Trail of Bits vs Wallarm

About Wallarm

Wallarm is an AI security and API security platform that discovers AI workloads, monitors runtime behavior, enforces policy inline, and generates continuous compliance evidence. Wallarm says it secures web applications, APIs, and AI through a single platform that delivers runtime visibility, protection, and governance. Wallarm says its platform reads the whole request instead of scanning for known-bad patterns, stopping disguised attacks on web apps and APIs without blocking real customers.^[6][7][12]

Wallarm says almost every legacy WAF keeps a list of known bad text patterns and matches requests against it. Wallarm unwraps and decodes every request layer before analysis, so encoding tricks that pass pattern-matching firewalls do not get through. Wallarm has no size cutoff, while many WAFs stop reading after a fixed number of kilobytes. Wallarm blocks the malicious session and lets everyone else through.^[7]

Wallarm sells API Security, which discovers APIs and blocks attacks against them in one product, one deployment, one console. API Security covers REST, GraphQL, gRPC, SOAP, and WebSocket, including the APIs behind AI applications and agents. API Security deploys at the load balancer or ingress.^[2][7][8]

AI Hypervisor is the runtime enforcement layer for enterprise AI agents. AI Hypervisor shows every decision agents make, every data boundary they cross and every external call they initiate, and blocks the ones that violate policy. AI Hypervisor deploys as a Kubernetes DaemonSet on EKS and instruments every labeled pod at the kernel using eBPF analysis. AI Hypervisor finds every model provider, MCP tool and agent framework running in a cluster, including ones nobody approved. AI Hypervisor is the Observe and Enforce layer of the AI Control Loop.^[7][9]

Infrastructure Discovery is a continuous, cross-account asset discovery for AWS estates, mapping every API, compute, network, and IAM resource across up to 5,000 accounts. Infrastructure Discovery uses cross-account IAM to scan every AWS account registered, across every region. Infrastructure Discovery maps EC2, EKS, load balancers, API Gateway, Lambda, VPC and IAM. Infrastructure Discovery connects via cross-account IAM and reads the AWS estate continuously, with no per-account credentials stored and no agents to roll out. Infrastructure Discovery surfaces shadow AI within minutes of deployment.^[7][8][10]

Wallarm runs natively in Kubernetes as an Ingress controller, a sidecar, an Istio filter, or an out-of-band eBPF sensor. Wallarm runs on EKS, GKE, AKS, OpenShift, and self-managed clusters in private data centers. Wallarm says its filtering node adds 0.05ms of latency at 1700 requests per second.

On Google Cloud, Wallarm discovers every API running there and blocks API attacks, bots and abuse in real time. Wallarm can be deployed on GKE, Compute Engine or alongside Apigee in minutes. On Google Cloud, traffic is inspected inside the customer's GCP project, and only attack metadata reaches the Wallarm Cloud. The Wallarm policy for MuleSoft adds a layer of API protection to the MuleSoft Anypoint platform.^[6][12][15]

For AI systems, Wallarm says it provides API-first security by protecting AI agents, AI proxies, and APIs with AI features, preventing injection attacks and data leakage, controlling costs, and ensuring secure, compliant operations. Wallarm says AI agents with access to internal APIs and data can bypass LLM guardrails, so security must extend to every Agent API endpoint.^{[3][7][13][14][16]}