Wallarm vs Salt Security: runtime WAAP vs discovery-first API security
Wallarm when the primary gap is stopping OWASP web and API attacks inline with a cloud-native WAAP. Salt Security when the gap is inventorying shadow APIs, governing posture, and assessing the surface before traffic is fully under control.
API risk work fails in the same three stages every week: an endpoint that is not in the gateway inventory, a posture gap still open after the last review, and a request that should have been stopped before it reached the service.
Salt Security enters earliest. First-party discovery and Illuminate packaging center continuous inventory of shadow, zombie, and third-party APIs, posture governance against policy frameworks, and active surface assessment, with behavioral detection on the same platform. Wallarm enters hardest at runtime. Its cloud-native WAAP is sold as one inline engine for OWASP Top 10, OWASP API Top 10, bots, account takeover, and L7 DDoS, with Wallarm claiming 88% of customers run full blocking mode.
Between these two, pick which stage still fails on Monday: inventory and posture, or blocking on the wire. Workflow entry, operator artifacts, and packaging are below.
| Job | Cloud-native WAAP and API protection: inline block for web and API attacks, abuse, and L7 DDoS | API discovery, posture governance, surface assessment, and behavioral threat detection on the API fabric |
|---|---|---|
| How a bad day closes | Malicious or abusive API and web requests are blocked or rate-limited at the node; sessions can be cut without blunt IP bans | Undocumented or overexposed APIs are inventoried and scored; posture violations are governed; behavioral attacks are detected and stopped |
| Day-to-day workflow | Blocked attacks, false-positive reviews, virtual patches, and nodes that need a policy change | New shadow or zombie APIs, Policy Hub findings, Surface assessment hits, and behavioral alerts |
| Deploy | Inline block, out-of-band/mirrored, or trigger other systems across cloud, K8s, edge, on-prem; NGINX, Envoy, Kong, Security Edge, eBPF mirror paths. Modes are not equivalent for enforcement strength | Agentless Cloud Connect / Illuminate for fast inventory; traffic metadata and collectors for deeper runtime; can stop attacks without a mandatory Salt inline proxy. Mirrored or out-of-band detect is not the same as inline block |
| License/pricing | Cloud Native WAAP and Advanced API Security subscriptions; no complete public dollar card verified 30 Sep 2026 | AWS Marketplace Startup $100,000 / Enterprise $250,000 per 12 months by API-call ceiling |
| Who operates it | AppSec and platform teams that own the traffic path and need blocking without a separate bot tool | AppSec and platform teams that still cannot list every API or prove posture across the fabric |
We reviewed first-party Wallarm WAAP and docs subscription pages, Salt Illuminate and Surface announcements, the Salt AWS Marketplace listing, and live community threads on 30 Sep 2026. We did not run either product in a paid tenant, so this is not a hands-on benchmark.
Wallarm
Salt Security
Wallarm’s first-party WAAP story is one engine for web, API, and abuse without requiring a Wallarm CDN. Salt’s Illuminate launch on 3 Jun 2025 is the discovery-and-posture on-ramp: connect cloud sources in minutes, map the API fabric, then layer governance and behavioral controls.
Editions and pricing
Wallarm packages protection by subscription capability. Salt posts public call-volume contracts on AWS Marketplace.
| How you buy it now | Demo / sales for Cloud Native WAAP and Advanced API Security bundles | Sales, or an AWS Marketplace contract for the API Protection Platform |
|---|---|---|
| Public units (30 Sep 2026) | Docs describe Cloud Native WAAP for core web and API protection, and WAAP + Advanced API Security for BOLA controls, API abuse prevention, credential stuffing detection, specification enforcement, and GraphQL policies. No complete public dollar SKU verified on wallarm.com the same day | Startup lists Console Access and Support plus up to 10M API calls/month at $100,000 for 12 months; Enterprise lists up to 100M at $250,000. A dimensions summary on the same page says Startup covers 5M calls; confirm the ceiling on the quote |
| What the invoice covers | Node and console scope, which Advanced API Security controls are enabled, and any Security Edge or adjacent modules as quoted | Call-volume ceiling plus console access and support for discovery, posture, and behavioral detection as listed |
| Self-serve start | Sales-led; Security Edge and Free Tier paths appear in docs for limited edge trials, not a full enterprise WAAP calculator | Marketplace contract dimensions; enterprise packaging stays sales-led |
Model the quote against whether you need inline blocking modules or discovery and posture call volume, not against a third-party “starts at” roundup. Separate Salt Agentic Security Platform marketplace SKUs exist; do not mix those ceilings into the API Protection Platform numbers above.
Where each product enters the workflow
| Inventory stage | API Discovery on the node and console, including auth-flow detection and MCP discovery on recent node releases; discovery supports protection rather than replacing a posture program | Continuous discovery of internal, external, shadow, zombie, and third-party APIs; Illuminate and Cloud Connect aim for minutes-to-inventory without traffic routing |
|---|---|---|
| Posture / test stage | API Specification Enforcement and Schema-Based Testing shift checks earlier; Advanced API Security adds BOLA and GraphQL policy depth | Policy Hub maps findings to frameworks such as NIST, PCI, NYDFS 500, and OWASP; Salt Surface actively assesses internet-facing APIs for hidden endpoints and misconfigurations |
| Runtime stage | Inline WAAP blocking is the center: OWASP web and API threats, bots, ATO, L7 DDoS, virtual patching, API session blocking. Mirrored detect and trigger-other-system paths exist but are weaker than inline block for the same attack | Behavioral AI detects and can stop low-and-slow API abuse, BOLA-style patterns, and exfiltration via its own controls or by triggering other systems; that is not equivalent to classic inline WAAP block mode |
| Who writes the next step | Platform and AppSec owners of the node path decide block, monitor, or virtual patch | Security managers deploy policies; AppSec and owners remediate inventory and posture findings; SOC may consume behavioral alerts |
That Mar 2025 comment names the shadow-API inventory problem Salt sells hardest; it does not score Wallarm. Center the deal on where traffic is observed, where blocking can happen, what deploy change each path forces, and how long response takes after a new endpoint appears.
What operators get back
| Artifact | Blocked or monitored attacks, virtual patches, session blocks, and specification mismatches on protected traffic | API inventory with risk scores, Policy Hub violations, Surface assessment findings, and behavioral threat cases |
|---|---|---|
| Remediation shape | Tune the node path: block mode, rate limits, virtual patches, and Advanced API Security controls | Close shadow APIs, fix auth and overexposure, apply posture policies, and feed owners from discovery context |
| AI / agent side | MCP discovery, MCP sessions, and MCPJail open-source containment for agent tooling on first-party 2026 releases | Illuminate AI agent risk views; GitHub Connect for MCP-related APIs in code; separate Agentic Security Platform packaging on Marketplace |
| Compliance shape | Protection evidence and specification enforcement for APIs already on the traffic path | Continuous posture assessment with framework mappings aimed at audit fatigue reduction |
That Apr 2026 note is one operator’s inventory pain when a WAF already sits on the path; it is not purchasing research. Between these two, Wallarm’s stronger weekly artifact is the blocked request; Salt’s stronger weekly artifact is the API you did not know you owned.
Where they overlap
Both discover APIs, both talk behavioral or abuse detection, and both sell remediation paths rather than a static brochure. An RFP that only says “API security platform” will get two credible responses. The remaining split is whether Monday’s ticket is still “what APIs exist and are they governed,” or “stop this attack class on the wire without another bot product.”
Salt against Escape DAST is Salt Security vs Escape. Escape against contract governance is Escape vs 42Crunch. Broader shortlist context is on API security tools.
When to use both
Most teams will not pay for two full API security platforms covering the same traffic. The narrow split that shows up is Salt owning inventory and posture for sprawl the gateway never listed, while Wallarm owns inline WAAP on the production path. If one team owns both queues, pick the platform that matches the ticket type you already staff.
Choose Wallarm when inline WAAP blocking on the wire for web and API attacks is the primary need. Choose Salt Security when continuous discovery, posture governance, and surface assessment must come before fabric-wide blocking.
FAQs
Is Wallarm only a WAF?
No. First-party pages sell cloud-native WAAP that covers web OWASP Top 10, API Top 10, bots, ATO, and L7 DDoS from one engine, with Advanced API Security controls for BOLA, specification enforcement, and related API threats. Treat it as WAAP and API protection, not a legacy signature-only WAF.
Does Salt replace an inline WAF or WAAP?
Not as a blanket claim. Salt centers discovery, posture, and behavioral detection, and can stop attacks without requiring traffic to route through a Salt CDN or mandatory inline proxy. Inline block, mirrored detect, and “trigger another system” are not equivalent enforcement modes. If you need classic inline WAAP blocking as the primary workflow, Wallarm is the stronger fit between these two.
Where does Escape fit?
Salt Security vs Escape is runtime discovery and protection versus business-logic-aware DAST. This compare is Wallarm WAAP against Salt for protection versus discovery-first posture.
What public prices should buyers note?
Salt’s AWS Marketplace API Protection Platform lists Startup at $100,000 for up to 10M API calls/month and Enterprise at $250,000 for up to 100M per 12 months (dimension table checked 30 Sep 2026; confirm the Startup ceiling because marketplace prose also cites 5M). Wallarm did not show a complete public dollar rate card on paths checked the same day.
