Web Application and API Security

Protect web applications and APIs across any public or private cloud.

Today’s modern applications present security teams with a sprawling attack surface to monitor and protect, making traditional web application firewalls (WAFs) or point solutions difficult to manage and scale.

Read our Web Application and API Security benchmark analysis.

Secure your web applications and APIs

Prisma® Cloud WAAS provides an integrated approach to Web Application and API Security as part of our Cloud Native Security Platform, supporting the OWASP Top 10 and API protection, along with capabilities like Vulnerability Management, Compliance, and Runtime Defense. The WAAS module automatically detects and protects microservices-based web applications and APIs in cloud and on-premises environments.
  • Automatic visibility and protection
  • Single-agent, full stack protection
  • Easy deployment and scaling
  • OWASP Top 10 protection
    OWASP Top 10 protection
  • API security
    API security
  • Bot risk management
    Bot risk management
  • Virtual patching
    Virtual patching
  • Application DoS protection
    Application DoS protection
  • Continuous visibility
    Continuous visibility


Our approach to Web Application and API Security

OWASP Top 10 protection

Deploying application and API protection can be difficult in mixed environments. Prisma Cloud simplifies deployments with a single integrated agent for all cloud workload protection, delivering full, customizable support for the OWASP Top 10.

  • Secure web applications from top security risks

    Cover SQL injection, cross-site scripting, code injection and more.

  • Identify applications and APIs in any compute format

    Automatically discover web-facing services and APIs for protection.

  • Enforce application security on microservices locally

    Automatically enforce WAAS at the service level to keep up with auto-scaling, ephemeral environments.

  • Leverage full, customizable protection

    Select which enforcement mechanism – alert, prevent or ban – to apply for each security scenario.

  • Deploy agents as a part of your DevOps workflow

    Use code-based deployment mechanisms to enable automatic deployment of protection with every code push.

  • Take a unified approach to cloud native security

    Use a single, unified cloud security solution for superior protection compared to point products.

Application and API Protection

The key to comprehensive protection is accuracy, precision, and depth. With WAAS, you can enable customizable protection spanning the OWASP Top 10, API protection, file uploads, geolocation-based controls and more.

  • Auto-discover and protect applications and APIs

    Automatically detect web-facing and API services to protect, even in ephemeral environments.

  • Secure APIs against layer 7 attacks

    Simplify enforcement of positive API definitions based on OpenAPI, Swagger file or manual customization.

  • Enforce secure file uploading policies

    For applications that allow users to upload files, enforce file upload restrictions based on file extension and file content.

  • Configure fully for each application

    Customize the level of alerting and blocking for the unique use cases of your applications.

Bot risk management

The internet is full of bots, but not all bots are malicious. Gain visibility into bot activity to allow known good bots, such as search engine crawlers, to go through while other malicious bots are blocked.

  • Allow and monitor known bots

    Allow good bots, such as search engine crawlers and news bots, to crawl your applications, but monitor and block abusive behavior.

  • Control unknown bots

    Alert or block requests originating from bots with unknown intent, including headless browsers, command line tools and good bot impersonators.

  • Define custom bots

    Create bot definitions for bots your team decides are known-good or malicious.

  • Configurable for each application

    Set application- or individual service-level configurations for bot protection rules.

Virtual patching

When vulnerabilities are discovered, exploit kits are often released before a patch is available. Protect against unpatched vulnerabilities at the service level.

  • Reduce risk until official patches are released

    Use virtual patching to create a safeguard against exploits until the underlying service can be patched.

  • Add custom WAAS rules for signatures from your team

    Take advantage of custom rules, a guided, auto-complete way to secure against exploits when your research teams identify vulnerabilities.

  • Protect against zero-day exploits

    Automatically receive updated WAAS rules from Prisma Cloud Labs and choose whether to apply them.

Application DoS protection

Attacks on applications include forcing it to shut down or increasing latency, impacting end customers. Prisma Cloud enforces rate limits and protects against both high volume and steady DoS attacks.

  • Prevent volumetric attacks from crashing applications

    Alert on or ban requests that exceed defined thresholds for burst rates and average rates.

  • Protect against targeted DoS attacks

    Prevent vulnerability targeting attacks hidden in HTTP methods, file extensions and response codes.

  • Control penalty box settings

    Ban frequent abusers based on IP address or session ID for a configurable time period to prevent overly broad bans.

Continuous visibility

Gaining visibility into protected and unprotected web applications and APIs is the first step to comprehensive protection. That’s why Prisma Cloud automatically identifies the protection status of web apps in our centralized Radar with a simple, straightforward UI to quickly enable customizable protection.

  • Find and protect your entire web app and API surface

    Use WAAS to detect unprotected web applications and flag them for protection.

  • Reduce noise by identifying only public facing APIs

    Automatically detect web app and API behavior and does not flag services without an API.

  • Leverage advanced analytics for investigations

    Use analytics to observe WAAS audits in aggregate from different points of view, filter them and dive into individual events for incident investigations.

  • View all security events in a single console

    Identify vulnerabilities, compliance violations, runtime events and WAAS events in one dashboard.

Prisma Cloud
Prisma Cloud
Prisma Cloud delivers the industry’s broadest security and compliance coverage—for applications, data, and the entire cloud native technology stack—throughout the development lifecycle and across multi- and hybrid-cloud environments.

Cloud Workload Protection modules

Host Security

Secure virtual machines (VMs) on any public or private cloud.

Container Security

Secure Kubernetes and other container platforms on any public or private cloud.

Serverless Security

Secure serverless functions across the full application lifecycle.

Web Application & API Security

Protect against Layer 7 and OWASP Top 10 threats in any public or private cloud.