Gartner defines API protection products as a category of specialized stand-alone security products focusing on protecting APIs from exploits, abuse and access violations, and assisting in remediating API exposures. These products offer features such as API discovery, API security testing, API posture management and runtime protection utilizing behavioral analysis. They should provide coverage for the internal- and external-facing APIs, and third-party APIs that organizations may consume. API protection products are delivered as cloud-based and on-premises solutions. Deployment can be offered in-line by intercepting ingress/egress API calls or out-of-band by deploying agents on application workloads and/or scanning code repositories.
The In-app protection market refers to security solutions implemented within the application (instead of the network or the operating system, for example) to make the application more resistant to attacks such as malicious data exfiltration, intrusion, tampering, and reverse engineering. Enterprises use in-app protection to safeguard their software-based assets and to protect their organization and customers from fraudulent attacks.
The mobile AST market is composed of buyers and sellers of products and services that analyze and identify vulnerabilities in applications used with mobile platforms (iOS, Android and Windows 10 Mobile) during or post development. Many variations and flavors of techniques exist, but fundamentally mobile AST solutions test applications in three main ways: (1) SAST: These solutions statically analyze the source, binary or bytecode of an application to identify vulnerabilities. (2) Behavioral testing: Mobile AST solutions use behavioral analysis to observe the behavior of the app during runtime and identify actions that could be exploited by an attacker. (3) DAST: These solutions also use dynamic analysis to test the app in its runtime state. DAST simulates attacks against an application and analyzes the application's reactions, determining whether it is vulnerable.
Mobile threat defense (MTD) products protect organizations from malicious threats on iOS and Android devices, at the device, network and application levels. To successfully attack a mobile device, mobile malware must circumvent the controls built into mobile OSs, such as those for app store curation and native mobile OS hardening. MTD products tend to focus on preventing and detecting anomalous behavior by collecting and analyzing indicators of compromise, as well as expected behavior. MTD products gather threat intelligence from the devices they support, as well as from external sources, and use an analysis engine that resides in the cloud, on-premises or on an MTD app installed on devices.