Protection that’s accurate enough to leave on
APIs, bots, and agents on the same path
Protection and resilience that follow the application
Where we are taking this next
What this recognition represents to us
Learn more

Akamai has been named a Leader in the IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment. This is the second time that Akamai has been recognized as a Leader in this assessment.

The IDC MarketScape assesses vendors on two axes: current capabilities and future strategy. That distinction matters right now, because application security is changing faster than most roadmaps were built to absorb.

Attackers stopped treating web applications and APIs as separate problems a long time ago. The same request path now carries browser traffic, API calls, automated clients, and, increasingly, agents acting on behalf of users. Defenses built for one of these rarely hold up against the rest. Closing that gap is what the web application and API protection (WAAP) category exists to do, and it is what we have been building toward.

The IDC MarketScape defines WAAP as a “converged security solution”; that is, web application firewall (WAF), API security, bot management, and distributed denial-of-service (DDoS) mitigation operating together as a unified security platform rather than as a collection of point solutions.

Protection that’s accurate enough to leave on

When a critical vulnerability becomes public, the open window for mass exploitation is often measured in hours. Rapid Rules was built to close that window by rapidly deploying zero-day WAF protections across our network.

The IDC MarketScape cited, “Virtual patches for high-profile vulnerabilities roll out to full deployment within 3 hours once validated; the company cites a typical time to protection of 8–12 hours from disclosure, with examples such as the React/Next.js RCE, an on-prem SharePoint RCE, and a Magento ‘PolyShell’ exploit patched before mass exploitation.”

Speed only helps if protections are accurate enough to leave on. The IDC MarketScape identified this as an Akamai strength:

“Akamai reports an out-of-the-box WAF/API false-positive rate of ≤ 0.0000247% in the company's internal testing.”

“Akamai reports an out-of-the-box WAF/API false-positive rate of ≤ 0.0000247% in the company's internal testing.”

“The company notes that over 93% of customer WAF policies are running in fully automatic (hands-off) mode.”

“The company notes that over 93% of customer WAF policies are running in fully automatic (hands-off) mode.”

“In a third-party comparative benchmark the company cited, Akamai passed 100% of false-positive tests versus 70% as the market standard.”

“In a third-party comparative benchmark the company cited, Akamai passed 100% of false-positive tests versus 70% as the market standard.”

We see accuracy as the more meaningful measure. Protections that teams must routinely disable or bypass to keep the business running are not delivering the outcomes that they need.

Akamai’s accurate protection draws on an intelligence base that is difficult to replicate. We observe roughly 30% of daily global Domain Name System (DNS) lookups and analyze more than 700 TB of data daily, feeding a shared loop across WAF, API, bot, and DDoS detection.

APIs, bots, and agents on the same path

AI adoption has changed what application traffic looks like. Machine-to-machine calls, agent-driven workflows, and automated decision systems generate patterns that do not resemble human behavior, and they reach sensitive data and core business logic through APIs.

The IDC MarketScape noted “gRPC support has been added since the 2024 assessment, and API security now spans discovery, posture management, runtime protection, and preproduction testing as a single life cycle. Akamai also offers source code–based capabilities, including preproduction API discovery, AI/MCP endpoint tagging, code-to-runtime mapping, framework and language support, and reduced remediation time (MTTR).”

Akamai Firewall for AI addresses threats specific to AI and AI-enabled applications, including prompt injection, sensitive data exposure, and AI-directed denial of service. Akamai Bot & Agent Control extends how organizations identify and manage the automated clients that reach their applications.

The direction we are building toward is to understand how these interactions work together: not just whether a request is malicious, but also what is making the request, what it is reaching, what preceded it, and whether the interaction should be trusted at all.

Protection and resilience that follow the application

Applications no longer live in one place. A single business service might run partly at the edge, partly in a data center, and partly across several clouds. Protection that covers only one of those paths leaves inconsistent controls and fragmented visibility.

Akamai App & API Protector Hybrid extends the same WAF and DDoS engine into on-premises containers, reverse proxies, NGINX environments, and multicloud deployments.

Availability is part of application security, too. According to the IDC MarketScape, “Akamai AAP [App & API Protector] is powered by its Adaptive Security Engine (ASE), a behavioral DDoS mitigation engine, AI-powered WAF, bot detection engine, and API security engine, delivered from Akamai's globally distributed edge network and off-CDN solutions such as Akamai App & API Protector Hybrid and Akamai API Security.” Behavioral DDoS protections add behavioral detection designed to identify application-layer attacks that may never cross conventional rate-based thresholds.

Where we are taking this next

The IDC MarketScape also recognized “an aggressive, achievable 18-month road map” in addition to “delivering on previous road map commitments.”

Looking ahead, one of the areas that we believe will increasingly require an ecosystem approach is agent identity and trust. Agent identity will be an ecosystem problem before it is a product problem. No single vendor will determine how an agent proves who it is acting for, or how a business decides what that agent is permitted to do. That is why we are building our agentic security framework alongside partners including Skyfire, Visa, Experian, Auth0, and TollBit.

What this recognition represents to us

The IDC MarketScape writes that “Akamai AAP [App & API Protector] provides organizations with a breadth of capabilities for defending the web applications and interfaces that power the modern digital business, with an emphasis on critical business use cases when efficacy matters and enterprise-grade support affects security outcomes and business goals.”

In our view, being named a Leader for the second time in this market reflects what customers keep asking us to deliver:

Protection accurate enough to automate

Protection accurate enough to automate

Intelligence built from internet-scale visibility

Intelligence built from internet-scale visibility

Resilience against both application exploits and sophisticated Layer 7 DDoS attacks

Resilience against both application exploits and sophisticated Layer 7 DDoS attacks

Coverage that follows applications wherever they run, and a platform increasingly built to understand applications, APIs, automation, and AI as part of the same security problem

Coverage that follows applications wherever they run, and a platform increasingly built to understand applications, APIs, automation, and AI as part of the same security problem

Building a roadmap matters. Delivering it matters more. We are grateful to the customers whose feedback continues to shape both.

About the Author(s)

Stas Neyman

Stas Neyman is a senior marketing leader specializing in cybersecurity. As Director of Product Marketing at Akamai, he oversees the $1.5B Application and API Security portfolio, shaping positioning, messaging, and growth strategy across App & API Protector (WAAP), API Security, Firewall for AI, and bot management solutions. Before Akamai, Stas built the Product Marketing function at Noname Security (acquired by Akamai) and led Product Marketing for CyberArk’s Workforce Identity portfolio. Earlier in his career, Stas drove product marketing and go-to-market initiatives at Amazon Web Services (AWS) and HP, helping launch and grow multiple high-impact security and enterprise mobility offerings.