PingOne from Ping Identity vs. Salt Security API Protection Platform

Really like [this] solution, it fits our requirements 100%. There are unlimited possibilities to extend the product, either by creating additional adapters or selectors. We really like the policy management level in PingFederate. It's extremely helpful when we can specify customer journey per many different requirements like user location, application type etc. As well, both StepUp and TopDown authentication flows were implemented [easily].

Salt is highly recommended for anyone who wants to discover, monitor and protect their APIs against various types of attacks. Salt should not be used as a SIEM.

• Based on open standards, we can use as much or as little of the Ping suite as we like, depending on which other technologies we've already implemented.
• Continuous innovation and product enhancements have ensured their products continue to meet our rapidly evolving needs.
• Ping Identity has been an outstanding partner, starting with the RFP process and continuing to this day, years after the sale. They are focused on our success at every level of the company and are highly responsive to our needs, issues, and product suggestions.

• PII identification in API traffic.
• Divergence between API traffic and documentation (swagger files).
• Potential attacks with information to take counter measures.

• PingID has some limitations when used as the MFA for some LDAP implementations. You need to use it as a RADIUS password credential validator to solve for some of those limitations, which in turn causes challenges with our ephemeral cloud deployment model of PingFederate.
• The basic logon services within PingFederate are adequate and well-documented, but simple features like disabling user input after entering credentials would help with some of the additional customization required to support real world failure modes.
• PingCentral authorization models and configuration remain unpolished compared to other products, and now the features seem to be shifting toward onboarding PingAccess and PingDirectory over improving baseline administrative functionality/operations.

Incentivized

• The platform could have more options for exporting detailed data from attackers' dashboards.
• The Attackers dashboard could also have more options of filters in order to support the investigations of the attack.
• The OAS analysis could present a more detailed view of the found issues.

Ping's solutions are a powerful tool, but with that comes the need for skills to operate them. It's not easy for inexperienced engineers to run. From the end-user perspective, it is fully customizable and can be as seamless as you need.

Incentivized

Really good customer support, we always receive what we need. Sometimes instead of [a] solution (which have to be developed) we are receiving [a] work around, which is helping ad hoc. Then after time [needed for support to] develop fix we are receiving full fix or we [are] just waiting for new version of the product where our "bugs" are fixed.

PingOne from Ping Identity is the clear winner here. I can say this because the cost of their service is very worth it, and their service offers more than their competitors. In addition to that, this software is still improving daily, which only means that there is still more to come, and their Developers are giving their fair share of service to keep their software the best.

Incentivized

We tried controls offered by the IaaS providers but these were hard to manage and did not provide the visibility we wanted. We also protected APIs with a normal WAF but this was only helpful for assets we knew about and API attacks were not caught by the WAF.

• The TCO for our deployment of Ping will be over a million dollars/year less to operate compared to the systems it replaces.
• Moving the organization to federated protocols allows greater flexibility in our cloud migration strategy and zero trust designs.
• Operating with federated protocols internally facilitates M&A and divestiture activities.

Incentivized

• Salt Security API Protection Platform has provided detailed information that is helping us to identify and investigate attacks in our environment