Imperva to acquire CloudVector: Prioritizing API Protection for Modern Environments

I am excited to announce Imperva has entered into an agreement to acquire CloudVector to advance our mission to protect data and all paths to it. Together, we believe we can change what organizations expect from Web Application and API Protection solutions. There are multiple reasons APIs are at the top of Imperva’s key investment areas, and they are all about the future of applications and the ways they are compromised.

Shadow APIs are the new shadow IT, but riskier

A decade ago, when cloud services for storage and file transfers made collaboration dramatically easier, enterprises immediately recognized the risk. Unauthorized use of personal storage and any other official IT alternatives were labeled “shadow IT” and their detection was prioritized. Gradually, the risk faded as enterprise IT moved to cloud-first approaches and the managed tools were just as convenient as their unmanaged, consumer counterparts.

Shadow APIs do not fade on their own, they expand. In today’s world, application development teams move quickly to respond to business needs. When APIs are published without security review and controls they present a risk in addition to their benefit. Probing attackers can use them to access your organization’s data. Imperva recognizes this problem and firmly believes that automatic API discovery is a necessity for combatting this growing risk of shadow APIs.

Applications have changed and so has lateral movement

Like shadow APIs, you cannot protect all paths to data without looking at how much the technology has changed in the data center and cloud. It was difficult enough to defend against lateral movement when it was primarily done via network scans, server access, and stolen credentials. Public-facing APIs, shadow or not, represent the entry point aspect of the API attack surface. However, as applications have shifted their makeup to microservices and APIs, gaining access to one application after another can be done entirely via APIs.

Often described as ‘east-west’ traffic, from its networking origins, movement within the data center and cloud is notoriously difficult to monitor. Network-based and log-based UEBA solutions have both developed their own approaches to detecting lateral movement, but APIs are outside of their detection capabilities. Imperva sees this new form of east-west traffic as key to protecting critical data from attacker behavior as the future attack chain evolves.

Automated deployment demands autonomous protection

New APIs are modified and rolled out every day as development teams add new features and find efficiencies. At this pace, security teams are doomed to fail if they rely on traditional communications to learn of all APIs exposing them to potential attacks. Manually checking the breadth of APIs for broken objects or misconfigurations for eventual remediation is too slow.

Imperva strongly believes application security cannot rely on the hope that a security team can manually create rules as fast as attacks are publicly shared. This is why our threat research team tracks attacks in the wild and creates protections across thousands of environments. It is why our Advanced Bot Protection automatically adapts to behavioral indicators. And it is why we believe our customers will benefit from API protection that uses machine learning to assess new behavior, evaluate against risk-based policies, and determine appropriate action.

CloudVector is an innovator in API Protection

CloudVector already has customers using its technology to protect over 3 billion API calls per day. Imperva is excited by the potential of what we will be able to do together with CloudVector’s API blueprints, deep data layer anomaly detection, and autonomous protection policies. This acquisition will further our vision of protecting all paths to data.