Akto for Compliance officers

What middleBrick covers

Black-box API scanning with a risk score in under one minute
Detection aligned to OWASP API Top 10 (2023), PCI-DSS 4.0, SOC 2
Authenticated scans with Bearer, API key, Basic auth, and Cookie
OpenAPI 3.0, 3.1, and Swagger 2.0 parsing with $ref resolution
CI/CD integration via GitHub Action and MCP Server support
Continuous monitoring with diff detection and HMAC-SHA256 webhooks

Mapping findings to compliance frameworks

middleBrick maps findings directly to PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023). Each detected issue includes a reference to the specific control or requirement it relates to, enabling audit teams to trace evidence without manual cross-walks.

Workflow for compliance officers

Compliance officers can initiate a scan by submitting an API endpoint URL. Within under a minute, the scanner returns a risk score from A to F and a prioritized list of findings. Reports can be downloaded as PDFs that include control references, making it straightforward to assemble audit evidence or to feed results into governance dashboards.

Authenticated scanning and domain verification

For authenticated scans, Supported credentials include Bearer tokens, API keys, Basic auth, and Cookies. Before credentials are accepted, a domain verification gate confirms ownership through a DNS TXT record or an HTTP well-known file. The scanner only forwards a limited allowlist of headers, including Authorization, X-API-Key, Cookie, and X-Custom-*, to reduce credential exposure.

Limitations and complementary testing

middleBrick does not fix, patch, block, or remediate issues; it detects and reports with remediation guidance. It does not perform active SQL injection or command injection testing, does not detect business logic vulnerabilities, and does not detect blind SSRF. It is not a replacement for a human pentester on high-stakes audits, and it does not certify compliance with HIPAA, GDPR, ISO 27001, NIST, CIS, CCPA, NIS2, DORA, FedRAMP, DPDP, APPI, PDPA, PIPEDA, PIPA, UK DPA, LGPD, SOX, GLBA, FERPA, or similar frameworks.

Team ergonomics and integrations

The platform supports a CLI for local runs, a web dashboard for tracking score trends over time, and a GitHub Action that can fail CI/CD builds when the score drops below a defined threshold. Pro tier adds scheduled rescans, diff detection, email alerts, HMAC-SHA256 signed webhooks, and compliance reports to integrate scanning into existing engineering pipelines without requiring code access or SDKs.

Frequently Asked Questions

Can the scanner certify my API is compliant?

No. The scanner detects and reports findings; it does not certify compliance. Use its output as audit evidence, but rely on your internal audit process and qualified assessors for certification.

How does authenticated scanning keep credentials safe?

Credentials are only accepted after domain verification, and the scanner forwards a restricted set of headers. No agents or code access are required, and customer scan data can be deleted on demand and is purged within 30 days of cancellation.

Does the scanner test for SQL injection or command injection?

No. It does not perform active SQL injection or command injection tests, which require intrusive payloads outside the scope of this black-box scanner.

Can continuous monitoring alert me to new issues?

Yes. Pro tier supports scheduled rescans and diff detection that surfaces new findings, resolved findings, and score drift, with email alerts rate-limited to one per hour per API.