About the Web Application and API Protection (WAAP) category
What belongs in this category
The Web Application and API Protection (WAAP) category covers products that stand in front of live web applications and APIs and stop attacks on them. Typical entries combine a web application firewall that blocks injection and other exploits, API discovery and protection, defense against bots and denial-of-service attacks, and virtual patching that shields a known flaw until the code is fixed. These products run in the cloud, at the edge or in the application stack.
A web application firewall sold on its own enters here. Products focused on one layer have narrower categories: API Security for discovering, testing and protecting APIs on their own, API Abuse Prevention for business logic abuse, Bot Management for automated traffic and DDoS Protection for floods. Runtime application self-protection, which no longer has its own category, can enter here. A WAAP platform or RASP product may also be entered in Application Security, where it is judged among all application security products.
Related categories to enter
Each category is judged separately, so you can enter a product in every category that matches what it does, with a separate nomination for each. Tailor each nomination to that category's focus. Entering several related categories gives the product more than one chance to be recognized.
How entries are judged
An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against organizations of similar size and region, so a mid-sized firm is not ranked against a global enterprise. Your entry package, any sponsorship and public votes do not affect the jury's scores.
Strong entries in this category show:
- Leadership — the applications and traffic the product protects: applications and APIs behind it, requests handled each day, deployment options (cloud, edge or on premises), and customers that rely on it in production.
- Innovation — a web protection problem solved in a new way, such as blocking new exploits within hours of disclosure, protection that needs little rule tuning, or one policy for web apps and APIs across clouds.
- Impact — results for customers: attacks blocked, real users wrongly blocked, time to virtual-patch a new flaw, rule maintenance saved. Give figures from customers.
The jury awards Gold, Silver or Bronze, or a Finalist badge, and results are published on this site and announced to the 600,000+ member Cybersecurity Insiders community. Every approved nomination also enters the separate Community Choice award, decided by public votes.
How to enter
A vendor can enter its own product or service, and a PR agency can enter it on a client's behalf. The nomination form has a confidential field for detail that is shared with the judges and not published, such as customer names, deployment figures or roadmap. Deadlines, pricing and entry steps are on the How it Works page.
