ... | 11 | exemplar |
| OneTrust | OneTrust is an enterprise trust, privacy, and AI-governance platform. Its developer portal publishes 37 downloadable OpenAPI definitions covering roughly 631 operations across U... | 37 | exemplar |
| Aembit | Aembit is a Workload Identity and Access Management (Workload IAM) platform for non-human identities — AI agents, applications, microservices, CI/CD pipelines, scripts and servi... | 2 | exemplar |
| Paubox | Paubox is a HIPAA compliant, HITRUST certified email infrastructure company serving healthcare organizations in the United States. Its products encrypt outbound email without re... | 3 | exemplar |
| Amazon VPN | AWS VPN solutions establish secure connections between on-premises networks, remote offices, client devices, and the AWS global network. AWS offers two types of private connecti... | 1 | exemplar |
| JFrog | JFrog provides universal DevOps solutions for software supply chain automation and security, offering a unified platform for managing binaries, securing the software supply chai... | 14 | exemplar |
Terms in this area (5)
- OCRA — OCRA (OATH Challenge-Response Algorithm) is a standard for generating one-time passwords based on challenge-response authentication as defined in RFC 6287. It…
- RBAC — Role-Based Access Control (RBAC) is a security paradigm that restricts system access based on assigned roles rather than individual user identities. Users are…
- Secure-By-Design — A software development approach that prioritizes security from the initial design phase through implementation, ensuring security considerations are built into…
- Security by Design — A software development approach that integrates security considerations and practices from the initial design phase through the entire development lifecycle, r…
- Security Standards — Security Standards is a cybersecurity technology or practice designed to protect systems, networks, and data from unauthorized access, attacks, and vulnerabili…
Related areas
API Evangelist Search (1 shared)
Authentication (1 shared)
Containers (1 shared)
DNS (1 shared)
Encryption (1 shared)
Gateway (1 shared)
Markets provisional
Kin Score markets whose measured providers carry this area. Share is the fraction of the market's measured providers that carry it — it describes the market, not this area.
| Market | Share of the market's providers |
|---|---|
| Security (EDR, SIEM, SOAR) | 60% |
| Identity and Auth | 36% |
| Observability | 12% |
| Search API (Elasticsearch / OpenSearch shape) | 12% |
| Typed Decision Models | 10% |
Cohort brief
Auto-generatedThe 28 providers in the APIs.io catalog working in Security, scored on the Kin Score. Every figure below is computed from the catalog — nothing here is written.
Providers
28
of 30 in the catalog
Mean Kin Score
41.9
+19.1 vs catalog 22.8
Mean Agent Readiness
24.8
+11.5 vs catalog 13.3
Spread
4.7–82.8
median 33.7 · σ 26.5
How the 28 split by band
Exemplar 8Strong 2Developing 2Thin 6Emerging 8Minimal 2
Facet averages, against the whole catalog
| Facet | This cohort | Catalog | Difference | Scored |
|---|---|---|---|---|
| Access Clarity | 46.3 | 25 | +21.3 | 28 |
| Operational Transparency | 33.6 | 12.4 | +21.2 | 28 |
| Developer Ergonomics | 42.2 | 22.1 | +20.1 | 28 |
| Contract Quality | 33.6 | 18.2 | +15.4 | 28 |
| Contract Governance | 19.2 | 9.4 | +9.8 | 28 |
| Discoverability | 65.9 | 57.9 | +8 | 28 |
A facet is averaged over the members that carry it, not over the whole cohort — the “Scored” column is that count. Averaging an absent facet as zero would score our own coverage gaps as the providers’ posture.
What this cohort publishes
| Artifact | This cohort | Catalog | Difference |
|---|---|---|---|
| MCP server (any) | 45% | 16% | +29 |
| MCP server (first-party) | 34% | 14% | +20 |
| Agent Skills | 0% | 0% | 0 |
| OAuth scopes | 10% | 13% | -3 |
| Security | 97% | 98% | -1 |
| Arazzo workflows | 7% | 2% | +5 |
| Governance rules | 59% | 35% | +24 |
mcp_pct counts any mcp/ artifact including ones API Evangelist derived from the provider OpenAPI; mcp_first_party_pct counts only servers the provider publishes. Prefer the latter.
Top by Kin Score
- 1 Cloudflare 82.8
- 2 Snyk 80.5
- 3 Elastic Stack 80.2
- 4 OneTrust 77.1
- 5 Aembit 75.9
- 6 Paubox 75.8
- 7 Amazon VPN 74.9
- 8 JFrog 74.4
- 9 detectify 58.3
- 10 Upwind 54.6
Top by Agent Readiness
- 1 Cloudflare 69.6
- 2 Paubox 60.9
- 3 OneTrust 58.3
- 4 Aembit 52.7
- 5 Snyk 45.7
- 6 Elastic Stack 43.9
- 7 Upwind 40.3
- 8 CyCognito 38.6
- 9 Amazon VPN 34.5
- 10 JFrog 33.4
All 30 members of this roster resolve to a provider in the
catalog; 28 carry a score (93%).
The figures above describe the scored members only.
Coverage caveat. 18 of 28 scored members had under half their catalog-attributable points satisfied at all (catalog_earned / catalog_max < 0.5). They are INCLUDED in the mean above. A large share here means the cohort mean is partly a measurement of how far our enrichment reached, not only of how these providers publish.Generated from the catalog build of 7 November 2026, across 38912 providers, using the same computation served by the APIs.io cohort API. Briefs are published for rosters of 5 or more scored providers; below that a distribution is not meaningful.
Coverage caveat. 18 of 28 scored members had under half their catalog-attributable points satisfied at all (catalog_earned / catalog_max < 0.5). They are INCLUDED in the mean above. A large share here means the cohort mean is partly a measurement of how far our enrichment reached, not only of how these providers publish.Generated from the catalog build of 7 November 2026, across 38912 providers, using the same computation served by the APIs.io cohort API. Briefs are published for rosters of 5 or more scored providers; below that a distribution is not meaningful.
Work with this as data
Every area here is available over the APIs.io API and to AI agents over MCP.