CyanoRisk API Security Posture Management
cyanofabric.com
What it is
CyanoRisk API Security Posture Management is a self-hosted platform for discovering, inventorying, classifying, mapping, and continuously assessing REST, GraphQL, gRPC, and SOAP APIs. It evaluates APIs against the OWASP API Top 10, including authorization, authentication, mass assignment, injection, and resource-consumption weaknesses. The platform identifies shadow and zombie APIs, classifies regulated or confidential data, and flags over-exposure. Its knowledge graph links APIs with applications, databases, identities, gateways, threats, vulnerabilities, tickets, compliance, and business services. Risk scores combine OWASP findings, exposure, data sensitivity, and business dependency. It assesses OAuth, API keys, tokens, scopes, and gateway policies, including rate limiting and throttling. Findings can be assigned to owners and developers with SLAs and closure evidence. CyanoRisk runs on customer infrastructure and networks, under customer keys, with no telemetry or phone-home. CyanoAI analysis stays inside the deployment. Pricing is available on request.
Spec sheet
- Intended users
- The API page identifies CISOs, AppSec, API and platform, DevSecOps, identity, compliance, application-owner, and executive teams as audiences.Read 9 Oct 2026 · cyanofabric.com
- Deployment
- The platform says it runs on the customer's infrastructure and network, with no telemetry or phone-home.Read 9 Oct 2026 · cyanofabric.com
- Integrations
- The site names Tenable, Qualys, Rapid7, and CrowdStrike as scanner-ingest sources.Read 9 Oct 2026 · cyanofabric.com
- Compliance
- The API page says posture maps to PCI DSS, DPDPA, GDPR, ISO 27001, and internal policy.Read 9 Oct 2026 · cyanofabric.com
- Headquarters
- The site lists CyanoFabric Private Limited's registered office in Jakkur, Bengaluru, Karnataka, India.Read 9 Oct 2026 · cyanofabric.com
- Company
- The site identifies the maker as CyanoFabric Private Limited and lists its registered office in Bengaluru, Karnataka, India.Read 9 Oct 2026 · cyanofabric.com
- Access and audit
- The platform describes role-based access control and a tamper-evident audit trail for changes.Read 9 Oct 2026 · cyanofabric.com
- API context
- The product page says APIs are connected to data, identities, and business services.Read 9 Oct 2026 · cyanofabric.com
- API discovery
- The product is described as finding internal, external, shadow, zombie, and deprecated APIs across gateways, traffic, code, and cloud.Read 9 Oct 2026 · cyanofabric.com
- API risk posture
- The platform describes API posture in terms of authentication and exposure.Read 9 Oct 2026 · cyanofabric.com
- Authentication and gateways
- The product assesses OAuth, API keys, tokens, scopes, and gateway policies, and identifies missing rate limiting, throttling, and abuse protection.Read 9 Oct 2026 · cyanofabric.com
- Data exposure
- It classifies regulated, personal, financial, or confidential data handled by APIs and flags over-exposure.Read 9 Oct 2026 · cyanofabric.com
- Data intake controls
- Bulk data changes require independent approval before taking effect.Read 9 Oct 2026 · cyanofabric.com
- Data processing
- The site says CyanoAI analysis runs inside the deployment and customer data is not sent to an external service for processing.Read 9 Oct 2026 · cyanofabric.com
- Example scale
- The product page displays 4,820 APIs discovered, including 1,240 internet-facing APIs and 168 shadow and zombie APIs.Read 9 Oct 2026 · cyanofabric.com
- OWASP assessment
- It assesses APIs against the OWASP API Top 10, including authorization, authentication, mass assignment, injection, and resource-consumption weaknesses.Read 9 Oct 2026 · cyanofabric.com
- Platform deployment
- The maker says CyanoRisk runs on the customer’s infrastructure and network, under the customer’s keys, with no telemetry or phone-home.Read 9 Oct 2026 · cyanofabric.com
- Platform scope
- CyanoRisk says it combines 43 product modules in one platform.Read 9 Oct 2026 · cyanofabric.com
- Product scope
- CyanoRisk API Security Posture Management discovers, inventories, classifies, maps, and continuously assesses REST, GraphQL, gRPC, and SOAP APIs.Read 9 Oct 2026 · cyanofabric.com
- Proof of concept
- The site describes a six-week proof of concept on infrastructure provisioned by the customer.Read 9 Oct 2026 · cyanofabric.com
- Remediation
- Findings can be routed to owners, developers, and gateway changes with SLAs and closure evidence.Read 9 Oct 2026 · cyanofabric.com
- Risk context
- The API knowledge graph connects APIs with applications, databases, identities, gateways, threats, vulnerabilities, tickets, compliance, and business services.Read 9 Oct 2026 · cyanofabric.com
- Risk scoring
- API risk scoring combines OWASP findings, exposure, data sensitivity, and business dependency into a risk score.Read 9 Oct 2026 · cyanofabric.com
- Security controls
- The maker describes role-based access control, a tamper-evident audit trail, rate-limited sensitive operations, and independent approval for bulk data changes.Read 9 Oct 2026 · cyanofabric.com
- Support and evaluation
- The maker describes a six-week commissioning proof of concept on customer-provisioned infrastructure, including installation, data ingestion, user acceptance testing, and acceptance sign-off.Read 9 Oct 2026 · cyanofabric.com
- Threat feeds
- The platform says it syncs CISA KEV, NVD, FIRST EPSS, OSV, and GHSA daily.Read 9 Oct 2026 · cyanofabric.com
Strong points and limits
Strong points
- Discovers REST, GraphQL, gRPC, and SOAP APIs
- Assesses against the OWASP API Top 10
- Classifies sensitive data and over-exposure
- Runs analysis inside customer deployment
- Includes role-based access and tamper-evident audit trails
Limits
- Paid pricing is available only on request
- Requires customer infrastructure and network deployment
- No external telemetry or phone-home means customer-managed operation
- Six-week proof of concept requires provisioned infrastructure
Who it suits
CyanoRisk suits CISOs, CIOs, security engineers, DBAs, application owners, DPOs, and auditors managing API risk. It is intended for organizations able to deploy software on their own infrastructure.
Verdict
CyanoRisk provides broad API inventory, posture assessment, risk scoring, and remediation workflow in a customer-controlled deployment. Its scope fits organizations needing API security analysis alongside data and business context.
Where Specifiction places it
- Cyber Risk Quantification (CRQ) Tools#1 of 87.8
- Application Security Orchestration Platforms#8 of 237.7
- API Security Software#14 of 307.4