Need indicators
This capability is usually relevant when these signals appear in the operating environment.
Public APIs.
Abnormal service consumption.
Need for bot and abuse protection.
Back to solutions
Discuss your use case
Web Application Security
Technology solutionWeb Application and API Protection
Inspect traffic before it reaches your web applications and APIs to reject invalid requests, counter bots, and reduce exploitation risk.
What is this solution?
WAAP combines web application and API protection with application-layer controls for bots and abuse. WAF policies inspect web traffic, API defenses compare requests with expected behavior or schemas, and bot controls look for automation across requests. These capabilities complement rather than replace each other.
Web application and API protection combines WAAP bot management with application and API abuse protection tailored to each traffic path.
Practical example
A digital service sees suspicious web requests and high automated use on a public API. The team evaluates each path with suitable rules without blocking legitimate integrations.
Technical summary and scope of use
Technical explanation
The technology is a centralized protection layer for web applications and APIs, working as a reverse proxy that checks HTTP(S) requests before they reach applications. it analyzes requests, verifies protocols and diagrams, applies permission and blocking patterns, manages sessions, imposes access controls, and records security events.
The technology works as a protective layer against web applications and APIs. Before any request reaches the application, it is checked to make sure it is safe, consistent with permitted protocols and schemes, and does not contain attempts of injection, play or malicious automatic behavior.
The technology also helps in:
- Control who can access the applications.
- Safely managing sessions.
- Support for Unified Entry Registration
- Monitoring of events and requests
- Connecting events with security monitoring and analysis systems
In practice, this class reduces the exposure of applications to attacks, provides a clearer view of requests and threats, and helps improve availability and continuity through a balance between load and protection mechanisms.
Scope of use
The technology works in the environment:
- The Web Applications
- Applications
- The API
- The Virtual Environment
- Cloud Environment
- Internal applications
- External applications
The technical objective is:
- Reduce the risk of attacks on applications and APIs
- Prevent manipulation or theft of data
- Improving the security visibility
- Improving availability and continuity
What it delivers
Core capabilities that turn the requirement into practical controls.
Web application and API protection
Connection and protocol management
Session and identity protection
Expected value
The impact security teams and leadership can expect from the right implementation.
Reduced API exposure
Better consumption control
Broader protection for modern apps
Technical capabilities
Feature availability depends on product version, target systems, deployment, and integrations.
Web application and API protection
Protect Web Applications and APIs through Web Application Firewall and API Security Gateway within the WAAP concept
Inspect requests before they reach the service and define covered routes and rejection behavior.
Check each HTTP(S) request before it passes to the application
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Negative protection models through banned lists to detect known attacks such as injection and XSS
Inspect input for known attack patterns; inspection does not replace fixing the application.
Smart discovery patterns target families with complete attacks and not just single flaws
Combine relevant detection signals and review blocking impact on legitimate traffic before production.
Protocol and request normalization to prevent filter bypass
Normalize request components before inspection to make it harder to bypass security rules by changing the request encoding.
Positive security model: deny requests unless explicitly allowed
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Detection of deviations from normal behavior using anomaly detection
Correlate activity with its context to surface anomalies for review without treating every deviation as an incident.
Discover bots and browsing programs that try to appear as ordinary users
Distinguish suspicious automation from normal traffic and test exceptions for legitimate integrations.
Implementation of compliance with JSON and OpenAPI schemes
Compare request structure with the agreed API contract before forwarding it; test unexpected fields.
Blocks the infringed requests for the definition of the interface
Combine relevant detection signals and review blocking impact on legitimate traffic before production.
API protection through API keys, dynamic client registration, throttling and JSON object attack filters
Limit request rates by client or route to protect the service without blocking normal use.
Protection from DoS on Seventh Class
Gateway controls limit abusive requests within available capacity; volumetric floods may need upstream protection.
Protection against bots and automatic attacks
Distinguish suspicious automation from normal traffic and test exceptions for legitimate integrations.
Threat Intelligence, Webroot Feed Integration and GEO Filters
Combine relevant detection signals and review blocking impact on legitimate traffic before production.
Connection and protocol management
HTTP(S) reverse proxy
Receive connections in front of the service, then apply policy before forwarding requests.
TLS termination
Terminate TLS at the gateway for inspection and define how the connection to the application is protected.
OCSP and OCSP stapling
Check certificate revocation status and validate connection behavior when status lookup is unavailable.
Support to Encrypt
Integrate certificate enrollment or renewal with a compatible issuer; test authorization, renewal, and revocation.
Integrated with HSM
Integrate key operations with hardware protection where supported and review key export restrictions.
Service virtualization and content rewriting
Expose or rewrite service paths or content and verify that expected application behavior is preserved.
ICAP interface high availability
Send covered content to an external inspection service and define gateway behavior if the service is unavailable.
Session and identity protection
Cookie protection
Test how the protection layer handles modified cookies and identify the applications and rules in scope.
CSRF tokens
Verify session-bound proof before accepting state-changing requests, as appropriate to the application.
URL encryption
Test protected URLs on in-scope web routes and review how redirects affect URL elements.
form protection
Apply field and value rules to web forms separately from the API request schema.
Dynamic Value Endorsement
Identify which request values are validated, then test both a legitimate and a modified value in the integrated application.
Upstream authentication
Associate users or groups with authorized scope and review how membership changes affect access.
Access control when integrated with the identity system
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Single Sign-On
Associate users or groups with authorized scope and review how membership changes affect access.
Enforcement Point for Access Rules
Turn organizational requirements into testable settings and define who may approve exceptions.
Secure session management
Review web session lifetime and revocation at the protection layer separately from API token validity.
JWT and Connecting JWKS servers
Verify token signature, issuer, audience, and expiry before accepting the request.
Supports OAuth 2.0, OpenID Connect 1.0 and SAML 2.0 when integrated with the ID system
Federate sign-in through an identity provider; validate token issuer, audience, and expiry.
Identity propagation of old systems that do not support modern standards
Associate users or groups with authorized scope and review how membership changes affect access.
Integration and Monitoring
Integration with SIEM.
Send structured events to monitoring and verify that key fields arrive with the event time and asset context.
Integrated with viral scans.
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Integration with fraud prevention systems.
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Integrated with HSM
Integrate key operations with hardware protection where supported and review key export restrictions.
Integrate records with Splunk, Logpoint, ArcSight and others
Send structured events to monitoring and verify that key fields arrive with the event time and asset context.
Organized records in JSON format
Record what happened, when, and in which scope; review event fields and retention for investigation and audit.
Common Event Format (CEF) support
Send structured events to monitoring and verify that key fields arrive with the event time and asset context.
Lucene query syntax
Show activity within the covered scope and associate events with an asset or session during review.
Access statistics
Show activity within the covered scope and associate events with an asset or session during review.
Places ready for safety, performance and failure detection
Present reviewable results to compare changes and identify cases requiring action.
Custom visualizations
Show activity within the covered scope and associate events with an asset or session during review.
Availability and Continuity
High availability through failover cluster with active-passive and active-active
Reduce disruption from a component failure; test actual failover and recovery to normal operation.
Load balancing
Distribute traffic across endpoints; verify session behavior and removal of unhealthy targets.
health checks
Detect an unhealthy target so traffic is withheld until it is ready again.
Operations and Cloud Infrastructure
Deployment as a virtual appliance or cloud image
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Operating support as a cloud image compatible with AWS, Google Cloud and Azure
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Operating support in Alibaba Cloud
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Configuration management
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Automatic rule suggestions / policy learning
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Staging support
Test rules against representative traffic before production and define rollback if unintended impact appears.
Automation via REST API
Connect defined actions or data to other systems; review authorization, authentication, and failure handling.
How the technology works
How it works
- The technology deals with risks by setting a front control point that checks HTTP(S) requests before they reach applications.
- The protection mechanism is based on:
- Filter to prevent known attacks.
- Use of a positive permission model for authorized behavior
- Normalization of protocols and requests to prevent filtering
- Check API schemes such as JSON and OpenAPI
- Throttling and protection from bots and DoS attacks
- Identity verification and authorization when integrated with the identity system
- Management of Safe Sessions
- Events and security records.
- Connecting events with SIEM systems for analysis and monitoring
- Improving availability through load balancing, health checks and failover mechanisms
What to validate before rollout
- Tune web request inspection to the application's traffic patterns.
- Identify published APIs and expected operations and test policies against them.
- Distinguish legitimate integrations from abusive automation before applying supported restrictions.
Integration and scope
Inventory exposed web applications and APIs and establish the inspection point. Validate bot controls and enforcement actions for each path.
Challenges this solution addresses
- Web apps attacks such as Injection and XSS
- Applications that violate the API or JSON/OpenAPI
- attempts to steal or modify data through applications
- Weak access control.
- Unsecure sessions
- Boots, Automatic Attacks and Surfing Programs
- DoS attacks on the 7th class
- Weak vision in access records and events
- Difficulty Connecting Application Events to SIEM Systems
- The need to protect old applications that do not support modern identity standards
- High availability, failure and burden distribution challenges
- Risk of direct communication between users and applications without a centralized check and check layer
Regulatory alignment
Illustrative ways to support control implementation. An area may have more than one example; each row is not necessarily a separate official control.
NCA · ECC 2:2024For entities within the scope of the Essential Cybersecurity Controls.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Security of web applications. | The protective layer provides web applications and APIs, with HTTP(S) requests checking and communication security verification. Related capability: Web Application Protection Wall, APIs Protection, HTTPS/TLS | Applied |
| Network Security Management | Use a reverse proxy to inspect traffic, restrict protocols, and mitigate denial-of-service attacks. Related capability: HTTP(S) reverse proxy, verification of protocols, protection from DoS attacks | Applied |
| Identity and access management | Support access control, standard entry registration, and secure sessions management when integrated with the identity system Related capability: Single Sign-On, Access Control, Safe Sessions Management | Applied |
| Events records and monitoring | Provide organized records, access statistics, tracking panels, and link to monitoring and analysis systems Related capability: JSON records, tracking panels, SIEM integration, Common Event Format | Applied |
| Incident and threat management | Supports detection of threats, malicious behaviors and analysis of suspicious activities Related capability: Threat Intelligence, Detection of Bots, GEO Filters | Applied |
| Management of deficiencies | Supports reducing the exploitation of fractions by applying front protection policies before applying modifications Related capability: Virtual patching | Applied |
| Cryptography | Support communication encryption, certificate verification and integration with key management units Related capability: TLS; OCSP; HSM integration; URL encryption | Applied |
| Protection of data and information | Reduce attempts to manipulate or steal data by protecting forms, cookies and sessions Related capability: form protection; cookie protection; CSRF tokens | Applied |
| Cyber flexibility and continuity of business | Supports high availability, burden balance, and backup failure mechanisms Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: High availability; failover; load balancing; health checks | Applied |
| Cyber Security for Cloud Computing and Hosting | Support publishing as a default device or cloud image within cloud environments Related capability: virtual appliance, cloud image, support as a cloud image compatible with AWS, Google Cloud and Azure as well as Alibaba Cloud | Applied |
SAMA · CSFFor financial institutions within the Saudi Central Bank framework, subject to the control's applicability.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Security Governance | Helps enforce centralized access policies for sensitive accounts, clarify accountability, and support adherence to security policy Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Central Management of Security Policy | Applied |
| Identity and access management | Controls access to sensitive systems according to the principle of the need for knowledge and the need for use. Related capability: Identity management, access and accurate control of powers | Applied |
| Management of Privileges and Powers | Supports restricting the use of high-prioritarian accounts and monitoring their use Related capability: Privileged account management | Applied |
| Access from distance. | Supports administrative access regulation and sensitive accounts-related sessions monitoring Related capability: Access Control and Session Monitoring | Applied |
| Multi-factor authentication | Supports strengthening the identity verification of sensitive accounts and reduces the risks of unauthorized access Related capability: Multi-factor authentication | Applied |
| Management of assets | It contributes to the protection of access to servers, applications, databases and hardware connected with the technology infrastructure Related capability: Management of access to devices, servers, applications and database | Applied |
| Risk Management | Reduce the risk of abuse of privileges, joint accounts and uncontrolled administrative accounts Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Control of sensitive accounts and limiting privileges | Applied |
| Security Monitoring | Provides continuous monitoring of the management activities and user behavior within sensitive systems Related capability: Monitoring user behavior and administrative activities | Applied |
| Events and records. | Supports registration of activities and sessions related to high authority accounts Related capability: Activity logging and audit records | Applied |
| compliance and audit | Provide inspection records that help to review and verify compliance with security policies and procedures Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Audit records and recording sessions | Applied |
| Protection of data | Contribute to the protection of credentials and passwords related to administrative and sensitive accounts Related capability: Protecting Sensitive Data | Applied |
| Protecting the systems | Prohibits unauthorized access to sensitive systems and restricts the execution of unauthorized orders Related capability: Prevent unauthorized access and preventing the execution of unauthorized orders | Applied |
| Protection of Infrastructure | Supports access management to sensitive infrastructure components in local, cloud and hybrid environments Related capability: Unified Management of Systems, Applications and Devices | Applied |
| Operational Security | Reduce the dependence on manual processes through account management and policy implementation Related capability: Automated Account Management and Security Processes | Applied |
| Incident response | Provides records and activities of analytical sessions to support investigations and analysis of events after incidents Related capability: Registration of Sessions and Audit Records | Applied |
| Continuity of business | Reduce the risk of interruption or disruption of processes resulting from abuse of critical accounts Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: Central Management for Access to Sensitive Accounts | Applied |
| Security of third parties | Supports control and monitoring of access to sensitive systems by external users or related entities Related capability: Access Control and Session Monitoring | Applied |
| Security of cloud environments | Supports access management through cloud, local and hybrid environments Related capability: Supporting cloud, local and hybrid environments | Applied |
| Protection of sensitive financial systems | Limit access to highly sensitive systems and applies monitoring and audit to related administrative accounts Related capability: Management of sensitive accounts and monitoring of sessions | Applied |
| Protection of Critical Environments | Supports the protection of administrative accounts used in critical systems by limiting authorities and registrating activities Related capability: Protection of administrative and sensitive accounts | Applied |
NCA · OTCC-1:2022For operational technology and industrial control environments to which the controls apply.
Evaluate these examples against the facility level and assets in scope. They do not authorize IT/OT connectivity or component installation on operational assets without assessment.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Visibility and monitoring | Provide organized records, tracking panels, access statistics, and link to monitoring and analysis systems Related capability: logging; dashboards; SIEM integration | Applied |
| Isolation of networks. | It can be used as a front intermediate between users and services. Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: reverse proxy | Applied |
| Communication between IT and OT | It can be used as a port for applications and software interfaces between different regions with the imposition of access controls Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: HTTP(S) reverse proxy; access enforcement | Applied |
| Access control | Supports access control, standard login registration, and verification of characteristics when integrated Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: access control; Single Sign-On; JWT; JWKS | Applied |
| Discover threats. | Supports behavioral analysis, detection of bots and exploitation of threat information Related capability: threat intelligence; anomaly detection; bot detection | Applied |
| Protection of Protocols | Supports verification of HTTP(S) protocols and verification of JSON and OpenAPI schemes Related capability: protocol validation; OpenAPI enforcement | Applied |
| Incident response | Supports the collection and connection of records and events with security analysis and monitoring systems Verify asset compatibility and test operational impact before deploying an agent or taking response action in an OT environment. Related capability: structured logs; SIEM; Common Event Format | Applied |
| Protection of industrial environments | Supports the protection of web applications and APIs used within industrial environments or between connectivity zones Related capability: WAF; API gateway | Applied |
| Protection of remote access | Supports secure sessions management and access control at application level Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: secure session management; access control | Applied |
Aramco · SACS-210 (2026)For Aramco third parties, subject to their classification and assessment scope. These examples do not establish CCC certification.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| HTTP and HTTPS inspection for external applications | The WAF component can inspect covered application traffic when both paths traverse it and HTTPS is inspectable at the intended enforcement point. | Applied |
“Applied” describes the capability in the illustrative example, not an implementation or compliance status for the customer.
Decision questions
Questions before you start
How do we know this solution is right for us?
Start with the risk signals on this page. If they match your environment, they can be turned into a short assessment that defines scope, priority, and a practical implementation approach.
How do we start without adding operational complexity?
Start with a focused risk and scope assessment, then define implementation priorities, technical requirements, and phased rollout steps.
Related solutions
WAF
Web Application Firewall
Protect web applications from common attack patterns and abuse.
Explore solutionAPI Security
API Security Gateway
Govern API protection through validation, authorization, usage monitoring, and exposure reduction.
Explore solutionMicrogateway
Microgateway Security
Apply protection controls close to microservices and sensitive internal integrations.
Explore solutionReady for the next step?
Turn this need into a practical assessment and clear implementation plan.
Share your use case and priority systems so we can discuss a pilot and its integration requirements.