Cequence Security
By Cequence Security, Inc.
The implementation process for Cequence Security software involves a structured six-step approach aimed at ensuring comprehensive API protection.
Discover: The process begins with the API Spyder, an agentless tool that provides visibility into an organization’s API attack surface. This step allows organizations to identify all APIs, including those that may not be documented or known.
Catalog: Once the APIs are discovered, Cequence integrates into the organization's cloud and on-premises environments to automate the cataloging of these APIs, ensuring a complete inventory is maintained.
Ensure Compliance: Following cataloging, a risk assessment is performed to evaluate the information each API exposes, such as sensitive data or business logic vulnerabilities, helping organizations understand their compliance posture.
Detect API Abuse: The platform then monitors API interactions to detect any signs of abuse or exploitation of vulnerabilities, focusing on critical business data exposure.
Prevent API Abuse: Cequence natively prevents identified vulnerabilities from being exploited through immediate mitigation actions, ensuring that threats are addressed in real-time.
Shift Left for Full-Spectrum Security: The final step involves integrating security into the continuous integration/continuous development (CI/CD) pipeline, ensuring that security measures are considered throughout the entire lifecycle of the APIs.
The entire implementation process can typically be completed within a few weeks, depending on the complexity of the organization’s API landscape and existing infrastructure.
Cequence Security software is highly customizable to meet specific business requirements. Here are several key points regarding its customization capabilities:
Bespoke API Security Testing: The platform allows users to create customized test cases tailored to individual applications. Users can define pass/fail criteria based on specific business logic and operational needs, ensuring that security testing reflects real-world usage scenarios.
Traffic Profilers: Users can customize traffic profilers per API group within test cases, allowing them to simulate various threat scenarios and improve resilience against attacks.
Authentication Profiles: The software supports configuring authentication profiles for different user personas and privileges, enabling thorough validation testing that aligns with how applications are actually used in practice.
Automated Threat Detection and Mitigation: The platform's machine learning capabilities enable it to automatically generate mitigation policies based on detected anomalies or malicious traffic patterns, which can be reviewed and implemented by security analysts.
While specific pricing details for Cequence Security software are not publicly disclosed, several potential additional costs may be associated with its implementation and ongoing use:
Setup Fees: Depending on the complexity of the deployment and any required customization, there may be initial setup fees involved in integrating Cequence Security into an organization’s existing infrastructure.
Maintenance Costs: Organizations should anticipate ongoing maintenance costs related to updates and enhancements of the software. This may include periodic upgrades to maintain compatibility with evolving security threats and compliance requirements.
Support Charges: While basic support may be included in the subscription model, organizations might incur additional charges for premium support services or dedicated account management. This could involve 24/7 support availability or access to specialized technical resources.
Cequence Security provides a comprehensive training and support framework to ensure new users can effectively utilize its Unified API Protection (UAP) platform.
Onboarding Training: Upon implementation, Cequence offers onboarding training sessions tailored to the specific needs of the organization. These sessions cover essential features and functionalities of the platform, ensuring users understand how to navigate and leverage the software effectively.
Documentation and Resources: Users have access to extensive documentation, including user guides, API references, and best practices. This resource library is designed to help users troubleshoot issues independently and maximize the platform's capabilities.
Webinars and Workshops: Cequence regularly hosts webinars and workshops that focus on various aspects of API security, including threat detection, compliance management, and best practices for using the UAP platform. These sessions provide valuable insights from industry experts.
Customer Support: Cequence Security offers dedicated customer support through multiple channels, including email, phone, and online chat. This support is available to assist users with technical issues, configuration questions, or general inquiries about the platform.
Community Engagement: The company fosters a user community where customers can share experiences, ask questions, and provide feedback. This community-driven approach helps users learn from one another and stay informed about updates or new features.
Cequence Security implements a robust set of security measures to protect data throughout its Unified API Protection (UAP) platform:
Data Encryption: All data transmitted between clients and the Cequence platform is encrypted using industry-standard protocols (e.g., TLS/SSL). This ensures that sensitive information remains secure during transit.
Access Controls: The platform employs strict access control mechanisms to ensure that only authorized personnel can access sensitive data or modify configurations. Role-based access controls (RBAC) allow organizations to define user permissions based on their roles.
Regular Security Audits: Cequence conducts regular security audits and vulnerability assessments to identify potential weaknesses in its systems. These proactive measures help maintain a high level of security across its infrastructure.
Threat Detection and Response: The UAP platform includes real-time threat detection capabilities powered by machine learning algorithms that continuously monitor API traffic for anomalies or malicious activities. Automated responses can be triggered to mitigate threats immediately.
Compliance with Standards: Cequence adheres to various regulatory standards and frameworks (e.g., GDPR, CCPA) to ensure that it meets legal requirements for data protection. Compliance measures are integrated into the platform’s operations.
Cequence Security releases updates for its Unified API Protection platform regularly to enhance functionality, address vulnerabilities, and introduce new features:
Scheduled Releases: The company typically follows a structured release schedule for major updates, which may occur quarterly or biannually. These updates are communicated in advance to customers through official channels.
Continuous Improvement: In addition to scheduled releases, Cequence implements continuous improvement practices that allow for smaller incremental updates or patches to be deployed as needed. This ensures that any critical vulnerabilities can be addressed promptly without waiting for the next major release.
User Feedback Integration: Updates are often influenced by user feedback gathered through support interactions, community forums, and direct customer engagement. This collaborative approach helps prioritize features that meet customer needs.
Testing and Quality Assurance: Before any update is rolled out, it undergoes rigorous testing and quality assurance processes to ensure stability and performance. This minimizes disruptions for users during deployment.
Cequence Security maintains a clear policy regarding data ownership and portability, emphasizing that customers retain full ownership of their data. According to their terms and conditions:
Customer Data Ownership: Customers own all rights, title, and interest in their data (referred to as "Customer Data"). This means that any data transferred to Cequence for processing remains the property of the customer.
Limited License for Processing: While customers retain ownership, they grant Cequence a non-exclusive, limited-term license to host, process, transmit, and display their data as necessary to provide the services. This license is strictly for the purposes of maintaining the system, addressing security issues, and complying with legal requirements.
Data Portability: Cequence allows customers to retrieve their data upon request. This ensures that organizations can maintain control over their information and facilitate data migration if they choose to switch providers or discontinue services.
Compliance with Data Protection Laws: Cequence commits to handling Customer Data in accordance with applicable data protection laws. This includes ensuring that the transfer of data does not violate any privacy policies or legal obligations.
Cequence Security offers flexible terms for scaling its services up or down based on organizational needs:
Modular Architecture: The platform is designed with a modular architecture that allows organizations to scale their API security solutions according to changing requirements. This means customers can add or remove features based on their current security landscape without significant disruption.
Subscription-Based Model: Cequence typically operates on a subscription-based pricing model, which provides organizations with the flexibility to adjust their subscriptions in response to changes in business size or security needs. This model allows for easy scaling without incurring heavy upfront costs.
Usage-Based Scaling: Organizations can scale their API protection capabilities based on usage metrics, such as the number of APIs being protected or the volume of API calls. This usage-based approach ensures that customers only pay for what they need, making it easier to manage costs during fluctuations in demand.
Support for Hybrid Deployments: Whether deployed on-premises, in the cloud, or in a hybrid environment, Cequence's solutions can be adjusted to fit evolving organizational structures and workflows. This adaptability is crucial for businesses experiencing growth or restructuring.
Cequence Security has established clear terms and conditions regarding contract renewal and cancellation within its Software-as-a-Service (SaaS) agreements:
Automatic Renewal: Subscriptions to Cequence Security’s services automatically renew for additional one-year terms unless either party provides written notice of non-renewal at least 30 to 60 days prior to the end of the current subscription term. This ensures continuity of service unless explicitly canceled by either party.
Price Adjustments: Upon renewal, the pricing may be adjusted to reflect any inflation or updates in service fees as outlined in the agreement. This means that customers should expect potential changes in costs during each renewal period based on market conditions.
Termination Rights: Either party can terminate the agreement if the other party fails to cure a material breach within 30 days after receiving written notice. Cequence may also terminate immediately for specific violations, such as breaches of confidentiality or if the customer is subject to bankruptcy proceedings.
Effects of Termination: Upon termination, all rights and obligations under the agreement cease. Customers must pay any outstanding amounts owed to Cequence, and they will lose access to the service and any data stored on it after a specified period (usually 30 days post-termination). Customers are also required to return any confidential information obtained during the contract.
Cequence Security adheres to several key compliance standards that demonstrate its commitment to security and data protection:
ISO 27001 Certification: Cequence has achieved ISO 27001 certification for its information security management system (ISMS). This international standard establishes a framework for managing sensitive company information, ensuring that data is kept secure through risk management processes.
SOC 2 Type II Compliance: The company has undergone a SOC 2 Type II examination, which evaluates its controls related to security, availability, processing integrity, confidentiality, and privacy. This compliance reassures customers that Cequence's systems are designed to protect their data effectively.
PCI DSS Compliance: While Cequence does not process or store credit card data directly, it complies with PCI DSS (Payment Card Industry Data Security Standard) requirements related to handling cardholder data securely when it is part of API transactions.
GDPR Compliance: Cequence Security aligns with the General Data Protection Regulation (GDPR), ensuring that it manages personal data in accordance with European Union regulations regarding privacy and data protection.
