Airlock Gateway is a Web Application and API Protection (WAAP) solution that combines the functions of a Web Application Firewall (WAF), API Security Gateway, and a central reverse proxy. Its primary purpose is to serve as a security instance that inspects all inbound HTTP and HTTPS requests to protect web applications and APIs by blocking attacks before they reach internal systems. The gateway is designed to mitigate threats including the OWASP Top 10, Denial of Service (DoS) attacks, malicious bots, and zero-day exploits. It identifies malicious traffic using hardened filter rules, reputational analysis, and machine learning-based anomaly detection, which distinguishes between human users and automated bots.
Beyond traffic inspection, the system acts as a central policy enforcement point for authentication, authorization, and API access management. It supports secure API exposure through OpenAPI specification validation and provides virtual patching for application vulnerabilities. Airlock Gateway features include load balancing, failover capabilities, and a REST API for integration into DevSecOps pipelines. It also provides for automated certificate lifecycle management using the ACME protocol and operates within a cluster architecture where behavioral data is kept within the local environment.
