Blindspot WAAP

Blindspot WAAP is a Web Application and API Protection platform that inspects and filters HTTP traffic without acting as an inline proxy. Instead of routing traffic through a third-party edge, it uses a lightweight sidecar agent deployed alongside the application server. The agent extracts request metadata and sends it to Blindspot's cloud engine, which returns an allow or block decision in under 1ms. SSL termination remains on the customer's infrastructure. Detection Pipeline (35+ stages): - Request validation: size limits, header count, URI length - Protocol enforcement: HTTP method whitelisting, protocol version, content-type - IP reputation: 6 threat intelligence feeds, botnet IPs, Tor exit nodes, anonymous proxies - Geo and ASN filtering: country-level blocking, ASN-based policies, regional rate limits - Rate limiting: per-IP, per-endpoint, sliding window counters - Bot detection: 215+ bot signatures, browser fingerprinting, behavioral analysis, challenge-response - Injection detection: SQL injection (libinjection + regex), XSS, path traversal, command injection - API protection: GraphQL inspection, gRPC analysis, OpenAPI schema compliance, BOLA/IDOR detection - Data protection: mass assignment blocking, credit card DLP (Luhn), SSN/PII filtering, response body inspection - Business logic: flow enforcement, session validation, account takeover detection, credential stuffing protection Deployment modes: - Cloud WAAP: DNS-based routing with global PoPs - Hybrid Sidecar: agent runs alongside the application, SSL keys remain on-premises - On-Premise: full stack in customer data center, air-gapped environments supported - Kubernetes Ingress Controller: Helm chart deployment, auto-scaling Operational tools: - Policy templating for multi-site management - Decision replay against historical traffic - Canary deployments and shadow policy testing - Automated false positive learning via ML - Real-time dashboards - 7-year audit trail for compliance