The API security landscape
API security as a category was established by a first generation of platforms that analyze API traffic out-of-band, typically by mirroring traffic from a load balancer, API gateway, or service mesh. Salt Security, Akamai API Security (formerly Noname Security), and Traceable are among them. This approach made API security deployable without code changes and remains a strong fit for many organizations.
Cerberus takes a different architectural approach: in-app instrumentation. The two approaches make different trade-offs.
Out-of-band traffic analysis
Strengths: deploys without touching application code; works across heterogeneous backends; well-understood operational model.
Trade-offs: relies on inference from traffic shape rather than the application's own context; sensitive data flows through the analysis layer in raw form, which lengthens privacy and vendor review; tying behavior to a specific user across services often requires correlation work after the fact.
In-app instrumentation (Cerberus's approach)
Strengths: detection runs on the actual request and response context the application sees; identifiers are hashed at the source so raw PII never leaves the environment; behavior, identity, and intent are tracked at the user level by default; cross-customer threat intelligence is possible without raw identifiers crossing environments; agentic AI traffic and MCP tool calls fit the same instrumentation model natively.
Trade-offs: requires instrumentation to be installed in the application runtime.
Which approach fits
If your priority is broad coverage of legacy services with no application-side changes, an out-of-band traffic analyzer is a reasonable fit. If your priority is detection fidelity, user-level attribution, keeping raw PII inside your environment, or native handling of agentic AI and MCP traffic, in-app instrumentation is the architectural fit. Cerberus is the platform built around it.
For the architectural detail behind in-app instrumentation, see why Cerberus is built this way.