IBM API Connect vs. Salt Security API Protection Platform

Based on our experience, IBM API Connect clearly excels in large enterprises navigating complex B2B ecosystems, especially within the Fintech and Banking sectors. Its capabilities are particularly valuable for achieving Open Banking compliance, facilitating the monetization of data and services, and seamlessly operating in hybrid cloud environments. However, it's crucial to understand that IBM API Connect primarily functions as an API management and orchestration tool. This means that backend integrations with providers like databases are best handled by dedicated integration middleware, such as IBM App Connect, allowing API Connect to then securely and efficiently expose those functionalities to external entities.

Salt is highly recommended for anyone who wants to discover, monitor and protect their APIs against various types of attacks. Salt should not be used as a SIEM.

• API discovery feature is very helpful to allow us to scope the work required before diving into things.
• The ability to set permissions and rulesets at a user level is essential to restrict access to specific datasets.
• Ability for external users (those from outside our organisation) to leverage the API in more restrictive manner.

Incentivized

• PII identification in API traffic.
• Divergence between API traffic and documentation (swagger files).
• Potential attacks with information to take counter measures.

• Improvement can come in the interface of the tool, which is sometimes complex and requires a deep understanding of the tool.
• Improving the different levels of access to the playroom could be helpful because product owners and developers need to see other information.
• Publishing API and integration of API can be more straightforward.

Incentivized

• The platform could have more options for exporting detailed data from attackers' dashboards.
• The Attackers dashboard could also have more options of filters in order to support the investigations of the attack.
• The OAS analysis could present a more detailed view of the found issues.

I can honestly say that the availability of the platform has been incredible, with almost no disruptions during the two years of the implementation. Availability is provided through the distributed architecture that may be deployed in multiple zones. We have had almost no cases of unplanned outages, and most maintenance operations were done during planned downtimes.

Incentivized

IBM API Connect and Apigee are both robust API management platforms. IBM API Connect was selected for its strong integration capabilities, hybrid cloud deployment options, and comprehensive analytics. It aligns well with organizations seeking flexibility and control over their API ecosystems, especially when dealing with complex integration scenarios across diverse environments.

Incentivized

We tried controls offered by the IaaS providers but these were hard to manage and did not provide the visibility we wanted. We also protected APIs with a normal WAF but this was only helpful for assets we knew about and API attacks were not caught by the WAF.

• Our company benefited from IBM API Connect's assistance in establishing cooperation with our outside providers and efficiently managing the API. As a result, we were able to expand our vendor ecosystem.
• Additionally, creating APIs and implementing them on the goods was not too difficult. Additionally, we were able to ensure that only appropriate people could publish the APIs following evaluation by using role-based access control.
• Our teams were able to reuse and share departmental APIs and services with each other thanks to the simple, self-service developer site.

Incentivized

• Salt Security API Protection Platform has provided detailed information that is helping us to identify and investigate attacks in our environment