Mayhem API Security is a dynamic testing solution designed to identify vulnerabilities in REST and gRPC APIs through automated security penetration tests. It employs API fuzzing combined with symbolic execution to systematically probe endpoints, validate data handling, and assess authentication mechanisms against the OWASP Top 10 API vulnerability classes. The tool generates thousands of test cases per minute, incrementally exploring edge cases and complex interactions while prioritizing results by severity and exploitability. It integrates into continuous integration pipelines, providing actionable results with Common Weakness Enumeration (CWE) mappings and proof-of-concept exploit details within five minutes. The system uses machine learning to refine test coverage over time, reducing false positives through automated triage and reproduction of defects. Additionally, Mayhem supports regression testing to ensure fixes remain effective after code updates. Its runtime analysis extends beyond static tools by simulating real-world attack patterns and validating reachability of third-party components in the software supply chain.
