Akamai Named a Leader in the IDC MarketScape 2026 for Web Application and API Protection

Akamai has been named a Leader in the IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment. This is the second time Akamai has received Leader recognition in this assessment, highlighting its capabilities in protecting modern web applications, APIs, and digital services.

Application security is evolving rapidly. Organizations must protect web applications, APIs, automated clients, and AI agents that increasingly interact with business-critical systems. Traditional security tools designed to address individual threats may leave gaps when these interactions overlap.

Web Application and API Protection (WAAP) addresses this challenge by bringing multiple security capabilities together in a unified platform. IDC MarketScape defines WAAP as a converged security solution that combines web application firewall (WAF), API security, bot management, and distributed denial-of-service (DDoS) mitigation.

For organizations operating across cloud, on-premises, and hybrid environments, this integrated approach can help improve security visibility, simplify protection, and strengthen application resilience.

Accurate Protection Against Emerging Threats

When a critical vulnerability becomes public, attackers may begin exploiting it within hours. Security teams must respond quickly while avoiding false positives that could disrupt legitimate business traffic.

Akamai App & API Protector includes Rapid Rules, which enables the rapid deployment of WAF protections across Akamai's network to help organizations respond to newly discovered vulnerabilities.

According to the IDC MarketScape assessment, validated virtual patches for high-profile vulnerabilities can reach full deployment within three hours. Akamai reports a typical time to protection of 8–12 hours from vulnerability disclosure, with examples including React/Next.js remote code execution (RCE), an on-premises SharePoint RCE, and a Magento PolyShell exploit protected against before mass exploitation.

Speed alone is not enough. Security controls must also be accurate enough to operate without constant manual intervention. The IDC MarketScape highlighted several metrics reported by Akamai:

• Low false-positive rate: Akamai reports an out-of-the-box WAF and API false-positive rate of no more than 0.0000247% in its internal testing.
• Automated policy management: More than 93% of customer WAF policies are reportedly operating in fully automatic mode.
• Comparative testing: In a third-party comparative benchmark cited by Akamai, its solution passed 100% of false-positive tests, compared with a reported market standard of 70%.

These results emphasize the importance of effective, accurate protection. Security controls that frequently need to be disabled or bypassed to maintain business operations can undermine an organization's security objectives.

Akamai's approach is supported by extensive internet-scale visibility. The company observes approximately 30% of daily global Domain Name System (DNS) lookups and analyzes more than 700 TB of data daily. This intelligence contributes to a shared detection and protection framework spanning WAF, API security, bot management, and DDoS mitigation.

Securing APIs, Bots, and AI Agents

The growing adoption of AI is changing the nature of application traffic. Machine-to-machine communications, AI-driven workflows, and automated decision-making systems generate traffic patterns that differ from conventional human interactions. These systems often access sensitive information and business-critical functionality through APIs.

The IDC MarketScape assessment highlighted the development of Akamai's API security capabilities since the 2024 assessment, including gRPC support and coverage across the API security lifecycle:

• API discovery and inventory
• API posture management
• Runtime API protection
• Preproduction testing
• Source-code-based API discovery
• AI and Model Context Protocol (MCP) endpoint tagging
• Code-to-runtime mapping
• Support for different programming languages and frameworks

These capabilities help organizations improve API visibility, identify potential weaknesses earlier, and connect development-stage findings with runtime security.

Protecting AI Applications

Akamai Firewall for AI is designed to address threats targeting AI-enabled applications, including prompt injection, sensitive data exposure, and AI-directed denial-of-service attacks.

As AI systems become more integrated into business processes, organizations need to understand not only whether a request is malicious, but also which entity is making it, which resources it can access, and whether the interaction should be trusted.

Akamai Bot & Agent Control extends this approach by helping organizations identify and manage automated clients accessing their applications.

Together, these capabilities reflect the growing need to protect human users, APIs, automated bots, and AI agents within a consistent application security strategy.

Consistent Protection Across Hybrid and Multicloud Environments

Modern applications rarely operate in a single environment. A business service may span edge infrastructure, on-premises data centers, and multiple cloud platforms. Security controls that cover only one part of this architecture can create inconsistent policies and fragmented visibility.

Akamai App & API Protector provides application and API security capabilities, while Akamai App & API Protector Hybrid extends protection to environments such as on-premises containers, reverse proxies, NGINX deployments, and multicloud infrastructures.

This approach helps organizations apply security controls across distributed application architectures while supporting different infrastructure and deployment requirements.

Application Availability and DDoS Resilience

Application security also depends on availability. Distributed denial-of-service attacks can disrupt services, affect customer experiences, and impact revenue, even when attackers do not exploit a software vulnerability.

According to the IDC MarketScape assessment, Akamai App & API Protector combines several security engines and capabilities, including:

• Adaptive Security Engine (ASE)
• AI-powered web application firewall
• Behavioral DDoS mitigation
• Bot detection
• API security

These capabilities are delivered through Akamai's globally distributed edge network and complementary solutions for environments outside its content delivery network, including hybrid deployments and API security capabilities.

Behavioral DDoS protection can help identify application-layer attacks that may evade conventional defenses based primarily on traffic volume or fixed rate thresholds. This is particularly important for protecting business-critical applications against attacks designed to resemble legitimate user activity.

Looking Ahead: The Future of Application and Agent Security

The IDC MarketScape assessment also recognized Akamai's roadmap, describing it as an aggressive and achievable 18-month plan while noting the company's delivery against previous roadmap commitments.

One emerging challenge is establishing identity and trust for AI agents. As agents increasingly interact with digital services and perform actions on behalf of users or organizations, businesses need reliable ways to determine who an agent represents and which actions it is authorized to perform.

This is an ecosystem challenge that requires collaboration across security, identity, payments, and digital trust providers. Akamai is developing its agentic security framework alongside partners including Skyfire, Visa, Experian, Auth0, and TollBit.

As agentic AI adoption expands, organizations will need security strategies that address agent identity, authorization, accountability, and the protection of applications and APIs accessed by autonomous systems.

What the IDC MarketScape Recognition Means

The IDC MarketScape assessment states that Akamai App & API Protector provides a broad set of capabilities for defending the web applications and interfaces that power modern digital businesses, with an emphasis on critical business use cases, protection efficacy, and enterprise-grade support.

Being named a Leader for the second time highlights several areas of Akamai's application security approach:

• Accurate protection: Security controls designed to reduce false positives and support automation.
• Internet-scale threat intelligence: Extensive visibility that informs detection and protection capabilities.
• Application resilience: Protection against application exploits, malicious automation, and sophisticated Layer 7 DDoS attacks.
• Hybrid and multicloud coverage: Security capabilities designed to support applications wherever they run.
• Security for evolving workloads: An approach that increasingly addresses applications, APIs, bots, and AI agents as connected parts of the security landscape.

For organizations, these capabilities can help support a more unified approach to application security while reducing the operational complexity associated with managing multiple disconnected security tools.

Learn More About Akamai WAAP Solutions

Organizations evaluating web application and API security can explore the Akamai App & API Protector solution and its capabilities for protecting applications, APIs, and digital services.

The complimentary excerpt of the IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment provides additional information about the assessment and its findings.

Softprom is an official Akamai distributor. Contact Softprom to discuss Akamai application and API security solutions and evaluate the options that best fit your organization's infrastructure, security requirements, and business objectives.