Akamai Named a Leader in IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment

When a critical vulnerability becomes public, the open window for mass exploitation is often measured in hours. Rapid Rules was built to close that window by rapidly deploying zero-day WAF protections across our network. 

The IDC MarketScape cited, “Virtual patches for high-profile vulnerabilities roll out to full deployment within 3 hours once validated; the company cites a typical time to protection of 8–12 hours from disclosure, with examples such as the React/Next.js RCE, an on-prem SharePoint RCE, and a Magento ‘PolyShell’ exploit patched before mass exploitation.” 

Speed only helps if protections are accurate enough to leave on. The IDC MarketScape identified this as an Akamai strength: 

• “Akamai reports an out-of-the-box WAF/API false-positive rate of ≤ 0.0000247% in the company's internal testing.”

• “The company notes that over 93% of customer WAF policies are running in fully automatic (hands-off) mode.”

• “In a third-party comparative benchmark the company cited, Akamai passed 100% of false-positive tests versus 70% as the market standard.”

We see accuracy as the more meaningful measure. Protections that teams must routinely disable or bypass to keep the business running are not delivering the outcomes that they need.

Akamai’s accurate protection draws on an intelligence base that is difficult to replicate. We observe roughly 30% of daily global Domain Name System (DNS) lookups and analyze more than 700 TB of data daily, feeding a shared loop across WAF, API, bot, and DDoS detection.

AI adoption has changed what application traffic looks like. Machine-to-machine calls, agent-driven workflows, and automated decision systems generate patterns that do not resemble human behavior, and they reach sensitive data and core business logic through APIs.

The IDC MarketScape noted “gRPC support has been added since the 2024 assessment, and API security now spans discovery, posture management, runtime protection, and preproduction testing as a single life cycle. Akamai also offers source code–based capabilities, including preproduction API discovery, AI/MCP endpoint tagging, code-to-runtime mapping, framework and language support, and reduced remediation time (MTTR).” 

Akamai Firewall for AI addresses threats specific to AI and AI-enabled applications, including prompt injection, sensitive data exposure, and AI-directed denial of service. Akamai Bot & Agent Control extends how organizations identify and manage the automated clients that reach their applications.

The direction we are building toward is to understand how these interactions work together: not just whether a request is malicious, but also what is making the request, what it is reaching, what preceded it, and whether the interaction should be trusted at all.

Applications no longer live in one place. A single business service might run partly at the edge, partly in a data center, and partly across several clouds. Protection that covers only one of those paths leaves inconsistent controls and fragmented visibility.

Akamai App & API Protector Hybrid extends the same WAF and DDoS engine into on-premises containers, reverse proxies, NGINX environments, and multicloud deployments. 

Availability is part of application security, too. According to the IDC MarketScape, “Akamai AAP [App & API Protector] is powered by its Adaptive Security Engine (ASE), a behavioral DDoS mitigation engine, AI-powered WAF, bot detection engine, and API security engine, delivered from Akamai's globally distributed edge network and off-CDN solutions such as Akamai App & API Protector Hybrid and Akamai API Security.” Behavioral DDoS protections add behavioral detection designed to identify application-layer attacks that may never cross conventional rate-based thresholds.

The IDC MarketScape also recognized “an aggressive, achievable 18-month road map” in addition to “delivering on previous road map commitments.” 

Looking ahead, one of the areas that we believe will increasingly require an ecosystem approach is agent identity and trust. Agent identity will be an ecosystem problem before it is a product problem. No single vendor will determine how an agent proves who it is acting for, or how a business decides what that agent is permitted to do. That is why we are building our agentic security framework alongside partners including Skyfire, Visa, Experian, Auth0, and TollBit.

The IDC MarketScape writes that “Akamai AAP [App & API Protector] provides organizations with a breadth of capabilities for defending the web applications and interfaces that power the modern digital business, with an emphasis on critical business use cases when efficacy matters and enterprise-grade support affects security outcomes and business goals.” 

In our view, being named a Leader for the second time in this market reflects what customers keep asking us to deliver: 

• Protection accurate enough to automate

• Intelligence built from internet-scale visibility

• Resilience against both application exploits and sophisticated Layer 7 DDoS attacks

• Coverage that follows applications wherever they run, and a platform increasingly built to understand applications, APIs, automation, and AI as part of the same security problem 

Building a roadmap matters. Delivering it matters more. We are grateful to the customers whose feedback continues to shape both.

Access your complimentary excerpt of the IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment, or speak with an Akamai security expert about protecting your applications, APIs, and AI workloads.

Source: IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment, Christopher Rodriguez, September 2026, IDC #US54130626.