Seismic proves exploitability across 500+ APIs at a fraction of the cost

The challenge

As Seismic moved from a browser-based product to an API-driven model, its most sensitive surface moved with it. Point-in-time tests and traditional scanners reached only 10 to 20 percent of its APIs, yet manual testing still cost roughly $200,000 a year.

What they did

Seismic adopted apisec to make exploitability, not test frequency, the measure of coverage. apisec onboarded the APIs from their Swagger definitions, rebuilt the application model on every change, and continuously generated attacks grounded in Seismic's own business logic, RBAC and ABAC paths, injection, and application denial of service.

The outcome

Within 24 hours apisec was proving which paths were exploitable. Over three months it drove remediation of 300+ exploitable issues, cut testing cost by 80% (about $160,000 a year), and halved mean time to detect and respond.

About Seismic

Company: Seismic
Founded: 2010
Industry: Sales and Marketing Enablement
Mission: Our mission is our reason for being, and it encapsulates what we’re trying to accomplish as a company. A lot of thought, debate, and consideration went into selecting these three words. We ultimately selected we because our mission isn’t just one person or a faceless organization — it’s all of us together. Ignite is a dynamic word that has a cause and effect. And growth spans personal and professional; individual, team, and business; as well as revenue.

As a leader in sales and marketing enablement, Seismic transitioned from a browser-based application to an API-driven model to meet growing customer demands. This change required enhanced security measures to protect confidential client information.

Business Challenge: Expensive, Incomplete Application Security

Seismic faced several challenges as they evolved to an API-driven model:

• Managing new security risks associated with APIs.
• Traditional scanners and manual penetration tests only cover 10-20% of APIs.
• High costs of manual penetration testing, approximately $200,000 per year.

Despite frequent manual penetration tests, Seismic realized the need for a more comprehensive and cost-effective solution.

Key Challenges:

• Addressing new security risks with the API-driven approach.
• Reducing the high costs of frequent manual penetration testing.
• Achieving broader API security coverage.

The Solution: Automated and Integrated Application Security

Seismic partnered with apisec to automate and enhance their application security. apisec's AI-driven platform provided comprehensive security testing, revealing business logic flaws and other vulnerabilities.

apisec's Contributions:

• Initial API risk discovery scanning was completed in just 24 hours.
• Seamless deployment into the staging environment without disrupting CI/CD workflows.
• Continuous updating of attack vectors as APIs evolved.

apisec automated the entire process, from onboarding APIs using the Swagger definition file to executing new attack vectors, and the API feature map was rebuilt with each update.

‍

The Business Impact: A Wide Range of Vulnerabilities Revealed Rapidly, For a Fraction of the Cost

Application Security Coverage:

• Number of APIs covered: 500+
• Frequency of automated tests: Continuous

Cost Savings:

• Reduction in manual pen-testing costs: 80%
• Annual savings: Approximately $160,000

Vulnerability Detection:

• Number of vulnerabilities detected and remediated: 300+ in the first three months
• Types of vulnerabilities detected: Business logic flaws, RBAC, ABAC, Application DoS attacks, injection flaws

Deployment Speed:

• Time to deploy apisec: <1 month
• Initial API risk discovery time: 24 hours

Operational Efficiency:

• Reduction in security-related testing needed: 90%
• Number of actionable reports findings: 10+ per month

Developer Productivity:

• Time saved on security testing: 90% reduction in manual efforts
• Reduction in developer security support requests: 60%

Compliance:

• Compliance standards maintained:  SOC2

Incident Response Improvement:

• Reduction in the mean time to detect (MTTD) and mean time to respond (MTTR): 50%

Customer Confidence:

• Increase in customer confidence: Measurable improvement in client feedback regarding data security

Sensitive Data Secure

“Our customers ask us what we are doing to protect their sensitive data on Seismic, and once they see what we have done with apisec, their confidence in us grows”
— Tim Dzierzek, VP of Information Security, Seismic

Cost-Effective Security

“With APIsec continuously working in our staging environment, we eliminated the need for dynamic scanning and costly manual penetration tests. apisec paid for itself in just three months, providing enterprise-grade application security at a fraction of the cost.”
— Tim Dzierzek, VP of Information Security, Seismic

Proactive Security Coverage

“The apisec team is a great partner to work with on the journey of securing our APIs. They partner with us to continue to increase the coverage and security of the API.”
— Tim Dzierzek, VP of Information Security, Seismic

Looking Ahead: Sustaining Security Excellence

Seismic is committed to maintaining and enhancing its application security practices by focusing on the following:

• Expanding Testing Coverage: Broadening the scope of application security tests to cover new functionalities and services.
• Enhancing Automation: Increasing automation in security processes to reduce manual intervention and accelerate response times.
• Continuous Training: Investing in ongoing training for development and security teams to stay updated with the latest security practices and threats.
• Collaborating with apisec: Leveraging new features and updates from apisec to enhance their security posture.

By prioritizing these areas, Seismic aims to maintain robust protection of their APIs, ensuring the highest standards of security and reliability for their customers.

‍