Traceable is an application and API security company that helps enterprises find every API they run, test those APIs for vulnerabilities and block attacks against them in production. It is aimed at security and development teams running microservices and API-heavy applications, including generative AI APIs, where unknown or poorly protected endpoints expose sensitive data.
The core problem is visibility. Teams cannot protect or test APIs they do not know exist, and API documentation rarely keeps up with what is actually deployed.
At A Glance
| Vendor | Traceable |
|---|---|
| Category | Application and API security |
| Deployment | Agents, Kubernetes sidecars and API gateway plugins |
| Certifications | SOC 2 Type 1 and SOC 2 Type 2 |
| Customers | Informatica, Jobvite, Axos Bank, Nextroll, DigitalOcean |
| Founded | 2018 |
| Market classification | Application Security |
What Traceable Does
Modern applications expose hundreds or thousands of APIs, many of them undocumented, and attackers use them for data exfiltration, account takeover and bot abuse. Traceable covers the whole API lifecycle, from discovery through testing to protection in production, so a team can see what it has, fix what is weak and defend what is live.
What ties the three areas together is the data. As code executes across microservices, distributed tracing records how each API is actually called. The same runtime picture supplies the traffic that security tests replay and feeds an API security data lake used for threat hunting and incident response.
Products
Application And API Posture Management
Posture management is for teams that do not have a full list of their APIs. It discovers applications and APIs across environments, assesses their risk and compliance posture, and provides continuous discovery and posture insights for both APIs and MCP tools.
Application And API Security Testing
Security testing helps developers and AppSec teams find flaws before attackers do, using live traffic rather than synthetic guesses, and it skips APIs that are idle or never called. It covers:
- The OWASP API Top 10 and common CVEs, with authentication and authorisation tests
- Business logic flaws such as BOLA, using Traceable’s own dynamic payloads
- Tests generated from older traffic with data close to real runtime parameters
- The complete API call flow recorded whenever a vulnerability is found
- Reports with CVSS and CWE scores and remediation recommendations
Application And API Protection
Runtime protection defends APIs in production. It detects attacks, supports API threat hunting, provides OWASP Top 10 protection and counters account takeover, bot traffic and sensitive data exfiltration. It also protects generative AI APIs, which bring “a new set of security challenges”.
How It Works
Traceable deploys into Kubernetes or other microservices environments and is designed to fit existing infrastructure.
| Component | What it does |
|---|---|
| Agents | Lightweight agent modules collect code-level diagnostic data through distributed tracing across microservices. Language modules can be added to application code for deeper analytics. |
| Deployment options | Kubernetes sidecars, in-app agents and plugins for API gateways. |
| Data aggregation | Agents can aggregate data inside the customer network, and sensitive information can be scrubbed before data leaves the environment. |
| Machine learning | Deep learning, clustering and classification build a baseline of normal behaviour from the tracing data and flag deviations from it. |
Testing connects into CI/CD pipelines so that it fits developer workflows without changing release cadence.
Company Background
| Founded | 2018, by Jyoti Bansal and Sanjay Nagaraj |
|---|---|
| Headquarters | San Francisco, United States |
| Ownership | Merger with Harness announced in February 2025, with the aim of an AI native DevSecOps platform |
| Funding | A reported $60 million Series B in 2022 led by Institutional Venture Partners, bringing total funding to $80 million; other investors include Unusual Ventures, CitiVentures, Sorenson and Geo Discovery Capital |
Note: This overview is compiled from Traceable’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.