Web Attack Protection
A WAF inspects requests for injection, cross-site scripting and other common attack patterns.
Web app and API protectionWAAP
Protect Web Apps and APIs From Attacks, Bots and Application-Layer Floods
Customer problem
Attacks Hide Inside Valid Requests
Customers reach you through web applications and APIs. So do attackers, with injection payloads, bots that stuff credentials, and floods that slow endpoints down.
Some requests are valid but ask for data the caller should not see, such as a user changing an ID to read another customer's record.
A network firewall sees little of this, because the attack sits inside HTTP.
- Injection and cross-site scripting attacks
- Business-logic abuse such as BOLA
- Bots running credential stuffing and scraping
- Application-layer floods that slow services
- Forged, expired or replayed tokens
- Fast-changing endpoints, GraphQL and mixed hosting
THE COSGRID SOLUTION
API-Aware Protection in One Engine
API QShield combines a web application firewall, API-specific controls, bot scoring and application-layer flood protection in one engine. It inspects each request in context and applies your policy, to help keep public-facing services available and harder to abuse.
With API QShield, organisations can
- Reduce exposure to common web attacks with a WAF
- Enforce API schemas so unexpected requests are refused
- Score bots and rate-limit abusive clients
- Validate client certificates and JWTs at the edge
- Deploy as SaaS, ingress, sidecar, appliance or VM
How It Works
Place QShield in Front
Choose a deployment mode that fits: SaaS, Kubernetes ingress, or VM.
Load Specs and Set Policy
Import API specifications, or generate them first with QShield Discover. Choose WAF rules, schema, token and certificate checks, bot actions and rate limits.
Inspect Every Request
Each request is checked against the WAF, API schema, token and certificate rules, bot scoring and rate limits.
Allow, Challenge, Limit or Block
Passing requests reach the application. Others are handled by policy. Review logs and tune policy to reduce false positives.
Key Benefits
API Schema Enforcement
Unexpected endpoints, methods, parameters and payloads can be refused.
BOLA Detection
Helps detect and limit attempts to reach other people's objects.
Bot and Flood Controls
Bot scoring and per-endpoint rate limits help reduce credential stuffing, scraping and L7 floods.
Token and Certificate Checks
mTLS and JWT validation refuse invalid credentials before the application sees the request.
Runs Where You Run
SaaS, Kubernetes ingress, sidecar, appliance or VM, including self-hosted environments.
Traditional WAF vs API-Aware WAAP with QShield
Traditional WAF
- Looks for known attack patterns
- Treats APIs like web pages
- Little insight into business-logic abuse
- Bots handled separately, if at all
- Rate limiting often coarse
- GraphQL treated as ordinary POST traffic
- Often tied to one hosting model
API-Aware WAAP with QShield
- Adds API schema, token and certificate checks to WAF rules
- Understands endpoints, methods, parameters and payloads
- Documents BOLA / IDOR detection
- Bot scoring in the same engine
- Application-layer flood controls per endpoint or client
- GraphQL-specific controls
- SaaS, Kubernetes ingress, sidecar, appliance or VM
Use cases
Built for every application scenario
Reduce credential stuffing on banking APIs
A bank protects its mobile and web banking APIs with schema enforcement, token validation and bot scoring to reduce credential stuffing.
Keep checkout responsive under load
A retailer uses rate limiting and bot scoring to reduce inventory hoarding and keep checkout responsive.
Verify partners before requests go further
A fintech requires mutual TLS from partners and validates their tokens before requests reach internal services.
Baseline protection for every new service
A platform team deploys QShield at the Kubernetes ingress, so every new service gets the same baseline protection.
Who Is This For
No API specs yet? See "Find every API you expose, including the ones nobody documented"
- CISOs
- Application Security Teams
- Digital & Product Heads
- Platform Engineering Teams
- Internet-Facing App Owners
FAQs
Have a question about web app and API protection with API QShield?
What is WAAP?
WAAP stands for Web Application and API Protection. It combines a web application firewall with API-specific security, bot management and application-layer DDoS protection.
How is QShield different from a WAF? A WAF looks for known attack patterns. QShield includes a WAF and adds API schema enforcement, token and certificate validation, BOLA detection, bot scoring, GraphQL controls and rate limiting in the same engine.
What is BOLA, and can QShield stop it? Broken Object Level Authorisation is when a user can reach another user's data, often by changing an ID in a request. QShield helps detect and limit these attempts. The lasting fix is correct authorisation in the application, and QShield works alongside it.
