Every European API security platform reviewed
London, United Kingdom
Platform priced per organisation on request; 14-day free trial for the AI coding plugin
Book a demo
Best for: Teams that maintain OpenAPI definitions and want one file to drive testing and enforcement
42Crunch builds its product around the API specification. An audit runs more than 300 static checks on OpenAPI and GraphQL definitions inside the IDE and in CI/CD, a scan sends simulated traffic to the running service and compares the answers with the contract, and a micro-firewall deployed from the pipeline rejects requests whose verb, path, content type or payload shape the contract does not allow. Rate limits can be set per client and per operation.
42Crunch Ltd is a UK limited company, with the parent at an address in Covent Garden, London, according to its privacy policy, and its trust page states ISO 27001. Its current homepage puts governance of MCP servers for AI agents first, so a buyer who wants API testing alone should confirm the roadmap in a demo. The platform has no public price, the AI coding plugin has a 14-day trial, and no hosting region is stated.
What 42Crunch does well
- One contract feeds the audit, the scan and the firewall
- Static checks appear in the IDE and in CI/CD pipelines
- Runtime policy is rebuilt whenever the contract changes
- GraphQL gets the same treatment as REST
- ISO 27001 is stated on its trust page
Where 42Crunch falls short
- Gives less to APIs without maintained specifications
- The platform has no public price list
- Homepage focus has shifted to MCP governance
- No hosting region on the pages we read
Standout feature. 42Crunch is the only tool here that turns a reviewed API contract into an enforcement rule at the gateway.
Florence, Italy
€4,999 buys one penetration test; continuous testing is priced by quote
Book a demo
Best for: Security teams that want attack results on their APIs without waiting for a pentest slot
Equixly replaces the scheduled API pentest with software agents that attack endpoints repeatedly. The vendor says its agents chain calls and workflow steps to expose broken object-level authorization, IDOR and multi-step exploit paths, and that findings are validated by exploitation to cut false positives. A second module inventories APIs, flags undocumented endpoints and classifies personal data in responses.
Equixly S.r.l., named as data controller in its privacy policy, is in Florence, Italy, and the site footer shows an Italian VAT number, ISO 27001 and the Cybersecurity Made in Europe mark. The pricing page lists one fixed offer, a black-box or grey-box penetration test with results in two days for €4,999, and quotes the continuous platform. No trial, hosting region or self-hosted option appears on the pages we read.
What Equixly does well
- Aims at BOLA, IDOR and multi-step logic flaws
- Publishes the cost of one test
- Covers REST, GraphQL and single-page apps
- Can be started from CI/CD
- Footer states ISO 27001
Where Equixly falls short
- Offers no runtime blocking
- No free trial on the pages we read
- The continuous plan has no public price
- Where data is hosted is not stated
Standout feature. Equixly sells a single API penetration test at a stated euro price and a two-day turnaround.
Paris, France
The pricing page carries no figures and all paths lead to booking a demo
Book a demo
Best for: Cloud-native teams whose main API risk is broken authorization rather than known CVEs
Escape attacks a running API the way a tester would, aiming at logic errors such as one user reading another user's data. According to its pages the engine understands GraphQL, replays flows as several different users and attaches fix suggestions to findings. The vendor has since added AI pentesting with a retest step and an attack surface module. Internal networks are not scanned, and we credit it with no source code analysis.
The contracting party is Escape Technologies SAS in France. Its privacy policy gives a street address only in part, so ask procurement to obtain the full registered office. Nothing on the pricing page states an amount: each route finishes at a demo request. A founding year did not appear on the pages we read.
What Escape does well
- Replays flows as several users to catch authorization gaps
- Starts a scan from an API definition
- GraphQL is a supported target
- External pentests come with a retest
- A French SAS, so EU law applies
Where Escape falls short
- No figures on the pricing page
- Only part of a street address in the privacy policy
- Does not scan internal networks
- A demo request is the first step of every purchase
Standout feature. Escape directs its tests at business-logic flaws in APIs, the class of bug that signature-based scanners do not report.
Batley, West Yorkshire, United Kingdom
No price list is published; each licence includes unlimited users
Book a demo
Best for: Teams that want one scanner for APIs, web apps and infrastructure, including signed and token-protected endpoints
AppCheck grew out of an internal penetration testing tool, and its API module builds a model of a service from its schema before crafting tests for each method. It reads REST with JSON, SOAP by WSDL and GraphQL, generates fixture data from Swagger and GraphQL definitions and lists IDOR among its authorization checks. Where many scanners stall, it documents HMAC and AWS v4 request signing, chainable rules for custom signatures, and TOTP and OAuth sessions.
AppCheck Ltd is registered in England and Wales under company number 06888174, with a Batley address, and its privacy policy names it as UK data controller. The same licence covers web applications, infrastructure, CMS and asset discovery, and licences are described as having unlimited users. Prices are not published, the hosting region is not stated, and nothing is blocked at runtime.
What AppCheck does well
- Copes with request signing and OAuth or TOTP sessions
- Reads REST, SOAP and GraphQL
- Builds test data from Swagger and GraphQL schemas
- A single licence spans web and infrastructure scanning
- Companies House number 06888174 is published
Where AppCheck falls short
- Has no runtime protection
- No price list
- No discovery from live traffic is described
- Hosting region is not given
Standout feature. AppCheck documents HMAC and AWS v4 request signing, which most scanners in this category do not.
Ghent, Belgium
Founded 2022
Two users free; paid Basic and Pro fees are billed monthly (a page selector decides the currency, so none is named here)
Free tier without a card
Best for: Small developer teams that want an API scanner next to code and cloud checks, starting free
Aikido Security sells one dashboard for developer security: dependencies, secrets, source code, infrastructure as code and containers, with an API scanner among the modules. The scanner takes Swagger definitions as input, and the vendor adds detection of shadow and zombie APIs, so an undocumented endpoint shows up beside a vulnerable library in the same queue.
Behind it stands Aikido Security BV of Ghent, Belgium, founded in 2022. The company website lists further offices in the US and the UK, a point to raise in procurement. Two users can use the free tier without a card. Paid Basic and Pro fees are monthly, yet a selector on the page decides the currency, so we name none. A data region is not given.
What Aikido Security does well
- A Belgian BV is named as the contracting company
- Two users can begin on the free tier, no card required
- API results appear alongside code, container and cloud results
- Detection of shadow APIs ships with the scanner
Where Aikido Security falls short
- A 2022 founding means a short track record
- US and UK offices are listed next to the Belgian one
- The paid currency depends on a page selector
- Where data is stored is not stated
Standout feature. Aikido Security puts an API scanner, shadow API detection and a free tier inside the same suite as its code and container scanning.
Stockholm, Sweden
Founded 2013
Per year: free Starter for 5 users and 100 assets, then €2,500 (Standard), €5,000 (Professional) and €15,000 (Enterprise)
Book a demo
Best for: Security teams that want recurring external scanning of web apps and APIs at a known price
Detectify checks REST and GraphQL APIs against OpenAPI v2 and v3 specifications and GraphQL schemas, available from its Standard tier, and charts the external attack surface around them. Its payload library partly comes from Crowdsource, a community of over 400 ethical hackers. The result is a list of exposures: Detectify does not read source code, filter traffic or act as a WAF or CDN.
The Stockholm company, Detectify AB, has run since 2013 and cites ISO 27001 and GDPR. Its yearly prices are public. A free Starter tier allows 5 users and 100 assets; Standard at €2,500 stops at 750 assets and 10 users; Professional at €5,000 is where CI/CD integration begins; Enterprise costs €15,000. Customers on paid tiers get a trial tailored to them.
What Detectify does well
- Attack surface mapping and application scanning in one product
- Payloads submitted by 400+ ethical hackers
- REST and GraphQL interfaces are scanned
- A published price ladder from free up to €15,000 a year
- A Swedish company, so EU law applies
Where Detectify falls short
- Reports exposure but does not block attacks
- Standard is limited to 750 assets and 10 users
- CI/CD integration needs Professional
- The jump to Enterprise at €15,000 a year is steep
Standout feature. Detectify lists every price tier, from a free plan to €15,000 a year, a practice that is rare among application security vendors.
London, England, United Kingdom
Free plan; Cloud and Pro by checkout, Enterprise by quote; AI pentests priced from USD 3,500 apiece
Book a demo
Best for: Small and mid-sized teams that want hands-off monitoring of what they expose
Intruder bundles API scanning with cloud checks, container image scans, change detection and AI pentests in one exposure management subscription. Teams upload a schema, run scans on a schedule or from CI/CD and receive issues in Jira. When a port opens or a cloud service is added, the new asset is scanned without anyone asking.
Intruder Systems Ltd is registered in England as number 09529593, according to the site footer, and the homepage says more than 3,000 companies use it. The free plan runs weekly external scans on ports 80 and 443 only; the Cloud plan has a 14-day trial; the page text showed no amounts for paid plans. AI pentests are priced from USD 3,500 each.
What Intruder does well
- Free plan available
- 14-day trial on the Cloud plan
- Detects new assets as they appear
- Plenty of integrations, Jira included
- UK Ltd whose company number is published
Where Intruder falls short
- No supplier ratings
- Paid plan amounts missing from the page text
- Pentests are priced in US dollars
- Free plan restricted to ports 80 and 443
Standout feature. Intruder begins scanning a new asset by itself the moment a port opens or a cloud service shows up.
Bucharest, Romania
Founded 2017
Subscriptions grow with the number of assets, beginning at $96 (NetScan), $140 (AppScan) and $190 (Exploit) a month
Book a demo
Best for: Pentesters and in-house security teams that run their own API tests and need evidence and reports
Pentest-Tools.com sells scanners and exploiters to people who run tests themselves. The API scanner accepts an OpenAPI file or a Postman collection. AppScan covers authenticated DAST, and the Exploit plan adds a CVE exploiter, SQL injection and XSS exploiters and Burp Suite import. The API scanner has a seven-day trial.
PENTESTTOOLS S.A., named in the terms, is a joint stock company in Bucharest, where the about page says it has been headquartered since 2017, and the vendor says it serves over 2,100 customers across 119 or more countries. Plans start at $96 a month (NetScan, 16 assets), $140 (AppScan, 5 assets) and $190 (Exploit, 5 assets). Every plan has API access and unlimited rescans. The report generator costs extra, and managed pentests are estimated per job.
What Pentest-Tools.com does well
- Published prices that follow asset count
- Tools from reconnaissance to exploitation
- Burp Suite import and a report generator
- Romanian S.A. is the contracting entity
- A REST API and integrations on every plan
Where Pentest-Tools.com falls short
- No community of researchers and no triage of reports
- Prices are quoted in US dollars
- The report generator is an extra
- Some capabilities carry a "new" label
Standout feature. Pentest-Tools.com accepts a Postman collection as scan input, which fits teams that keep their API documentation there.
Dublin, Ireland
Founded 2017
No price appears on the pages we read
Book a demo
Best for: Organisations that want automated testing with expert verification and discovery of hidden APIs
Edgescan offers a continuous testing platform whose modules cover attack surface management and web, API, network and mobile testing. Human analysts verify findings before delivery, which the vendor presents as a way to reduce false positives, and its API material mentions discovery of rogue and hidden APIs. A pentest-as-a-service option sits in the same range.
The privacy policy names BCC Risk Advisory Limited as the Irish company trading as Edgescan. The vendor says Eoin Keary founded it in 2017 and lists offices in Dublin and New York. Because that policy concerns the website, the entity on a service contract is unconfirmed. We found no prices and no stated data region.
What Edgescan does well
- Attack surface and testing modules in the same platform
- Analysts verify findings
- Offers pentest as a service
- An Irish company with a registration number
- Dublin headquarters
Where Edgescan falls short
- No prices shown
- No supplier ratings
- A New York office alongside Dublin
- Contracting entity for services unchecked
Standout feature. Edgescan combines discovery of rogue and hidden APIs with human verification of the findings.
Lyon, France
Founded 2014
Each engagement is quoted after a request
Book a demo
Best for: French and European teams that want a human-led API pentest or red team from a French SARL
Vaadata is a pentest firm, and it approaches APIs through people: JWT and OAuth checks, access control tests and a retest once the client has fixed what was found. Other scopes include web, mobile, cloud, LLM systems, infrastructure and IoT, in black, grey or white box mode, plus red team and assumed breach exercises. No platform or bounty programme is sold.
According to its legal notices, VAADATA is a SARL with €36,000 in share capital and a registered office in Lyon (RCS 797 558 590). The about page dates creation to 2014 and states financial independence; the vendor claims over 800 clients. Engagements are quoted. The site exists in French and English, and the notices say its hosting company is Kinsta Inc. in the United States.
What Vaadata does well
- A French SARL with its register number published
- Scope extends to LLM systems and IoT
- Red team and assumed breach exercises exist
- Describes itself as financially independent
- The site is offered in French and English
Where Vaadata falls short
- No bounty and no crowd of researchers
- Prices are not published
- Each engagement is a point in time
- The marketing site is hosted by a US company
Standout feature. Vaadata puts named French testers on API authentication and then retests the fixes.
Stockholm, Sweden
Founded 2015
Community Edition at no cost; paid Standard, Enterprise and Token Handler editions sold as one yearly subscription, price by request
Book a demo
Best for: Teams that need token-based access to partner, app and AI agent APIs on infrastructure they choose
Curity covers who may call an API, not whether the API has bugs. Its identity server issues and controls OAuth and OpenID Connect tokens and supports FAPI, SAML and SCIM, with OpenID Foundation certification for the implementation. A Token Handler edition and the API access material address partners, apps and AI agents.
The company, Curity AB, was founded in Stockholm in 2015 (registration number 559017-0196), and its terms of use dated 30 March 2026 name it as contracting party. It operates no SaaS: its deployment page covers on-premise, single-cloud, multi-cloud and hybrid setups only. Since May 2023 the Danish private equity fund GRO has held a stake of undisclosed size, and Curity's pages mention no ISO 27001 or similar audit.
What Curity does well
- Swedish AB in Stockholm, registration number 559017-0196
- You pick the hosting: on-premise, one cloud, several clouds or hybrid
- OAuth, OpenID Connect, FAPI, SAML and SCIM, OpenID Foundation certified
- Community Edition at no cost, plus a 14-day trial of paid editions
- Flat yearly subscription instead of per-user billing
Where Curity falls short
- Paid edition prices are available only on request
- Free does not mean open source here
- No vendor-run service, so operations fall to you
- No independent audit such as ISO 27001 is mentioned
- A Danish private equity fund holds a stake since 2023, size undisclosed
Standout feature. Curity runs no cloud of its own, so the token layer for your APIs exists only on infrastructure you selected.
