Akto

Name: Akto
Brand: Akto

AI Native

AI Agent and MCP Security Solution

Est 2021|Valuation $20M|Raised $13M|7 Ref Customers

LinkedIn 7K|Web traffic 86K|FTEs 22|HQ San Francisco, CA

MarketsApplication Security Testing (AST)

Published Oct 13, 2026

01Common complaints

- If an organization requires a runtime-only, SOC-centric API protection platform with deep behavioral analytics and forensics as the primary requirement, a runtime-first vendor may be a better fit. - If an organization requires publicly verifiable certification artifacts (for example, a directly accessible SOC 2 Type II report via a vendor trust center), this was not apparent in the materials reviewed and will likely require additional vendor engagement. - If a team is new to API security and needs highly guided, low-effort onboarding, review feedback indicates there may be a learning curve and setup complexity. - If an organization relies on specific integrations (for example, BurpSuite workflows) and needs guaranteed integration stability, some users reported integration issues that should be validated with a proof-of-concept.

Deal disqualifiers (poor fit)

The organization requires publicly documented SOC 2 Type II / ISO evidence available without extensive NDA processes.
The organization needs simple, transparent public pricing with minimal variability.
The organization lacks engineering bandwidth to manage integrations and tuning.

Known limitations (from evidence)

The open-source repository lacked a published security policy file and no published advisories were visible in the sources reviewed; this is a potential supply-chain governance concern for some enterprises.
Setup complexity and documentation gaps were recurrent themes in review summaries.

Roadmap / future capabilities

Public messaging indicates investment in AI-based capabilities and source-code-based vulnerability detection. Buyers should validate whether such capabilities are generally available, how they are priced, and what data is transmitted to any AI components.

02Why they buy

Unique selling points supported by evidence

Open-source availability: A public repository under an MIT license enables hands-on evaluation and may reduce lock-in for initial testing.
Connector and CI/CD emphasis: The vendor documents a range of connectors and CI/CD integration workflows that align with shift-left testing patterns.

Unique selling points that are vendor-claimed / require verification

Claims of a very large test library and specific deployment speed claims should be validated through proof-of-value engagements that assess coverage quality, false positive/negative rates, and real deployment duration.
Claims about acting as an extension of customer teams should be validated via reference checks and documented support SLAs.

Where competitors may have advantages

Some competitors have higher market engagement and may have more mature trust center artifacts, audit artifacts, and enterprise controls that are readily accessible.

03Field reports

Review platform signals (G2 and Gartner Peer Insights)

G2: Very highly rated on G2.
Gartner Peer Insights: Summary-level rating information is present; full review text may require a Gartner account.

Positive review themes (what customers like)

Commonly surfaced pros on review sites include claims of ease of use, automation, API testing coverage, and integrations. Examples from reviews include statements that the product simplifies API compliance tasks and that support and integrations were helpful in some deployments.

Negative review themes (what customers dislike)

Despite generally positive ratings, review summaries show recurring themes:

Implementation/setup complexity
Documentation and onboarding gaps
UI/UX and debugging clarity issues
Learning curve for teams new to API security
Specific integration fragility reported in isolated reviews (for example, BurpSuite-related issues)

Community/social proof

An open-source repository exists under an MIT-equivalent license, which supports hands-on evaluation.
The vendor maintains a community forum and other community channels.

Note: This research did not identify extensive high-signal practitioner critiques on public discussion forums in the sources reviewed. A targeted community sentiment analysis is recommended during procurement if community feedback is a priority.

Customer story (vendor-published)

A vendor-published customer story authored by a security engineer at a customer in the health and fitness space describes challenges such as a lack of centralized API collection/inventory, and states Akto was used to: - Build centralized API call collection - Enable request/response inspection and replay (Burp-friendly workflows) - Automate checks for IDOR/authorization issues - Identify some issues earlier than bug bounty reports Critical note: This is a vendor-hosted case study; outcomes are anecdotal and not independently verified. The case study does not provide hard metrics in the reviewed materials.

Additional case studies

Akto lists additional customer case studies that procurement teams should review directly to verify metrics and applicability to their environment.

04Best fit

Company size

Based on positioning, pricing cues, and review personas:

Likely fit: mid-sized to large organizations with a growing API surface area.
Also plausible: mid-sized teams with security engineering capacity that can handle configuration and evaluation (for example, via the open-source option or trial tiers).

Industries

Akto markets to regulated and high-risk verticals such as financial services and healthcare, but public customer lists and vertical-specific references should be validated during procurement.

Roles/personas

Decision makers: CISO (mid-market), Head of AppSec/Product Security, Security Engineering Manager
Implementers: AppSec engineers, DevSecOps, platform/security platform engineers
Stakeholders: API/platform engineering, SRE (for traffic mirroring and runtime stability)

Qualification criteria (good fit)

The organization has many undocumented APIs and can provide traffic (mirroring/gateway logs) for discovery.
The organization can allocate time to configure authentication contexts and integrate CI/CD testing.
The organization values a combined inventory, testing, and compliance-mapping capability in a single tool.

05The pitch

Target market and market positioning

- **Primary buyers:** Application Security (AppSec), Product Security, DevSecOps teams. - **Likely environments:** API-first SaaS, fintech, healthcare, enterprises with many microservices and undocumented APIs. - **Positioning theme:** Shift-left testing and continuous discovery from real traffic, plus optional runtime controls. Evidence of enterprise targeting includes SSO documentation and vendor-published claims of broad enterprise adoption. These vendor-published statements should be treated as unverified unless corroborated independently.

Get a comprehensive analysis of Akto including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →