API Security Success Without Escalating Cloud Costs or Compliance Risks

Buchi Reddy B

CEO and Founder at Levo

As a former Engineering Director, I can attest that most engineering leaders want to equip their teams with the best security tooling, especially for urgent and easily exploitable attack surfaces. 

However, many vendor partnerships fail due to poor architecture choices, compliance issues, or a high TCO.

These experiences taught me that an effective security tool must solve problems efficiently and affordably. 

It's not just about whether the product solves a problem but how it goes about solving it.

That's why we built Levo to provide visibility into an enterprise's API sprawl and automate API security testing while minimizing resource consumption.

We use less than 1/10th of the computing resources of our competitors, process less than 1% of your data in our SaaS, and offer you the flexibility of no sensitive data ever leaving your environment. We have demonstrated to discover 2.5x more APIs than our competitors.

This efficiency and privacy-focused approach is, in my opinion, one of our most significant competitive advantages — a result of our first-mover advantage.

Read on to learn how we've built efficiency and privacy into our platform.

API Security: A complex problem to solve

API security is notoriously difficult because of APIs' complexity and dynamic nature. 

For each API to surface, you must call it with specific HTTP methods and request formats. 

This gets even more complex when you try to security test them with real user data, as this data is often sensitive, spanning customer PII, financial records, and business-critical information.

In an ideal world, all of these details would be available in API documentation maintained by developers. 

But the reality is far different. 

75% of enterprises don’t know how many APIs they have, and 65% lack complete API documentation. 

This makes API security a moving target.

Levo addresses this first by building an automatic API Inventory Portal that reverse-engineers traffic and code repositories to provide a real-time API inventory and generate OpenAPI/Swagger documentation. 

This solves a huge pain point—but only if done efficiently. 

If your environment is like that of our fintech customers, inefficient API inventory management could add $100,000 to $500,000 in annual cloud costs. That money could be better used for additional security tools or team members.

Furthermore, providing traffic access— full of sensitive business transactions and customer details—introduces significant compliance and privacy risks. 

Sharing this data with a third-party vendor risks losing control over how it's processed and stored. Even with assurances of best practices, many organizations remain uneasy as audits are labor-intensive and far from foolproof.

Levo's product architecture reflects this foresight, thus providing API Security without creating compliance or operational hurdles. 

Unlike competitors who have retrofitted their platforms to include API security modules, we do not create more problems than we solve. 

Maximum Impact with Minimal Resource Consumption

All of our 6 use cases are performed with no egress cost and minimal CPU and memory usage. Our sensor can run with half a core CPU and 0.5GB RAM, even at large scales —compared to competitors who use 10x more.

Think of it like this: while competitors use a sledgehammer to solve a precision task, we use a scalpel. 

This translates into significant savings, both in terms of cloud costs and operational efficiency. 

Our fintech customers, for example, avoid between $100,000 to $500,000 in extra cloud spending annually despite having high-performance environments due to our unique architecture.

We also ensure no sensitive data leaves your infrastructure by offering on-prem satellite and sensor hosting. 

This means we don’t store or process customer data within our SaaS except for metadata and OpenAPI specs. 

As a result, we can produce similar, if not better, results with a far lesser cloud and maintenance cost, usually <5% compared to the competition.

Levo.ai in Action

Let me explain how Levo works using an example from one of our fintech customers.

Our ability to discover, document, and test APIs primarily depends on access to their traffic. While code instrumentation is possible, the most crucial API parameters and API behavior are only visible in traffic.

We begin by deploying our passive, out-of-line eBPF sensors (1 of our 12 instrumentation methods) across environments to observe and collect API traffic, including SSL traffic.

Instead of collecting everything (which could quickly amount to terabytes of data per day in high-performance environments), our agent samples only what's necessary to create a conclusive and representative traffic profile.

We also provide configuration flexibility, allowing you to create and edit signals to determine how these samples are produced.

Thus, excessive data collection, processing, and duplication—common issues with traffic mirroring that drive up cloud costs—are avoided.

Once collected, the sampled data is sent to our satellite for processing—a stark contrast to most vendors who process 100% of your data in their SaaS.

After processing the traces, the satellite discards all of them, including those containing PII.

You can choose to host the satellite yourself or have us host it. Either option maintains total capacity and can be deployed across all environments with a single click. 

Built using microservices, our satellite supports Kubernetes, VMs, and serverless architecture and doesn’t require any updates to your Firewall configurations. 

Regardless of your choice, only metadata and OpenAPI specs are sent to our SaaS platform—nothing containing PII ever leaves your premises.

You can even keep the entire process within your infrastructure by self-hosting the Platform, meeting compliance requirements like GDPR, which mandates data remains within certain jurisdictions.

While our eBPF agent and satellite have always been designed to capture and process only minimal, necessary traffic, our new feature enhances this capability.

Engineering and security leaders can now configure both components directly from the UI to capture and process data separately for each availability zone. 

Not only have we taken care of your compliance initiatives, but we are also SOC2, GDPR, and ISO compliant ourselves. 

Book a demo through this link to see this live in action!