- Home
- DDoS Protection Software
- Imperva API Security
Imperva API Security
United States
What it is
Imperva API Security is a hybrid platform for discovering, assessing, monitoring, and protecting APIs across cloud, on-premises, and mixed environments. It continuously finds public, private, and shadow APIs, tracks changes, and identifies design flaws or vulnerabilities. Ongoing assessments address risks associated with the OWASP API Security Top 10. Machine-learning BOLA Detection and Response profiles traffic, detects behavioral changes, and can block Broken Object Level Authorization exploits. API Security Testing reviews uploaded specifications for posture gaps, configuration weaknesses, design flaws, and risky endpoints. Deployment can be cloud-managed or self-managed, with agent-based or agentless options for cloud WAF, microservices, encrypted applications, and network monitoring. Integrations include Kong, Mulesoft, Azure APIM, Apigee, and F5. The product classifies sensitive APIs, supports bot protection, runtime protection, access governance, audit reporting, rate limiting, and managed mitigation. Pricing is on request; a free trial is available, with a possible 100 Mbps limit.
For and against
For
- Discovers public, private, and shadow APIs
- Assesses OWASP API Security Top 10 risks
- Detects and blocks BOLA exploits
- Offers cloud or self-managed deployment
- Classifies sensitive API data
Against
- No free plan
- Pricing requires a request
- Trial may limit traffic to 100 Mbps
- Unsafe Consumption remains outside stated OWASP coverage
The verdict
Imperva API Security combines discovery, testing, risk assessment, and mitigation in one hybrid deployment. Its trial and broad controls may help teams evaluate API protection before requesting pricing.
Who it suits
It suits organizations managing APIs across cloud, on-premises, or hybrid environments, especially enterprise teams handling sensitive data and regulated services.
Plans and prices
Free trial
Cloud WAF, DDoS, Bot Protection and CDN included · trial bandwidth may be limited to 100 Mbps
Read 15 Oct 2026 · imperva.com
Imperva API Security
Enterprise API security; Cloud WAF add-on or API Security Anywhere
Read 15 Oct 2026 · imperva.com
On the record
- API classification
- It classifies APIs and sensitive data such as government IDs, payment-card data, addresses and other PII.imperva.com · read 15 Oct 2026
- API discovery
- The service continuously discovers public, private, undocumented and shadow APIs and keeps an inventory current.imperva.com · read 15 Oct 2026
- API documentation scope
- The public API documentation covers account and service management, policy updates, monitoring, audit retrieval, alerting integrations, users, API keys and subscription metrics.docs-cybersec.thalesgroup.com · read 15 Oct 2026
- API testing
- API Security Testing scans uploaded API specifications, ranks posture and configuration issues by severity, and supplies developer fixes.imperva.com · read 15 Oct 2026
- API verification
- API verification assesses specifications and generates targeted fuzzing tests based on discovered API behavior.imperva.com · read 15 Oct 2026
- BOLA protection
- Its ML-driven BOLA Detection and Response profiles traffic, detects behavioral deviations, and can block Broken Object Level Authorization exploits.imperva.com · read 1 Oct 2026
- BOLA response
- ML-based behavioral profiling can detect and automatically block Broken Object Level Authorization attacks in real time.imperva.com · read 15 Oct 2026
- Bot integration
- Sensitive or abuse-prone APIs can be sent to Imperva Advanced Bot Protection for automated-threat mitigation.imperva.com · read 15 Oct 2026
- Bot protection
- Imperva API Security integrates with Advanced Bot Protection to identify sensitive APIs, detect bot attacks, and apply tailored mitigation policies.imperva.com · read 1 Oct 2026
- Business-logic protection
- Hybrid behavioral and rule engines score anomalies and identify business-logic abuse, including BOLA.imperva.com · read 15 Oct 2026
- Company ownership
- Thales agreed in July 2023 to acquire 100% of Imperva from Thoma Bravo for a $3.6 billion enterprise value; completion was announced in December 2023.cpl.thalesgroup.com · read 15 Oct 2026
- Company size
- LinkedIn lists Imperva as a privately held Thales company with 10,001-plus employees and Austin, Texas headquarters.linkedin.com · read 15 Oct 2026
- Core licensing
- An independent product comparison describes Imperva API Security as proprietary rather than open source.comparisec.com · read 15 Oct 2026
- Deployment choices
- Customers can use cloud-managed or self-managed local-console deployment, with agent-based or agentless options.imperva.com · read 15 Oct 2026
- Deployment options
- Deployment options include cloud-managed or self-managed management, plus agent-based or agentless setups for cloud WAF, microservices, encrypted applications, and network-layer monitoring.imperva.com · read 1 Oct 2026
- Deployment topologies
- The product supports cloud WAF, microservices, encrypted applications, network monitoring, Kubernetes sensors, sidecar sniffers and standalone network sniffers.imperva.com · read 15 Oct 2026
- Documentation portal
- Imperva maintains a searchable documentation portal and a separate Thales-hosted API reference library.docs.imperva.com · read 15 Oct 2026
- Free-trial limit
- The 30-day trial may be limited to 100 Mbps bandwidth, with traffic above that threshold potentially null-routed.imperva.com · read 1 Oct 2026
