API Management and Security

APIs have shifted from a purely technical convenience to a foundation of modern digital business, enabling faster application delivery, microservices architectures, and seamless data exchange across vendors, clouds, corporate networks, mobile devices, industrial environments, and the Internet of Things. They support partner and customer connectivity, orchestrate large-scale infrastructures, and unlock new business models through productization, monetization, and multi-channel service delivery. This expansion—accelerated by lightweight REST adoption alongside cloud and mobile growth—has also made APIs central to handling “crown jewel” digital information and to operating nearly every software product and cloud service through management, integration, and monitoring interfaces.

Security, however, is frequently treated as friction, with misconceptions such as assuming web application firewalls sufficiently cover API risks. The market has evolved from early-stage API management platforms with rudimentary threat protection to a rapidly changing landscape: core API management functions are becoming commoditized (including basic gateways from cloud providers), while specialized API security startups have emerged to address narrow slices of a broad, complex discipline. Consolidation via acquisitions is underway, but a true “one stop shop” remains premature. Effective coverage requires lifecycle-wide capabilities: proactive developer-oriented security (e.g., contract conformance and vulnerability management), continuous monitoring and analytics for operations, and risk-based automation for security teams.

A hybrid deployment model is positioned as the most future-proof approach, combining gateways, service meshes, in-line or out-of-band monitoring, and often cloud-hosted consoles for unified visibility. The report’s vendor analysis highlights leaders across overall, product, innovation, and market dimensions, emphasizing that selection should rely on detailed requirements mapping and proof-of-concept validation, not rankings alone.

• APIs are used across homes, mobile devices, corporate networks, cloud environments, industrial environments, and the Internet of Things.
• Rapid demand for exposing and consuming APIs has tipped the industry toward lightweight RESTful APIs.
• Adoption of REST APIs coincided with exponential growth in cloud computing and mobile device proliferation.
• Core API management capabilities are becoming commoditized, and every cloud service provider offers at least basic API gateway functionality.
• Dedicated API security startups have emerged, typically focusing on a single area of the API security discipline.
• Few vendors are currently capable of delivering comprehensive API security coverage across all required functional areas.
• A hybrid deployment model is described as the only flexible and future-proof option for comprehensive API management and security architecture.
• Apigee was founded in 2004, entered the API management market in 2010, and was acquired by Google in 2016.
• 3scale was acquired by Red Hat in June 2016, and Red Hat became a subsidiary of IBM in July 2019.
• 42Crunch was founded in 2016 and has offices in Dublin, Montpellier, and Irvine, California.

• “In a world where digital information is one of the ‘crown jewels’ of many modern businesses, APIs are now powering the logistics of delivering digital products to partners and customers.”
• “As it often happens in such scenarios, security quickly becomes an afterthought at best or, even worse, it is seen as a nuisance and an obstacle on the road to success.”
• “The success of an API is measured by its adoption and security mechanisms are seen as friction that limits this adoption.”
• “Only by combining proactive application security measures for developers with continuous activity monitoring and deep API-specific threat analysis for operations teams and smart, risk-based and actionable automation for security analysts one can ensure consistent management, governance and security of corporate APIs.”
• “Creating a well-planned strategy and reliable infrastructure to expose their business functionality to be consumed by partners, customers, and developers is a significant challenge that has to be addressed not just at the gateway level, but along the whole information chain from backend systems to endpoint applications.”
• “Expecting to find a ‘one stop shop’ for API security is still a bit premature.”
• “In short, for a comprehensive API management and security architecture a hybrid deployment model is the only flexible and future-proof option.”
• “Vendors above the line are sort of ‘overperforming’ in the market.”
• “Here, we see a rather low correlation between the product and innovation ratings.”
• “Using Curity Identity Server, the company’s flagship product, organizations can secure their digital services in configuration and not in code, thus reducing the complexity of development and maintenance.”