Migrating from APIsec to Nessus

This guide outlines the practical steps and gaps to consider when moving API security scanning from APIsec to middleBrick. The focus is on data export, rebuilding scan history, and preserving CI/CD wiring while setting realistic expectations about feature coverage.

Begin by exporting findings from APIsec in a structured format such as JSON or CSV. Map severity levels and issue types to middleBrick categories aligned to OWASP API Top 10 (2023), noting that exact taxonomy matches are uncommon. Use scripts to normalize tags like broken authentication and excessive data exposure so that historical dashboards can be rebuilt with consistent groupings.

For authentication-related findings, include method details and affected endpoints. For PII and key exposure findings, preserve confidence indicators and evidence snippets to support downstream triage in the middleBrick dashboard.

Import normalized findings into middleBrick and create custom labels that correspond to your previous severity scheme. Use the dashboard to recreate trend lines by date, focusing on recurring categories such as BOLA IDOR, BFLA privilege escalation, and unsafe consumption patterns.

Note that middleBrick does not automatically backfill historical scans. You will need to establish a baseline by running initial scans and then rely on scheduled rescans to build a continuous record. Over time, scan accuracy improves as the scanner refines detection signals across your API surface.

Replicate your CI/CD gates by configuring the middleBrick CLI in your pipelines. Use middlebrick scan <url> with JSON output to parse results and fail builds based on score thresholds or specific finding types.

middlebrick scan https://api.example.com/openapi.json --output json | jq '.score, .findings | length'

For environments that used APIsec webhooks, replace those with signed webhooks from middleBrick Pro. Ensure the receiving endpoint validates HMAC-SHA256 signatures and handles retries after transient failures.

middleBrick focuses on black-box detection and does not perform active SQL injection or command injection testing that APIsec may have supported. Business logic vulnerabilities and blind SSRF are also outside the scope of automated scanning and require human expertise.

Compliance coverage is framed as alignment rather than certification. The scanner helps you prepare for SOC 2 Type II and validates controls from OWASP API Top 10 (2023), but it does not map directly to HIPAA, GDPR, ISO 27001, NIST, or other regulatory frameworks. Use findings as audit evidence where relevant, and apply custom rules in Enterprise tier to address organization-specific requirements.