APIsec for IoT / OT

What middleBrick covers

Black-box scanning with no agents or SDK integration
Risk score A–F with prioritized findings under one minute
12 OWASP API Top 10 categories including LLM security
OpenAPI 3.0/3.1 and Swagger 2.0 parsing with ref resolution
Authenticated scans with header allowlists and domain gate
Continuous monitoring with diff detection and alerts

Black-box coverage for constrained devices

middleBrick is a self-service API security scanner designed for environments where deploying agents is impractical. You submit a URL and receive a risk score from A to F with prioritized findings. The scanner operates in read-only mode using GET and HEAD methods plus text-only POST for LLM probes, completing in under a minute. This approach suits IoT and OT endpoints that cannot accept SDKs or runtime instrumentation.

Detection aligned to industry frameworks

The scanner detects 12 security categories aligned to OWASP API Top 10 (2023). It maps findings to PCI-DSS 4.0 and SOC 2 Type II through direct coverage of authentication, encryption, and input validation controls. Detection includes authentication bypass, JWT misconfigurations such as alg=none, BOLA and IDOR via sequential ID enumeration, BFLA and privilege escalation attempts, data exposure including PII and API key patterns, SSRF probes targeting internal endpoints, and unsafe consumption surfaces. The OpenAPI parser supports versions 3.0, 3.1, and Swagger 2.0 with recursive $ref resolution, cross-referencing spec definitions against runtime behavior.

LLM and AI security testing

The scanner includes LLM / AI Security testing with 18 adversarial probes across Quick, Standard, and Deep tiers. Probes exercise system prompt extraction, instruction override, DAN and roleplay jailbreaks, data exfiltration, cost exploitation, encoding bypasses, translation-embedded injection, few-shot poisoning, markdown injection, multi-turn manipulation, indirect prompt injection, token smuggling, tool abuse, nested instruction injection, and PII extraction. These tests help you surface risks specific to AI-enabled interfaces without performing intrusive exploit activities.

Authenticated scanning and safety constraints

Authenticated scanning is available from Starter tier onward, supporting Bearer tokens, API keys, Basic auth, and cookies. Domain verification is enforced through DNS TXT records or an HTTP well-known file, ensuring only the domain owner can scan with credentials. The scanner forwards a restricted allowlist of headers and blocks private IPs, localhost, and cloud metadata endpoints at multiple layers. Findings related to compliance requirements can be supported for audit evidence, and scan data is deletable on demand and never used for model training.

Product options and monitoring

The Web Dashboard centralizes scans, report downloads, and score trends with branded compliance PDFs. The CLI via the middlebrick npm package supports JSON and text output, and the GitHub Action can gate CI/CD when scores drop below a threshold. The MCP Server enables scanning from AI coding assistants. Pro tier adds scheduled rescans at six-hour to monthly intervals, diff detection for score drift, email alerts limited to one per hour per API, HMAC-SHA256 signed webhooks, and Slack or Teams notifications. Enterprise tiers provide unlimited APIs, custom rules, SSO, audit logs, SLAs, and dedicated support.

Frequently Asked Questions

Does this replace a human pentester for IoT environments?

No. The scanner detects and reports with remediation guidance, but it does not replace a human pentester for high-stakes audits or business logic issues that require domain understanding.

What standards does the scanner directly map findings to?

It maps findings directly to OWASP API Top 10 (2023), PCI-DSS 4.0, and SOC 2 Type II. For other frameworks, it supports audit evidence and alignment with described controls.

Can authenticated scans be performed for CI/CD pipelines?

Yes, authenticated scanning is available from Starter tier onward, including header allowlists and domain verification to ensure only authorized scanning of your APIs.

Is sensitive customer data retained or used for training?

No. Customer scan data is deletable on demand, purged within 30 days of cancellation, never sold, and never used for model training.

Does the scanner perform active exploitation like SQL injection?

No. The scanner does not perform active SQL injection or command injection, as those require intrusive payloads outside its scope.