Akto for CISOs
What middleBrick covers
- Risk scoring A–F with prioritized findings
- Black-box scanning with no agents or SDKs
- Coverage aligned to PCI-DSS, SOC 2, OWASP API Top 10
- Authenticated scans with strict header allowlists
- LLM adversarial probes and API inventory checks
- CI/CD integration and continuous monitoring
Risk visibility and scan workflow
The tool surfaces an overall risk score graded A to F and prioritizes findings so that engineering teams can act on the most critical issues first. Black-box scanning requires no agents, SDKs, or code access; it operates through read-only methods such as GET and HEAD, with text-only POST for LLM probes, and completes in under a minute.
OpenAPI specifications in versions 3.0, 3.1, and Swagger 2.0 are parsed with recursive $ref resolution, and findings are cross-referenced against the spec to identify undefined security schemes or deprecated operations. This workflow supports both unauthenticated scans and authenticated scans when domain ownership is verified through DNS TXT records or an HTTP well-known file.
Coverage aligned to major frameworks
Findings map directly to PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023). Detection includes authentication bypass attempts, JWT misconfigurations such as alg=none or expired tokens, security header misconfigurations, and OWASP API Top 10 categories like BOLA, BFLA, and excessive data exposure.
Additional coverage spans input validation issues like CORS wildcards and dangerous HTTP methods, rate-limiting indicators such as missing or weak rate-limit headers, and data exposure patterns including PII, Luhn-validated card numbers, and API key formats for AWS, Stripe, GitHub, and Slack. Encryption checks evaluate HTTPS redirects, HSTS, and cookie flags, while SSRF probes target URL-accepting parameters and internal IP detection.
Authenticated scanning and safety controls
Authenticated scanning supports Bearer tokens, API keys, Basic auth, and cookies. Domain verification ensures that only the domain owner can run scans with credentials, and a strict header allowlist forwards only Authorization, X-API-Key, Cookie, and X-Custom-* headers.
Safety is enforced through read-only methods only; destructive payloads are never sent. Private IPs, localhost, and cloud metadata endpoints are blocked at multiple layers. Customer data is deletable on demand and purged within 30 days of cancellation, and it is never sold or used for model training.
LLM and API inventory management
The scanner includes specific checks for LLM and AI Security, executing 18 adversarial probes across Quick, Standard, and Deep tiers. These probes target system prompt extraction, instruction override, DAN and roleplay jailbreaks, data exfiltration, token smuggling, and other multi-turn and indirect prompt injection techniques.
Inventory management assessments identify missing versioning, legacy path patterns, and server fingerprinting. OpenAPI analysis highlights discrepancies between the specification and runtime behavior, such as sensitive fields that are over-exposed or missing pagination definitions.
Product integrations and monitoring
The Web Dashboard centralizes scan results, score trends, and branded compliance PDF exports. The CLI, distributed as an npm package, supports commands such as middlebrick scan <url> with JSON or text output.
GitHub Actions integration allows CI/CD gating that fails the build when the score drops below a chosen threshold. The MCP Server enables scanning from AI coding assistants, and the Pro tier adds scheduled rescans, diff detection, email alerts rate-limited to one per hour per API, and HMAC-SHA256 signed webhooks with auto-disable after five consecutive failures.