Salt Protect · Detect and respond at runtime Stop the attacks that look like valid requests.
Agents act through MCP servers and APIs, and attackers abuse the same paths with requests that look legitimate. Salt Protect uses patented behavioral analysis to detect and block abuse by intent, including low-and-slow attacks that unfold over time. No signatures. No rules.
“Salt stopped an attack that would have cost us millions. Our WAF never even saw it.”
CISO · Fintech leader
The problem
Your WAF sees requests. Attackers abuse behavior.
WAFs and gateways were not built for APIs, or for agents acting through them. They miss context, logic abuse and threats that evolve over a session.
01 Valid-looking requests carry the attack
BOLA, scraping and business logic abuse use legitimate calls with real credentials. Nothing in a single request looks wrong.
02 Low and slow attacks hide in time
The attack is the sequence, not any one request. Tools that judge requests in isolation never see it.
03 Agents make abuse faster and harder to trace
Prompt injection, compromised tools and rogue agent behavior all end in API calls. Salt detects abuse regardless of who or what is behind it.
The shift
Stop judging requests. Understand behavior.
How it works
From behavior to block, in four steps.
Step 01 Learn what normal looks like
Salt builds behavioral baselines from runtime traffic, so detection starts from context instead of signatures.
- Per API and per user
- Per session and sequence
- Per agent and MCP server
Step 02 Detect by intent
Patented behavioral analysis looks at sequences over time, catching logic abuse and low-and-slow attacks that single-request tools miss.
- BOLA and enumeration
- Scraping and abuse
- Prompt injection and tool abuse
Step 03 Respond through what you run
Salt blocks through the controls you already have and sends high-fidelity alerts to the SOC. No traffic redirection required.
- Block via gateways and WAFs
- Alert to SIEM and SOAR
- Ticket to the owner
Step 04 Feed it back
Runtime findings flow back into governance and code workflows, so the same attack is harder to repeat.
- Governance and posture
- Code workflows
- Agentic Security Graph
Part of the platform
Response is where context pays off.
Salt gives you breadth across every agent, MCP server and API, and depth across exposure, source code, configuration and runtime behavior. Protect is the response layer.
Capabilities
What you get with Salt Protect.
Real-time behavioral detection
Find and block threats as they happen, without signatures or rules.
Business logic attack defense
Stop abuse that uses valid calls and valid credentials.
Session and sequence awareness
Judge the whole sequence, not each request alone.
Low-and-slow detection
Build context over time to catch patient attackers.
Agent and MCP abuse detection
Detect compromised tools, exfiltration and rogue agent behavior.
SIEM, SOAR and gateway integration
Respond through the controls and workflows you already run.
Use cases
Where your team would use it.
Integrations
Block through the controls you already run.
Protect works with your gateways, WAFs and SOC tools. Add it without rerouting traffic or replacing anything.
See what your WAF is missing.
Watch Salt catch an attack that looks like valid traffic.