Salt Security, which is developing a threat protection solution that discovers APIs and detects vulnerabilities, today raised $ 30 million. The Palo Alto, California-based startup plans to use the capital to bolster product development, sales and marketing, and customer acquisition efforts well into 2021, following a $ 20 million raise in June.
Application programming languages (APIs) dictate the interactions between software programs. They define the kinds of calls or requests that can be made, how they’re made, the data formats that should be used, and the conventions to follow. As over 80% of web traffic becomes API traffic, they are coming under increasing threat. Gartner predicts that by 2021, 90% of web apps will have more surface area for attacks in the form of exposed APIs than frontends.
Salt’s platform aims to prevent these attacks with a combination of AI and machine learning technologies. It analyzes a copy of the traffic from web, software-as-a-service, mobile, microservice, and internet of things app APIs and uses this process to gain an understanding of each API and create a baseline of normal behavior. From these baselines, Salt identifies anomalies that might be indicators of an attack during reconnaissance, eliminating the need for things like signatures and configurations.
Above: The web dashboard for the Salt Security platform.
Salt leverages dozens of behavioral features to identify anomalies. Its machine learning models are trained to detect when an attacker is probing an API, for instance, because this deviates from typical usage. They analyze the “full communication,” taking into consideration factors like how an API responds to malicious calls. And they correlate attacker activity, enabling Salt to connect probing attempts performed over time to a single attacker, even if the perpetrator attempts to conceal their identity by rotating devices, API tokens, IP addresses, and more.
Confirmed anomalies trigger a single alert to security teams with a timeline of attacker activity.
Salt takes an approach similar — but not identical — to that of Elastic Beam, an API cybersecurity startup that was acquired by Denver, Colorado-based Ping Identity in June 2018. Other rivals include Spherical Defense, which adopts a machine learning-based approach to web application firewalls, and Wallarm, which provides an AI-powered security platform for APIs, as well as websites and microservices.
But Salt is doing brisk business, with customers like Gett, City National Bank, TripActions, and Armis. The company claims the size of its customer base has increased 200%.
The series B funding round announced today was led by Sequoia Capital, with participation from existing investors Tenaya Capital, S Capital VC, and Y Combinator. It brings Salt’s total raised to $ 60 million.
