APISec.ai excels with its effortless integration into CI/CD pipelines, AI-powered accuracy (minimal false positives), and developer-friendly remediation guides, making it ideal for teams that need fast, automated API security testing without slowing down development. Its ability to detect business logic flaws (like BOLA/BFLA) and support for REST, GraphQL, and gRPC sets it apart, while features like one-click scans and Slack/Jira integrations streamline workflows, though advanced capabilities may require an enterprise plan. Review collected by and hosted on G2.com.

Advanced features (e.g., custom threat modeling) require enterprise plans Review collected by and hosted on G2.com.

Automated API Security Testing:

ApiSec.ai runs security tests automatically every time an API is updated, much like unit tests.

This continuous testing approach ensures real-time detection of vulnerabilities without human intervention.

OWASP Top 10 API Security Coverage:

It tests for OWASP API Security Top 10 threats (e.g., Broken Object Level Authorization, Broken User Authentication, etc.).

This provides strong coverage against common API-specific vulnerabilities.

CI/CD Pipeline Integration:

Easily integrates with tools like Jenkins, GitHub Actions, GitLab CI, CircleCI, and others.

Helps shift security left by embedding it directly in the development cycle.

No-Code or Low-Code Test Creation:

You don’t need to write complex security test scripts.

Leverages your existing OpenAPI (Swagger) or Postman collections to generate security tests.

Realistic Attack Simulations:

Uses actual attack methods to verify vulnerabilities instead of just static analysis.

Helps prioritize real exploitable flaws, reducing noise and false positives. Review collected by and hosted on G2.com.

1. Dependency on OpenAPI Specs or Collections: ApiSec.ai works best when you have up-to-date OpenAPI (Swagger) specs or Postman collections. If your API documentation is outdated or incomplete, the platform’s effectiveness is reduced.

2. Limited Manual Customization: While it excels at automation, teams wanting to write custom, deeply tailored test cases may find it limiting compared to manual security testing tools like Burp Suite Pro or ZAP

3. Learning Curve for Full Value: Teams unfamiliar with API security or CI/CD integration may need some onboarding to set up proper pipelines, policies, and risk models effectively.

4. Cloud-Hosted Solution (Data Concerns): Because it's primarily a SaaS-based solution**, some organizations (especially in regulated industries like finance or healthcare) may have concerns about sending API specs or scan data to a third-party cloud.

5. No Real-Time Runtime Protection: ApiSec.ai is a testing tool, not a runtime protection or WAF solution. If you need in-line API protection or real-time traffic monitoring like Noname Security or Salt Security, you’ll need to integrate additional tools. Review collected by and hosted on G2.com.

I recently tried apisec.ai's API scanner during one of my security assessments, and I was genuinely impressed. The setup was quick, and it automatically discovered endpoints without much manual effort. What stood out was the depth of the scans—it picked up logic flaws and auth issues that some other tools missed. The reporting was clean and actionable. Overall, a solid tool to have in your API testing arsenal. Review collected by and hosted on G2.com.

There is nothing I dislike about Apisec. Review collected by and hosted on G2.com.

Apisec.ai provides automated, in-depth API security testing, reducing manual effort and uncovering vulnerabilities efficiently. The continuous scanning feature helps in proactive security management, making it a reliable tool for pentesters and security teams. Review collected by and hosted on G2.com.

While powerful, the learning curve can be steep for beginners, and more detailed documentation would help users maximize its capabilities. Review collected by and hosted on G2.com.

I have scanned networks and web apps for years with tools like Nessus etc, however, I didnt belive I would find something as much easier and beautiful to use for APIs like this tool. It is easy to navigate, has necessary features like the cvss 4.0 score, standard mitigations. Easy implementation of the api, accessibility of rerunning a test for frequent usage. The integration process was top. Customer support was nice even though I didnt need as I found my way through all features. Review collected by and hosted on G2.com.

Nothing honestly. Maybe I dislike the fact I am just getting to know about APIsec.ai Review collected by and hosted on G2.com.

With more than 70 percent of all internet traffic happening through API's we do need a rock solid security testing tool to test and build secure web applications and web application programing interfaces. Apisec.ai is closing this gap by comming up with their API security scanner, which is trully fantastic. Covering all API vulnerabilty classes from OWASP top 10 and beyond is making it a top choice for every cybersecurity professional. Lots of cool features, ease of use and it's intuitive interface have caught my attention from the start. Review collected by and hosted on G2.com.

As a cybersecurity professional, I can only come up with plus points for Apisec.ai API security scanner. Review collected by and hosted on G2.com.

I love that as someone fairly new to learning about APIs that the videos, quizzes, and instructors are all clear in what they’re saying and don’t get overly technical with jargon or if it’s necessary, that jargon is explained. Review collected by and hosted on G2.com.

I would love to see more hands on material. The videos and quizzes are great but would appreciate the practice by doing. Review collected by and hosted on G2.com.

apisec.ia has brought a centralized experience in API analysis, with a firm foundation in the analysis of various vulnerabilities, facilitating the correction and identification of flaws. For security researchers, it is an essential tool in security analysis. The fact that it identifies vulnerabilities by routes, analyzing all API routes, is a wonderful addition, facilitating and reducing the time in the analysis. Review collected by and hosted on G2.com.

So far I have nothing to complain about, the reports are easy to use, the interface is user-friendly and the data is well presented. Review collected by and hosted on G2.com.

The best of apisec.ai is that they provide free resources to learn the API security. The Corey Ball author of Hacking API's is very good calm and good instructor I love the way he explain the things. And the

thanks Dan Barahona to create the platform right now in the market there is not platform like this who teach you API security in a detailed way. Review collected by and hosted on G2.com.

I genuinely not dislike anything about apisec.ai but just an suggestions that like create an additional section of quizzes and of Assessment. And add levels like normal, medium, hard. For both quizzes and assessment. It help learner that how much he knows about API security. Review collected by and hosted on G2.com.

I like scanner because it is easy to use, especially the automated App Model that guides you in the necessary API testing steps. The scanner also has many great features like support for different API types and documentations like GraphQL. It is also vest fast and thorough, and you can integrate many tools like Postman, Jira, and Slack. Overall, great product for security professionals interested in API security. Review collected by and hosted on G2.com.

Some features like GitHub integration are not yet available, but the team has been actively rolling out new updates so it will be available soon. Review collected by and hosted on G2.com.