Wallarm API Security & WAAP Platform

Wallarm, Inc. is an application and API security company headquartered in Austin, Texas, led by CEO Shayne Higdon and backed by Toba Capital, Y Combinator and Partech. It protects web applications, APIs and, increasingly, AI agents for companies in payments, fintech, retail, e-commerce and banking.

The Wallarm platform is a unified web application and API protection (WAAP) service organized around discovering, observing, enforcing and governing traffic. It discovers APIs automatically and blocks attacks in real time across REST, GraphQL, gRPC, SOAP and WebSocket, decoding every request layer and inspecting JWTs rather than matching simple patterns. It can run as SaaS Security Edge, inside the customer's VPC, or as a self-managed open-source edge in Kubernetes, inline or out-of-band. Newer modules add AWS infrastructure discovery and runtime enforcement for AI agents. Customers shown on the site include Panasonic, Samsung, Dropbox, Miro, Semrush and RappiPay.

• API discovery: Builds an inventory of APIs from live traffic, including shadow and undocumented endpoints.
• WAAP protection: Replaces legacy WAFs by inspecting full, decoded requests.
• Multi-protocol support: Protects REST, GraphQL, gRPC, SOAP and WebSocket APIs and inspects JWTs.
• Session-based blocking: Blocks malicious sessions rather than whole IP addresses.
• AI agent enforcement: Applies runtime policies to AI agents and their API connections.
• AWS infrastructure discovery: Maps AWS accounts, shadow AI and attack paths using cross-account roles.

An e-wallet provider can protect its payment APIs against credential stuffing and business logic abuse. A bank can deploy the filtering nodes inside its own data center to protect open banking APIs. An online retailer can replace an aging WAF and gain an inventory of all mobile app APIs.

Automatic API discovery shows which APIs are actually exposed, including undocumented ones, so protection covers the real attack surface. Deep request decoding and session-based blocking stop attacks that legacy WAF rules miss while reducing blocking of legitimate users. One policy layer for web apps, APIs and AI agents simplifies operations and audit evidence. Flexible deployment in SaaS, in-VPC or self-managed modes fits banks that must keep traffic inside their own environment.

APIs have become one of the most exploited attack surfaces as mobile apps, partner integrations and AI agents rely on them, and traditional WAFs struggle with API protocols such as GraphQL and gRPC. Payment and banking APIs are under particular pressure. In Vietnam, open banking, e-wallets and e-commerce platforms expose growing numbers of APIs that need discovery and real-time protection.

Wallarm, Inc. is headquartered in Austin, Texas and backed by Toba Capital, Y Combinator and Partech. It holds AWS Security Competency, is sold on AWS Marketplace and received G2 Leader badges for API security in spring 2026. A new leadership team was announced in February 2026.