Preemptive
Prevents OWASP-Top-10 and zero-day threats against Web App & APIs by using ML-based security without signature updates (e.g. blocked Log4Shell and Spring4Shell with no updates)
Precise
Continuous learning delivers precise detection, finding more attacks while eliminating constant fine tuning and exception creation inherent in traditional WAFs.
Automatic
Cloud native CI/CD-friendly deployment and automation - from installation to upgrades, to configuration - using declarative infra-as-code or APIs.
Open Source WAF
Makes effective Web & API security based on a ML-based engine that is painless to configure and manage available for everyone to use and expand build upon (GitHub).
Principles
Thank you for your incredible support!
🎉 open-appsec surpassed 1000 GitHub Stars! 🌟
Use open-appsec also as Cloud Service using the Enterprise Edition. See here
Features
API Discovery and Security
Know your API usage and narrow your attack surface to keep API activity within safe limits through ML-based malicious content blocking and OpenAPI schema validation.
Anti-Bot
Identify and stop automated attacks before intrusion, theft or harm to customer experiences.
Intrusion Prevention (IPS)
Protect against over 2,800 Web CVEs, based on award winning NSS-Certified IPS and a fully open Snort 3.0.
ML-Based Threat Prevention (WAF)
Prevents OWASP-10 and zero day threats automatically using ML engine and scoring based on transaction, user behavior, crowd behavior & content risk. No signatures.
File Security
Prevent malicious files from being uploaded to web apps and APIs. The engine scans uploaded files and consults a huge cloud repository as to the file's reputation.
Rate Limiting
Set a cap on how many requests can be made within a certain period to web apps and APIs, based on identifiers such as IP address or keys within JWT, cookies or headers.
Crowd Wisdom
Block requests from malicious IPs based on crowd wisdom gathered in real-time from 64,000+ contributing servers via partnership with CrowdSec.
Immunity against a critical vulnerability in a highly popular library used in many production environments. Exploitation allows remote code execution, DDoS and other attacks.
Immunity against a critical vulnerability in a library used in 2500 software projects. Exploitation allows remote code execution.
Immunity against a critical vulnerability in the widely used Java Spring Framework. Exploitation allows remote code execution.
Immunity against a critical vulnerability that allows bypassing all WAFs by appending JSON syntax to SQL injection payloads.
Zero-Day Security
The only WAF that blocked these attacks preemptively without signatures
AppSec is an 'install and forget' solution. We don't need to mobilize valuable team members to monitor the solution. It provides state-of-the-art protection and allows us to focus on new business and customer satisfaction.
David Cancalon | CTO, Proxeem
Management
Machine Learning Tracking
Monitor learning progress and get notifications when the system is ready.
Infra-as-Code and API
Deploy and manage using Helm Charts, Kubernetes Annotations, Terraform or extensive GraphQL API.
SaaS Security Management
Enterprise grade management and situational visibility using WebUI and management available as SaaS.
Awards & Audits
Trusted by innovators
These and many others are using AppSec technology to protect their applications & APIs.
Integrations
Available for
Emissary
Ingress
Istio