About the API Security category
What belongs in this category
The API Security category covers products that secure the APIs applications use to exchange data. Typical entries build an inventory of every API, including undocumented (shadow) and outdated (zombie) ones, classify the data they expose, test them for weaknesses such as broken authorization, and detect and block attacks on them in production.
Abuse of an API by clients that look legitimate, such as scraping data a client should not see or misusing business logic, fits API Abuse Prevention. API protection bundled with a web application firewall and bot defense fits Web Application and API Protection (WAAP). APIs that connect AI agents to tools through the Model Context Protocol fit MCP Security. Every API security product is also open to Application Security.
Related categories to enter
Each category is judged separately, so you can enter a product in every category that matches what it does, with a separate nomination for each. Tailor each nomination to that category's focus. Entering several related categories gives the product more than one chance to be recognized.
How entries are judged
An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against organizations of similar size and region, so a mid-sized firm is not ranked against a global enterprise. Your entry package, any sponsorship and public votes do not affect the jury's scores.
Strong entries in this category show:
- Leadership — the API estate the product covers: APIs discovered and protected, calls analyzed, gateways and clouds supported, and customers that rely on it for API inventory and defense.
- Innovation — an API problem solved in a new way, such as finding authorization flaws automatically, discovering APIs no team documented, or testing every API change before it ships.
- Impact — results for customers: unknown APIs found, sensitive data exposure closed, API attacks blocked, flaws fixed before release. Give figures from customers.
The jury awards Gold, Silver or Bronze, or a Finalist badge, and results are published on this site and announced to the 600,000+ member Cybersecurity Insiders community. Every approved nomination also enters the separate Community Choice award, decided by public votes.
How to enter
A vendor can enter its own product or service, and a PR agency can enter it on a client's behalf. The nomination form has a confidential field for detail that is shared with the judges and not published, such as customer names, deployment figures or roadmap. Deadlines, pricing and entry steps are on the How it Works page.