API security without compromise: Introducing flexible new discovery options with F5 API security

Ian DinnoSr. Product Marketing Manager | F5

As organizations continue to modernize, including the integration and adoption of AI, their API ecosystems are expanding at an extraordinary pace—often outstripping the ability of security and operations teams to keep up. The increasing complexity of modern applications, combined with the critical reliance on APIs, makes uncovering and understanding these APIs essential.

API discovery serves as the foundational first step in building and sustaining an effective API security strategy. It allows organizations to better understand and quantify API risk through improved visibility, the development of a centralized, up-to-date API inventory, and robust monitoring capabilities. The insight provided by API discovery enables the establishment of consistent security practices, creating a unified and streamlined approach to API security across an organization’s application ecosystem.

Potential tradeoffs with API discovery

While the benefits of API discovery are indisputable, achieving them isn’t always straightforward. As with most technologies, implementing API discovery shouldn’t have to be a “one-size-fits-all” proposition; organizations have unique requirements and expectations regarding performance, reliability, privacy, and compliance. These varying needs can lead to difficult decisions with potential tradeoffs, particularly when deploying new services like API discovery within existing delivery and security architecture already operating in-line with app and API data paths. Many organizations are concerned with in-line API discovery solutions increasing latency, introducing additional points of failure, or creating further operational complexity that overwhelms their teams.

Performance concerns stem from API discovery tools that operate in-line, adding runtime overhead to application data paths. For high-performance environments in industries such as financial services, e-commerce, and media, even marginal latency increases can be a deal breaker. Additionally, reliability risks arise when in-line solutions create new points of failure, potentially disrupting production traffic if bugs or compatibility issues occur. Operational complexity can also be a significant burden, as these solutions often add dependencies, increase patch cycles, and require extensive compatibility testing.

For these reasons, organizations increasingly look for non-intrusive solutions that seamlessly adapt to their existing architectures without altering data-plane traffic or degrading application performance and stability.

How F5 eliminates tradeoffs with flexible API discovery options

The good news is that with F5’s continued expansion of the F5 Application Delivery and Security Platform (ADSP), organizations no longer have to make these difficult tradeoffs. We have expanded our API discovery capabilities,providing greater choice and flexibility, empowering organizations to adopt API discovery that seamlessly aligns with their unique architectures and operational goals—all without compromising reliability, performance, or security.

Exciting expansions for API discovery

F5’s expanded API discovery options are designed to deliver maximum flexibility and meet organizations where they are. These new capabilities include specialized solutions for BIG-IP, multi-proxy and gateway architectures, and air-gapped environments. Each new option offers tailored benefits to provide organizations choice in how and where API discovery is executed and help eliminate any tradeoffs.

• API discovery for F5 BIG-IP: For organizations leveraging BIG-IP TMOS, we have extend our F5 Distributed Cloud API Security discovery capabilities with out-of-band API discovery options. This enables BIG-IP customers (with versions 15.1 and higher) to inspect API traffic processed through their virtual servers with clear visualization in the Distributed Cloud Services console. Through this integration, BIG-IP customers gain the ability to take full control of their APIs by detecting unknown, shadow, and deprecated APIs, enriching their API inventories with precise and up-to-date documentation, and seamlessly managing API security through a unified solution from a single vendor. (You can see it in action here.)
• API Discovery for F5 NGINX and third-party data planes: Recognizing that API requests often traverse diverse proxies and gateways, F5 has extended its Distributed Cloud API Security discovery capabilities to integrate with NGINX (e.g. NGINX OSS, NGINX Plus) and third-party data planes like Kong and Apigee. This allows organizations to gain complete visibility into their API ecosystem, no matter where APIs are deployed or how requests flow through the infrastructure. These out-of-band deployment options are supported by verified integrations, enabling data collection and API analysis across virtually any gateway or proxy. Organizations can analyze API activity, spot unmanaged or shadow APIs, and visualize their API ecosystem centrally within the Distributed Cloud Services console.
• Deployable software option for API discovery in air-gapped environments: For organizations with data sovereignty concerns that are operating in highly regulated industries or air-gapped environments where sharing data externally is restricted, F5 now offers a fully localized API security option. With this solution, organizations can conduct out-of-band API discovery, monitoring, and detection entirely on-premises, without transmitting any sensitive data to the cloud. This deployable software includes a dedicated console to provide full insight into APIs flowing through an organization’s BIG-IP instances, while meeting the specific compliance and regulatory needs of industries operating under strict security constraints.

These expanded API discovery capabilities enable businesses to detect shadow (unknown), unmanaged, or forgotten APIs, generate OpenAPI schemas and documentation, and maintain API inventories with sensitive data detection and vulnerability insights. By delivering options tailored to diverse environments, F5 ensures that any organization can address evolving API security challenges effectively and seamlessly—without performance, reliability, or compliance tradeoffs.

API security on your terms

API discovery is undeniably the foundation of any API security strategy, and with F5’s broad set of API discovery and security capabilities, organizations can better understand and secure their APIs across increasingly diverse app ecosystems and architectures without compromise. With API discovery as the starting point, organizations can take confident, actionable steps toward safeguarding their APIs today—and into the future.

To learn more, explore F5’s complete set of API security capabilities and take a spin through this short, interactive experience.

For customers interested in any of the API discovery offerings mentioned here, be sure to connect with your local F5 account team for more details.

About the Author

Ian DinnoSr. Product Marketing Manager | F5

More blogs by Ian Dinno