Freedom251 › DDoS Protection Software
Imperva API Security
What Imperva API Security is
Imperva API Security brings API discovery, risk assessment, detection, and mitigation into one console for cloud, on-premises, and hybrid environments. It continuously identifies and monitors public, private, and shadow APIs, tracks changes, and flags design flaws and vulnerabilities. Ongoing assessments focus on risks associated with the OWASP API Security Top 10. For Broken Object Level Authorization (BOLA), machine-learning-driven detection profiles traffic for behavioral changes and can block exploits. API Security Testing scans uploaded API specification files for posture gaps, design and configuration weaknesses, and risky endpoints.
Teams can choose cloud-managed or self-managed management, plus agent-based or agentless deployment for cloud WAF, microservices, encrypted applications, and network-layer monitoring. Integrations include Kong, Mulesoft, Azure APIM, Apigee, and F5. The product also classifies APIs by sensitive information, including government IDs, credit card details, addresses, and other personally identifiable information. With Imperva’s application security platform, it protects against nine OWASP API Top Ten risks; Unsafe Consumption of APIs is the exception. The product is available for API, self-hosted, and web environments. Imperva is headquartered in San Mateo, California, and was founded in 2002.
Who it suits
Imperva API Security suits organizations that need to discover and monitor APIs across cloud, on-premises, or hybrid environments, and assess API risks. Its listed enterprise customers include banks, financial-services firms, telecom providers, and Fortune 100 companies.
What it does well
- Continuously discovers public, private, and shadow APIs.
- Assesses risks tied to the OWASP API Security Top 10.
- Can detect and block BOLA exploits.
- Scans uploaded API specifications for design and configuration weaknesses.
- Integrates with Kong, Mulesoft, Azure APIM, Apigee, and F5.
What to know first
- Pricing is available on request.
- No free plan is offered.
- The 30-day trial may be limited to 100 Mbps.
Limits
There is no free plan. The 30-day free trial may be limited to 100 Mbps bandwidth, and traffic above that threshold may be null-routed.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Free trial | 30 days · Cloud WAF, DDoS, Bot Protection and CDN included · trial bandwidth may be limited to 100 Mbps | Free |
| Imperva API Security | Contact sales · Enterprise API security; Cloud WAF add-on or API Security Anywhere | On request |
As imperva.com lists them, read 15 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the Imperva API Security website.
- Request pricing or schedule a demo for the Imperva API Security plan.
- Choose cloud-managed or self-managed management.
- Select an agent-based or agentless deployment approach.
- Start the free trial, which lasts 30 days and may have a 100 Mbps bandwidth limit.
Verdict
Choose Imperva API Security if you need API discovery, risk assessment, and mitigation across cloud, on-premises, or hybrid environments. Its BOLA detection and API specification scanning add focused security controls. Look elsewhere if you need a free plan or a price published up front.
Questions
How much does Imperva API Security cost?
Pricing is available on request. The listed plan is Imperva API Security, with cloud-managed or self-managed options and a demo to schedule.
Is there a free plan or trial?
There is no free plan. A 30-day free trial is available and may be limited to 100 Mbps bandwidth.
Which deployment options does it support?
It supports cloud-managed or self-managed management and agent-based or agentless setups. Deployment spans cloud, on-premises, and hybrid environments.
What integrations are listed?
Integrations include Kong, Mulesoft, Azure APIM, Apigee, and F5.
What OWASP API Top Ten risks does it cover?
With Imperva’s application security platform, it protects against nine of the OWASP API Top Ten risks. Unsafe Consumption of APIs is the exception.
Facts from Imperva API Security's own pages
- API classification
- It classifies APIs and sensitive data such as government IDs, payment-card data, addresses and other PII. · imperva.com, 15 Oct 2026
- API discovery
- The service continuously discovers public, private, undocumented and shadow APIs and keeps an inventory current. · imperva.com, 15 Oct 2026
- API documentation scope
- The public API documentation covers account and service management, policy updates, monitoring, audit retrieval, alerting integrations, users, API keys and subscription metrics. · docs-cybersec.thalesgroup.com, 15 Oct 2026
- API testing
- API Security Testing scans uploaded API specifications, ranks posture and configuration issues by severity, and supplies developer fixes. · imperva.com, 15 Oct 2026
- API verification
- API verification assesses specifications and generates targeted fuzzing tests based on discovered API behavior. · imperva.com, 15 Oct 2026
- BOLA protection
- Its ML-driven BOLA Detection and Response profiles traffic, detects behavioral deviations, and can block Broken Object Level Authorization exploits. · imperva.com, 1 Oct 2026
- BOLA response
- ML-based behavioral profiling can detect and automatically block Broken Object Level Authorization attacks in real time. · imperva.com, 15 Oct 2026
- Bot integration
- Sensitive or abuse-prone APIs can be sent to Imperva Advanced Bot Protection for automated-threat mitigation. · imperva.com, 15 Oct 2026
- Bot protection
- Imperva API Security integrates with Advanced Bot Protection to identify sensitive APIs, detect bot attacks, and apply tailored mitigation policies. · imperva.com, 1 Oct 2026
- Business-logic protection
- Hybrid behavioral and rule engines score anomalies and identify business-logic abuse, including BOLA. · imperva.com, 15 Oct 2026
- Company ownership
- Thales agreed in July 2023 to acquire 100% of Imperva from Thoma Bravo for a $3.6 billion enterprise value; completion was announced in December 2023. · cpl.thalesgroup.com, 15 Oct 2026
- Company size
- LinkedIn lists Imperva as a privately held Thales company with 10,001-plus employees and Austin, Texas headquarters. · linkedin.com, 15 Oct 2026
- Core licensing
- An independent product comparison describes Imperva API Security as proprietary rather than open source. · comparisec.com, 15 Oct 2026
- Deployment choices
- Customers can use cloud-managed or self-managed local-console deployment, with agent-based or agentless options. · imperva.com, 15 Oct 2026
- Deployment options
- Deployment options include cloud-managed or self-managed management, plus agent-based or agentless setups for cloud WAF, microservices, encrypted applications, and network-layer monitoring. · imperva.com, 1 Oct 2026
- Deployment topologies
- The product supports cloud WAF, microservices, encrypted applications, network monitoring, Kubernetes sensors, sidecar sniffers and standalone network sniffers. · imperva.com, 15 Oct 2026
- Documentation portal
- Imperva maintains a searchable documentation portal and a separate Thales-hosted API reference library. · docs.imperva.com, 15 Oct 2026
- Founded
- Imperva, Inc. was incorporated in April 2002. · sec.gov, 15 Oct 2026
- Free-trial limit
- The 30-day trial may be limited to 100 Mbps bandwidth, with traffic above that threshold potentially null-routed. · imperva.com, 1 Oct 2026
- Headquarters
- Redwood Shores, California, United States · imperva.com, 28 Sept 2026
- Integrations
- Named integrations include Kong, Mulesoft, Azure API Management, Apigee and F5. · imperva.com, 15 Oct 2026
- Intended customers
- Imperva says its solutions serve 6,200-plus enterprise customers in 150 countries, including major banks, financial-services firms, telecom providers, and Fortune 100 companies. · imperva.com, 1 Oct 2026
- Limit: complex architectures
- A Gartner review says the product can focus on edge inventory and lack deep detection and protection for complex API architectures. · gartner.com, 15 Oct 2026
- Limit: customization and reporting
- G2 feedback requests more custom-policy options and notes that security-event reports can be emailed but not downloaded. · g2.com, 15 Oct 2026
Where Imperva API Security stands on Freedom251
- DDoS Protection Software#14 of 37
- API Security Software#12 of 30
- Web Application Firewall Software#19 of 35