RSA 2023 Update: Salt Security accelerates API Threat Detection with new investigation capabilities

Using rich insights gathered from more than five years in customers' environments, the Salt API data cloud can quickly analyze all API traffic over days, weeks, and months to detect and combat the low and slow approach of API attacks. With the latest improvements to its patented AI algorithms, Salt now delivers:

• Enhancements to its core AI models – Salt has incorporated advanced models, including neural networks, to process more API data at faster rates into its patented API Context Engine (ACE) architecture. Salt has also applied insights from thousands of customer environments into the data sets it uses for the supervised learning portions of the algorithms. These enhancements to the Salt patented API Context Engine (ACE) architecture underlie several new platform capabilities that span API attack detection and discovery.
• Improved user intent detection – Salt is tapping its AI model enhancements to more quickly and more accurately detect when an API user exhibits malicious intent. Since most anomalies are benign, platforms that simply provide anomaly detection flood SoC teams, reducing the platform's value. These enhanced insights that distinguish API changes from API attacks enable Salt to further reduce its false positive rate while ensuring accurate identification of true positives.
• New threat severity analytics – Salt taps the power of its cloud-scale data sets to analyze more than one million anomalous users every day, looking at their behaviors, over long periods of time, for indicators of malicious intent. Since only 0.02% of traffic is malicious, Salt has been able to distill these signals from the noise and has augmented its attacker analysis to highlight different levels of severity for API attacks. The new capability enables security teams to differentiate between high- vs. low-severity attacks, so they can focus their time and attention on the greatest threats. Tracking user activity over long vs. short periods of time is essential to surfacing today's low-and-slow API attacks, which can take days and weeks to unfold.
• A new Rapid Investigation mode – Salt has long correlated attacks into a consolidated attacker timeline to help SoC teams streamline incident resolution. The new Rapid Investigation mode now identifies the most malicious attack events, highlighting them at the top of the attacker timeline. The Salt ACE engine analyzes the confidence of the Salt ML findings to identify these most critical malicious events. Given the significant rate of increase in API traffic and API attacks and the lack of commensurate growth in SoC teams, this new capability helps SoC teams keep up with the growing threat of API attacks. The SoC teams can tap the intelligence of the Salt platform to better scale their operations by dramatically reducing the mean time to resolve (MTTR) API attacks despite not having deep knowledge of the APIs themselves.
• Advanced API discovery at scale – Salt improvements to its AI and ML models has also enhanced its API discovery process. The latest version of the Salt platform provides a more accurate mapping of API endpoints. This kind of intelligent grouping makes it practical for large organizations to inventory and understand their APIs at scale. Less intelligent systems create a usable catalog in real-world operations, listing an iteration of an API per dynamic component such as a user ID, for example. Organizations need intelligent coalescence and deduplication for effective cataloging at scale.

"As the pioneer in API security, Salt recognized early on that API attacks differ from other types of attacks," said Roey Eliyahu, CEO, Salt Security. "To capture a BOLA attack in the wild, you must watch API behavior over days, weeks – even months. A short analysis window means you'll miss most in-the-wild API attacks and also limits your ability to determine user intent. With our AI-powered cloud-scale big data architecture and long analysis windows, we have unparalleled insights across trillions of API calls over time to capture attacker reconnaissance activity. By integrating those learnings into the supervised portions of our ML models, and delivering these new threat protection and discovery capabilities, we enhance the value we deliver to organizations to understand their API ecosystem and quickly and accurately identify and stop API attacks."

According to the Q1 2023 State of API Security Report, nearly 80% of API attacks come from seemingly legitimate users who have maliciously achieved the proper authentication. To identify and defend against these types of attacks, organizations must monitor their APIs' behaviors in production over time. The scale of the Salt customer base, the length of time the Salt AI algorithms have had for learning, and the long analysis windows Salt offers provide the Salt platform with unique abilities in API discovery and inventory, attack detection, and remediation insights gleaned in runtime.

To learn more about the Salt Security API Protection Platform or to request a demo, please visit: https://content.salt.security/demo.html.

About Salt Security

Salt Security protects the APIs that form the core of every modern application. Its patented API Protection Platform is the only API security solution that combines the power of cloud-scale big data and time-tested ML/AI to detect and prevent API attacks. By correlating activities across millions of APIs and users over time, Salt delivers deep context with real-time analysis and continuous insights for API discovery, attack prevention, and hardening APIs. Deployed quickly and seamlessly integrated within existing systems, the Salt platform gives customers immediate value and protection, so they can innovate with confidence and accelerate their digital transformation initiatives. For more information, visit https://salt.security/