API discovery
The complete inventory of endpoints, learned from the traffic and kept up to date.
VOGO eBS API Security
All your APIs, known, assessed and defended
API — Application Programming Interface, the interface through which applications exchange data. The complete inventory of the APIs, discovered automatically from the traffic, with the sensitive data they expose, the risk of each and the attackers who target them.
Installed at the organisation. Alerts come per attacker, not per isolated anomaly.
- Automatic inventory
- OWASP API Top 10
- Correlation by attacker
VOGO eBS API Security
Governance and protection of the whole API ecosystem
The system learns all API endpoints from the traffic — methods, parameters, data types — without manual configuration, and keeps them up to date: new APIs appear with a notification, abandoned (“zombie”) ones are flagged.
On each endpoint, sensitive and personal data is identified, the risk score is calculated and the organisation’s posture rules are checked, before and after going into production.
Activity spread over several addresses, tokens and devices is linked to the same attacker. The team sees a single actor, with everything it tried, and blocks it.
Inventory. Posture. Detection. Response.
Automatic inventory
The exact number of APIs and the structure of each endpoint, documented from the traffic.
Sensitive and personal data
Predefined and custom classifications, identified in requests and responses, with their exact location.
Risk score
On each endpoint, by protocol, authentication and data exposure, with adjustable weights.
Posture governance
Delivered best-practice rules and custom, composite rules, aligned with PCI, PSD2 and NIST.
Attack detection
BOLA, broken authentication, JWT tampering, OAuth redirection, injections, SSRF, excessive use.
Correlation by attacker
Activity spread over different IDs, addresses and devices, attributed to the same actor.
Automated response
Blocking in the WAF, forwarding to the SIEM, webhooks and multi-step remediation flows.
Separate roles and environments
Custom roles, linked to the identity directory, and separate environments per domain or department.
What makes the product different
Behavioural profile
Each user’s usual patterns, learned from history, separate benign anomalies from exploitation attempts.
Correlation by attacker
The VOGO engine links events to the same actor and raises a single alert, with a summary of the attack.
Masking for analysts
Sensitive data appears in the console as a one-way hash; the analyst investigates without seeing the raw values.
Remediation in Service Desk
Posture deviations and incidents open tickets in VOGO eBS Service Desk, Jira or ServiceNow.
Support, updates and training are provided by VOGO, as the product’s manufacturer.
VOGO eBS API Security — a single integrated product
Sensitive data classification
Personal and sensitive data in requests and responses, with their exact location.
The posture engine
The risk score, the governance rules and the continuous monitoring of deviations.
The detection engine
OWASP API Top 10 attacks and correlation of activity by attacker, with the behavioural profile.
VOGO eBS API Security Console
The inventory, alerts, investigation and automated response, in a Romanian-language web console.
The product uses as mature open-source libraries: Akto and OpenSearch.
Frequently asked questions
What is VOGO eBS API Security?
It is the VOGO product for API governance and protection: it discovers and inventories the APIs, assesses their risk and posture and detects the attackers who target them.
Why “by attacker” and not by anomaly?
A real attack spreads over many requests, addresses and identities. Correlating them to the same actor reduces the number of alerts and the investigation time, and allows blocking the source, not a single request.
Is it a VOGO product?
Yes. VOGO eBS API Security is an integrated product, developed, licensed and supported by VOGO, with VOGO modules, console and support. The product uses as mature open-source libraries: Akto and OpenSearch.
Where does it run?
On premise, in the organisation’s infrastructure. API traffic is not sent outside it.
Request a demo
See how VOGO eBS API Security works
Request a demo on your organisation’s APIs.
Note: The services are provided in line with the European DNSH principle – “Do No Significant Harm”, in accordance with Article 17 of Regulation (EU) 2020/852 on the establishment of a framework to facilitate sustainable investment and with the European Commission’s technical guidance on the application of the DNSH principle, C/2023/111.