API Security

Now pick what to compare Kong Gateway against.

Kong Gateway clear

Open a name for its full profile

Akamai API Security
Capabilities only
Akamai Technologies · Commercial · 4 capabilities in this domain
Compare →
Cequence Unified API Protection
Capabilities only
Cequence Security · Commercial · 4 capabilities in this domain
Compare →
Cloudflare API Shield
Capabilities only
Cloudflare · Commercial · 4 capabilities in this domain
Compare →
Salt Security API Protection Platform
Capabilities only
Salt Security · Commercial · 4 capabilities in this domain
Compare →
Traceable API Security
Capabilities only
Harness · Commercial · 4 capabilities in this domain
Compare →
42Crunch API Security Platform
Capabilities only
42Crunch · Freemium · 3 capabilities in this domain
Compare →
Escape
Capabilities only
Escape Technologies · Commercial · 3 capabilities in this domain
Compare →
Wallarm
Capabilities only
Wallarm · Commercial · 3 capabilities in this domain
Compare →
Microsoft Defender for APIs
Capabilities only
Microsoft · Commercial · 2 capabilities in this domain
Compare →
Postman API Governance
Capabilities only
Postman · Commercial · 2 capabilities in this domain
Compare →
Kong Gateway
Capabilities only
Kong · Freemium · 1 capabilities in this domain
selected
Spectral
Capabilities only
SmartBear · Open Source · 1 capabilities in this domain
Compare →

In API Security

42Crunch API Security Platform

42Crunch · API Security

Close ×

FreemiumCompany

42Crunch scores OpenAPI contracts in the IDE and CI, runs conformance scans against running APIs and enforces the contract at runtime.

What it does3 capabilities · 2 at full coverage

2 of 3 at full coverage.

API Runtime Threat ProtectionPartialAPI · level 3 · 10 providers
API Security TestingFullAPI · level 2 · 12 providers
API Specification Security AnalysisFullAPI · level 2 · 5 providers

What it proves15 controls across 6 frameworks

Satisfied through its capabilities, not claimed by the vendor.

API Top 108 / 10API1:2023 API2:2023 API3:2023 API4:2023 API5:2023 API6:2023 API7:2023 API8:2023
ASVS 5.02 / 17V4 V7
SSDF 1.12 / 42PW.1.3 PW.8.2
CNAS Top 101 / 10CNAS-2
CSF 2.01 / 106DE.CM-09
DSOMM1 / 19TV-Dynamic-Depth-Applications

What it stops2 techniques · 1 risk

2 techniques countered, 2 of them common

Broken Object Level Authorization ExploitationVery Common
Exploit Public-Facing ApplicationT1190Very Common

1 risks reduced

API exposes data through broken authorizationCritical

Where it runs4 phases · 3 ways to deploy

Capabilities per lifecycle phase

Plan1
Code1
Test1
Operate1

How it is delivered

CI/CD integrationIDE pluginSaaS

What it unlocks4 activities · reaches level 4

Program activities its capabilities support, reaching level 4. Supporting an activity is not completing it.

Level 2

Govern API specifications and rate limitsLow effort
Run DAST against ephemeral environmentsMedium effort

Level 3

Test object and function level authorizationMedium effort

Level 4

Runtime API protection and shadow API detectionMedium effort

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsOpen core or freemium · free tier

LicensingOpen core or freemium

Priced perfree tier plus paid tiers

BillingSubscription

Scales withFeature tier, users or usage beyond the free tier

Total cost

Start free; enterprise needs such as SSO, audit logs and policy often require the paid tier.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with1 standard

Standards and formats

OpenAPI Specification

What else to look at

No alternative, competitor or family sibling is modeled for it.

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13