Nov 3, 2022

- Advertisement - APIs are increasingly making the rounds of the world — but they also represent a major vulnerability for determined cyber attackers, warns security platform Ecto. The California-based start-up, which is announcing a $4.5 million seed funding round today, thinks it has the answer. - Advertisement - For beginners, an application programming interface (API) is a piece of software that enables two different computer programs to talk to each other – think of a retailer when you pay for something. or request your details from your bank to avail price comparison service. Quotes from websites of car insurance companies. That’s why APIs are important as the world interacts more and more digitally. - Advertisement - Ankita Gupta, co-founder of Acto, explains that the problem is that cybercriminals are willing to target these links between different programs. “APIs constantly fetch data from one place and move it to another, and they are extremely vulnerable when doing so,” she says. “Some of that data may be harmless – but what if it’s your confidential personal details, or your payment information?”. This is not a useless warning. A recent report notes a 700% increase in API attack traffic over the past year, while market research specialist Gartner thinks APIs will become the most used attack vector for cybercriminals by 2022. A recent high-profile breach, in which 9.8 million consumer data records were exposed at Australian telecoms business Optus, has been widely blamed for API weakness. - Advertisement - “That’s what we’re trying to solve,” says Gupta. “As of now, there is no automated security solution for API security – our plug-in-and-play platform closes that gap. “ The company argues that Ecto’s platform provides two important services. First, once it’s installed, it will identify every API your business is exposed to. Gupta explains that one problem with many businesses is that they can’t keep track of all the APIs they’re connected to through relationships with other organizations and developers. So Ecto will provide a quick directory of these links, rather than wasting IT valuable time trying to stay abreast of them. Second, the company maintains a constantly updated list of known API vulnerabilities and vulnerabilities; Its software then scans customers’ APIs for any of these problems and provides fixes where it finds them. In an ideal world, says co-founder Ankush Jain, customers would use Ecto’s platform before agreeing to deploy the partners’ APIs — and thus would already face problems. But the platform can also be used to scan APIs already in use for vulnerabilities – and to keep scanning APIs when the list of known vulnerabilities is updated. “It is better to identify these issues at the earliest,” says Jain. “But you need to keep scanning to stay on top of the problem.” Acto founders Ankush Jain and Ankita Gupta act Launched late last year, Ecto is working with customers on a closed beta basis, although it has already done over 100,000 API scans for customers around the world. Users say part of its appeal is that the platform can be up and running very quickly, scanning a customer’s API exposure within minutes of installation. The next step for Ecto is to launch commercially. It will operate as a software-as-a-service business, offering a free “community” version of its platform to those who only need limited functionality and have a limited number of APIs. The “Team” and “Enterprise” versions of the Platform will bear a monthly subscription fee. “We want to launch the largest API security platform in the world in the next few years,” says Gupta. He believes that Ecto’s community could attract 10,000 new joiners by the end of the first quarter of 2023. The growth plan will be supported by the additional financial firepower that today’s seed round gives the company. The $4.5 million is coming from Accel India, which is leading the round, as well as a group of angel investors, and is earmarked for further product development as well as reaching the market. “APIs are pervasive – they are the glue that enables any software to provide rich functionality – but until recently, not much thought was given to securing them,” says Prank Swarup, a partner at Excel India. “Acto’s approach and technology provide a reliable, scalable, easy-to-install and accurate API security solution.”