Upwind has announced that it has added API security to its Cloud Security Platform. This update makes Upwind the only Cloud Security Platform in the market with the ability to detect API threats and respond to them in real-time, directly at the runtime level, thanks to its advanced eBPF-based sensor.
In today’s world, it has become common for companies to build their systems using APIs (Application Programming Interfaces). APIs are used for services to communicate with each other, both internally and externally. Recent studies have shown that the number of APIs used by companies increased by over 200% between July 2022 and July 2023. The rapid adoption of AI may lead to an even higher rate, with Gartner predicting that more than 80% of enterprises will have used generative AI APIs or deployed generative AI-enabled applications by 2026.
However, as the usage of APIs increases, so does the number of security incidents. According to Checkpoint, in the first month of 2024, attempts to attack Web APIs impacted one out of every five organizations worldwide every week. This marks a 20% increase compared to January 2023, highlighting the growing risk associated with API vulnerabilities. As organizations increasingly rely on APIs to power their digital operations, the need for robust and adaptive API security has become paramount.
Upwind’s expansion from runtime workload protection to API security within the same platform allows it to use the rich data and context from workload behavior and its infrastructure to secure against API-based threats and attacks effectively. Upwind’s new API Security solution dynamically catalogs and maps any organization’s APIs in real-time by analyzing actual traffic. This is done using eBPF to ensure minimal performance overhead and provide unparalleled visibility. By using eBPF, Upwind avoids relying on expensive, traditional techniques such as traffic mirroring or relying solely on static API definitions, which are often incomplete or out-of-date.
Upwind’s API Security capabilities give organizations visibility of their full API catalog. This enables them to detect attacks, test APIs to identify new vulnerabilities with workload context, continuously discover if an API is receiving requests from the Internet, including malicious access attempts from external attackers, and assess the level of exposure of each endpoint to the Internet. By leveraging the runtime context provided by their eBPF sensor, Upwind minimizes alerts by 95%, pointing security teams at the information they need to understand and fix API risks that could be exploited while deprioritizing those that don’t pose a threat to the organization.
These new API security capabilities will also enable customers to analyze real-time API threats and attacks and focus on the most critical API vulnerabilities and threats outlined by OWASP (The Open Worldwide Application Security Project) and other application security organizations for comprehensive protection. By continuously automating scans for ongoing vulnerability assessments, Upwind reduces manual effort and ensures real-time protection, with no need for external mirrors or complex provisioning.
Amiram Shachar, Upwind Co-Founder and CEO: “Upwind API security uses runtime insights to give full visibility into the threats that actually put our customers at risk. With Gartner predicting APIs to be the #1 vector of attack in the next few years, it’s imperative security teams know which threats are most critical, so they know where to best invest their time and effort.”
