# apisec

> apisec (APIsec, Inc.) is an AI-based application security platform for application exploit validation. It models how an application works, generates the attacks a real attacker would use, and runs them at runtime, returning proven exploits (with a replay and the fix) instead of unverified findings. Founded in 2018.

Key facts:
- Product: the apisec platform works in three stages: Discover, Learn (a living Application Model of endpoints, identity, roles, object ownership and business logic) and Exploit.
- Coverage: business logic, data access, roles, containers, infrastructure and security controls; API and AI-agent flows (BOLA, BFLA, tenant isolation, tool-call authorization).
- Pricing: priced per 100 endpoints. Free plan ($0), Standard ($690/month per 100 endpoints), Pro ($2,750/month per 100 endpoints), Bug Bounty (custom). No credit card required to start.
- Free tools: apisec Surface (free, open-source AI and API discovery that produces an AI-BOM, API-BOM and S-BOM, runs offline) and apisec Bolt (free Chrome extension that discovers APIs as you browse and exports OpenAPI specs).
- Education: APIsec University offers free API security courses and certifications.
- Support: support@apisec.ai

## Product

- [Platform](https://www.apisec.ai/platform): How apisec discovers applications, learns how they work, and exploits them the way an attacker would, on every release.
- [Application Model](https://www.apisec.ai/application-model): The living model of endpoints, identity, roles, object ownership and business logic that every apisec attack is generated from.
- [Exploit Detection](https://www.apisec.ai/exploit-detection): What apisec tests across business logic, data access, roles, containers, infrastructure and security controls.
- [Where apisec fits](https://www.apisec.ai/platform/pipeline): Adding agentic exploit validation at the deploy gate alongside existing deterministic testing.
- [Build vs buy](https://www.apisec.ai/platform/build-vs-buy): Comparing a DIY AI pentesting pipeline with apisec.
- [Why apisec](https://www.apisec.ai/why-apisec): Keep SAST, DAST, SCA and WAF; apisec proves what an attacker can actually exploit.
- [Pricing](https://www.apisec.ai/pricing): Plans priced per 100 endpoints, with FAQs on endpoints, private APIs and deployment.

## Use cases

- [AI agents at runtime](https://www.apisec.ai/use-cases/ai-agents-runtime): Proving cross-agent access, delegated-credential scope, tool-call authorization and tenant boundaries in agent flows.
- [AI-BOM & API-BOM](https://www.apisec.ai/use-cases/ai-bom-api-bom): Building an outside-in inventory of what is actually exposed, not just what was built.
- [API security testing](https://www.apisec.ai/use-cases/api-security-testing): Testing the APIs behind AI agents with the agent's own token: BOLA, BFLA, object ownership and privilege boundaries.
- [Agentic application security](https://www.apisec.ai/use-cases/agentic-app-security): Full exploit chains from entry point to data reached, run at runtime.
- [Daily pen testing](https://www.apisec.ai/use-cases/daily-pentest): Daily re-runs of exploits with a dated, replayable record suitable for audit.

## Free tools

- [apisec Surface](https://www.apisec.ai/surface): Free, open-source discovery of agents, MCP servers, RAG pipelines and API endpoints in one command; nothing leaves your machine. Source: https://github.com/apisec-inc/AI-Surface
- [apisec Bolt](https://www.apisec.ai/bolt): Free Chrome extension that captures real API calls as you browse, filters high-confidence endpoints and exports OpenAPI specs.
- [Try apisec with OWASP crAPI](https://www.apisec.ai/crapi): Run a first validation against the deliberately vulnerable crAPI practice API.

## Learn

- [Learn hub](https://www.apisec.ai/learn): Free courses from APIsec University and original research from apisec Labs.
- [Blog](https://www.apisec.ai/blog): Guides on API security testing, the OWASP API Security Top 10, business logic flaws and access control.
- [What is the OWASP API Security Top 10](https://www.apisec.ai/blog/what-is-owasp-api-security-top-10): Overview of the OWASP API Top 10 risks.
- [BOLA explained](https://www.apisec.ai/blog/understanding-broken-object-level-authorization-bola-owasp-api-security-principle-1): Broken Object Level Authorization, OWASP API1.
- [API penetration testing checklist](https://www.apisec.ai/blog/complete-api-penetration-testing-checklist): Checklist for security teams.
- [Case studies](https://www.apisec.ai/case-studies): How customers such as Axos Bank, Seismic and Sally Beauty use apisec.

## Company

- [About](https://www.apisec.ai/about): apisec's mission since 2018: no application goes to production with an exploitable path.
- [Request a demo](https://www.apisec.ai/demo): Tailored walkthrough for dev, staging or production.
- [Sign up free](https://www.apisec.ai/sign-up): Start free, no credit card required.
- [Contact](https://www.apisec.ai/contact)
- [Support](https://www.apisec.ai/support)

## Optional

- [Privacy Policy](https://www.apisec.ai/privacy-policy)
- [Terms and Conditions](https://www.apisec.ai/terms-and-conditions)
- [Service Level Agreement](https://www.apisec.ai/sla)
- [Free License Agreement](https://www.apisec.ai/free-license-agreement)