42Crunch for CISO API inventory heatmap

What middleBrick covers

Black-box API scanning with no agents or code access
Risk scoring across 12 OWASP API Top 10 categories
OpenAPI 3.0/3.1 and Swagger 2.0 parsing with $ref resolution
Authenticated scans with strict header allowlists
Continuous monitoring and diff-based alerting
Programmatic access via API client and CLI

Scope and limitations of automated inventory approaches

Automated scanners map API surface by probing reachable endpoints, but they cannot infer business context or data sensitivity without domain knowledge. middleBrick operates as a black-box scanner that submits read-only requests and reports observed behaviors, which helps you prepare for inventory reviews while acknowledging that blind spots remain. Critical business logic flows, data classification, and trust boundaries require human review.

Mapping to compliance frameworks and audit evidence

middleBrick maps findings to OWASP API Top 10 (2023) and aligns with security controls described in PCI-DSS 4.0 and SOC 2 Type II. The scanner surfaces findings relevant to audit evidence for these frameworks by detecting misconfigurations and data exposures. It does not certify compliance, and it should not be referenced as meeting all requirements of HIPAA, GDPR, ISO 27001, NIST, CCPA, or other regulations.

Integration friction and time-to-value for CISO inventory workflows

middleBrick requires no agents, SDKs, or code access, which reduces integration friction in heterogeneous environments. You submit a URL, and the scan completes in under a minute, delivering a risk score and prioritized findings. This supports rapid inventory assessment, though ongoing coverage depends on scheduling and change cadence rather than a one-time heatmap.

Authenticated scanning and credential governance

With Starter tier and above, you can enable authenticated scans using Bearer tokens, API keys, Basic auth, or cookies. Domain verification via DNS TXT record or an HTTP well-known file ensures only the domain owner can scan with credentials. The scanner forwards a strict allowlist of headers and does not attempt to modify or delete resources.

Continuous monitoring and change detection

Pro tier adds scheduled rescans every 6 hours, daily, weekly, or monthly, with diff detection across scans to highlight new findings, resolved findings, and score drift. Email alerts are rate-limited to one per hour per API, and webhooks are HMAC-SHA256 signed, with auto-disable after 5 consecutive failures to prevent notification storms.

Frequently Asked Questions

Can middleBrick replace a human pentester for API inventory?

No. The scanner detects technical misconfigurations and exposures but cannot assess business logic or data classification, which remain the responsibility of security and domain experts.

Does the scanner expose sensitive data during inventory scans?

It only observes what is returned by the API under the provided credentials. Customer data is deletable on demand and is never used for model training.

How are compliance mappings presented in reports?

Findings are mapped directly to OWASP API Top 10 and aligned with security controls described in PCI-DSS 4.0 and SOC 2 Type II. No compliance certifications are claimed.

What happens to scan data after account cancellation?

Scan data is deletable on demand and purged within 30 days of cancellation. The service does not sell data and does not use it for model training.