Why Cequence

These were former products. API Spyder and API Sentinel have been combined into API Security, and Spartan is now called Bot Management. Functionality for existing customers is not affected by these semantic changes.

Bot management is the process of detecting bots, which are purpose-built software designed to automate and scale certain tasks, determining whether they are malicious, and then mitigating undesired bots to prevent negative effects on the business. Malicious bots are simply a vehicle for automated attacks; organizations may encounter many different types of bot attacks against their applications and APIs such as account takeover (ATO), sensitive data exposure, credential stuffing, content scraping, gift card or loyalty program abuse, fake account creation, and more.

Traditional bot management techniques such as IP reputation-based and JavaScript-based CAPTCHA solutions were once sufficient, but no more. Attackers utilize bulletproof proxies and hijacked residential IPs to bypass IP reputation-based products, and CAPTCHAs can be avoided, don’t cover all applications and APIs, and now can be easily solved by generative AI (GenAI).

A successful and future-proof solution now requires multi-dimensional behavioral anomaly detection and native, network-based mitigation that can track attacks as they evolve and prevent bot attacks from reaching the target applications and APIs. To learn more, read the What is Bot Management? blog.

Bots are simply a vehicle for automated attacks, and organizations may not always be aware that they have a bot problem. Some of the common attacks that bots enable at scale include:

• Account takeover (ATO) – Gaining unauthorized access to legitimate user accounts, usually with stolen credentials
• Sensitive data exposure – Accessing inadvertently exposed sensitive data from applications and APIs
• Credential stuffing – Accessing protected services with stolen, legitimate credentials
• Flash sales, hype sales, and ticket scalping – “Jumping the line” to acquire products that would otherwise be available to legitimate customers or purchasing in-demand products quickly for resale
• Content scraping/IP theft – Scraping data from web applications or APIs for esale, ransom, or other nefarious purposes
  • Gift card/loyalty program abuse – Brute-forcing card object combinations such as card numbers or PINs to access valid gift cards or loyalty programs
• Fake account creation – Creating user accounts from fake or stolen user identity information
• SIM swapping – Cellular account takeover that compromises user accounts through unauthorized SIM swaps

To learn more, read the What is Bot Management? blog.

On the other hand, API protection encompasses API security but also extends beyond it. While API security is more focused on preventing unauthorized access and malicious attacks, API protection involves a more holistic view of maintaining the integrity, availability, and performance of APIs. In addition to API security, it includes two other key components:

1. Discovery – Detecting all APIs using both inside-out and outside-in methods to know exactly where we need to apply API security tools.
2. Threat Protection – Once threats are detected, stop them in their tracks natively without relying on a third-party solution such as a WAF. It includes measures to protect against threats such as Denial of Service (DoS) attacks, rate limiting to manage the number of requests an API can handle, and continuous monitoring to detect any unusual activities or anomalies.