The most expensive doors in a company are often the ones nobody put on the floor plan. In modern software, those doors are APIs: little contracts that let a mobile app fetch a balance, a retailer confirm an order, or a partner pull the right record. They look tidy in a diagram. In production they multiply, linger after projects die, expose sensitive fields and accept millions of perfectly valid-looking requests. Salt Security built its business on a rude observation: knowing a door exists is not the same as knowing who is casing it.
Roey Eliyahu and Michael Nicosia founded Salt in 2018 after watching applications break into smaller, API-driven pieces. Their wedge was not another scanner that knocked once and reported a loose hinge. Salt copied API traffic out of band, inventoried endpoints and data, and used machine learning to understand behavior across users, calls and time. A request could be syntactically clean and still belong to a patient attacker testing object IDs for three weeks. Context, not a signature, was the product.
What failed first: the old security map
Web application firewalls were built to catch familiar attack shapes such as SQL injection. API gateways authenticate callers, apply routes and enforce quotas. Both remain useful. Neither was designed to understand a company's peculiar business logic across a long sequence of legitimate requests. A thief who asks the right endpoint the wrong series of questions may never trip a classic rule.
That was Salt's opening. Its platform discovers active APIs, including forgotten “zombie” versions and unofficial “shadow” endpoints; classifies the data moving through them; flags posture problems such as sensitive responses without authentication; and builds behavioral baselines for attack detection. Findings can flow to ticketing, SIEM, WAF and cloud tools. The architecture can stay out of the request path for observation, then trigger blocking through systems the customer already runs.
The customer list explains the design. Banks, airlines, retailers, healthcare providers and software companies have sprawling estates, sensitive records and enough traffic to hide reconnaissance in the crowd. Salt publicly references organizations including Scotiabank, Standard Bank Group, Solaris, Luxottica, Armis, Equinix, Finastra and DeinDeal. Its demo material says U.S. Bank secured 2,300 APIs on the first day of deployment. The buyer is usually a CISO, application-security leader, platform team or DevSecOps group that suspects its inventory spreadsheet is fiction.
The money arrived before Salt asked
The company raised a $20 million Series A in June 2020 and a $30 million Series B six months later. By May 2021, it said revenue had grown 400 percent in a year and API traffic under protection had risen 380 percent. Investors kept emailing. Nicosia later wrote that the team had enough money and no time to raise. They changed their minds and accepted a $70 million Series C led by Advent International, with Alkeon Capital and DFJ Growth participating.
Nine months later, CapitalG led a $140 million Series D at a $1.4 billion valuation. In total, the disclosed rounds add to roughly $270 million. The bill for customers is less visible: Salt does not publish enterprise pricing. Contracts are quoted, often after a demo or attack-surface assessment. This is classic enterprise security economics. The price varies with scale and deployment; the sales argument is that an unknown API and a breached record cost more.
A platform assembled around one stream
Salt has packaged that telemetry in several ways. Pepper, its named AI layer, was extended across discovery, posture and threat detection in 2024. Illuminate arrived in 2025 as a quicker path to useful visibility, pitched in minutes rather than months. Surface looks from the public internet inward, giving a security team the attacker's version of its API estate. Autonomous Threat Hunting searches for quiet business-logic campaigns without waiting for an analyst to form the perfect query. These are not unrelated gadgets. Each asks a different question of the same evidence: what exists, what is exposed, what looks abnormal and what deserves action now?
That shared evidence is also how Salt fits into an enterprise stack. It is not trying to replace the gateway that routes traffic, the WAF that blocks common payloads, Jira, Splunk or the cloud itself. Integrations with AWS, Azure, CrowdStrike and Cloudflare let Salt sit between visibility and response. This is useful positioning for a security buyer who has already purchased plenty of boxes. Salt can argue that the missing item is not another enforcement point, but the context that tells existing enforcement where to aim.
Then the clients stopped being human
By 2025, Salt's original object had acquired a new caller. AI agents use models to decide, MCP servers to connect, and APIs to fetch data or change systems. Prompt filters can inspect what a model says. They cannot see the downstream API call that sends an email, updates a customer record or moves money. Salt renamed that territory the “action layer” and widened its map.
The 2026 Agentic Security Platform maps those relationships in an Agentic Security Graph. Agentic Security Posture Management inventories connections and permissions; Agentic Detection and Response watches runtime behavior. Salt Code pushes policy in the opposite direction, into Cursor, Claude Code, GitHub Copilot, Codex and other coding assistants through MCP. The same governance idea can guide generated code, CI/CD checks and production behavior. In July, Salt said its Policy Hub had passed 100 pre-built policies. In August, it put API- and MCP-aware managed rules directly into AWS WAF through AWS Marketplace.
This is both coherent and risky. Coherent, because APIs remain the hands of the agent and Salt already owns years of behavioral machinery. Risky, because “agentic security” is a noisy new market where every cloud and security vendor wants a flag. Salt must prove that its graph is more than a handsome inventory and that behavioral context produces fewer false alarms, faster investigations and safe enforcement. The first API-security pitch was concrete. The new one has more nouns.
What a builder can steal
Salt's best lesson is not “add AI.” It is to choose a data advantage that survives category changes. API telemetry powered discovery, posture and runtime threat detection. The same stream can now reveal agent connections and actions. Products changed; the compounding context did not.
The Salt playbook, minus the $270 million
- Find the layer incumbents treat as plumbing, then make its hidden behavior visible.
- Deploy beside the critical path first. Low-risk observation earns access and produces an inventory quickly.
- Use discovery as the sales wedge. Showing a prospect what it does not know is stronger than a generic fear pitch.
- Integrate with the tools customers already use for blocking, tickets and investigation.
- Expand around the same proprietary context. Do not throw away the signal every time the market learns a new acronym.
Where it works - and where it does not
Salt makes the most sense when API complexity has outrun manual governance: many development teams, clouds, gateways, old versions, sensitive data and enough traffic for abuse to hide over time. It becomes more relevant when AI agents can act across those systems and nobody can draw the full permission chain. Financial services, retail, healthcare, SaaS and large digital businesses fit that shape.
| Condition | Likely fit | Why |
|---|---|---|
| Thousands of changing APIs | Strong | Automated inventory and behavioral context replace a brittle catalog. |
| Agents touching production systems | Emerging | The graph links model, MCP, identity, permission and API activity. |
| Small, static API estate | Weak | A gateway, careful schema management and testing may cover the risk more cheaply. |
| No team to act on findings | Weak | Visibility without ownership becomes another dashboard and another queue. |
It will not work merely because traffic is large. Salt needs representative telemetry, integrations and people empowered to fix posture gaps or block abuse. Heavily regulated organizations may prefer hybrid handling so sensitive data stays in their environment. Tiny teams may find the platform's breadth and custom contract disproportionate. Behavior models also need time and context; brand-new systems with little traffic offer less history to learn from.
The market around Salt now stretches from dedicated API-security vendors such as Cequence, Traceable, Akto and APIsec to broader products from Akamai, Cloudflare, Imperva, F5 and the cloud platforms. The differentiation is the through-line: discovery, posture, long-window behavior and, now, an agent-to-API graph under one policy layer. The test is no longer whether Salt spotted the API wave early. It did. The test is whether the company can make an AI agent's permissions and behavior as legible as an endpoint on its dashboard.
There is a pleasing circularity here. Salt began by telling companies their software had doors they could not see. Eight years later, the doors are being opened by machines that may not have names, desks or predictable workdays. The pitch is still inventory plus intent. Only the visitor has changed.