Tool profile
Salt Security: cost, fit and limits
Salt Security is an API and agentic security platform made by Salt Security, Inc. of Palo Alto that discovers APIs, AI agents and MCP servers, assesses their posture and detects abuse at runtime for large enterprise security teams.
What to know first
Salt Security organizes its offer into three services, Agentic Discovery, Posture Management and Runtime Protection, and starts buyers with a free Agentic Security Assessment. The company says it needs no rip-and-replace: discovery is agentless, and protection runs through existing gateways, WAFs and SOC tools. The page names over 40 integrations and prints no prices. Treat the assessment as the entry point.
Salt Security at a glance
| Maker | Salt Security, Inc., United States |
|---|---|
| Free plan | No |
| Entry price | Quote only |
| API access | No |
| Category | Best AI API Security Software in 2026, rank 7 of 10 |
| Website | salt.security |
Who Salt Security is best for
Enterprises with many gateways
Named integrations span AWS, Azure, Google Cloud, Cloudflare, Akamai, Kong, Apigee, MuleSoft and F5, so protection can run through gateways already deployed.
Teams starting with discovery
A free assessment maps agents, MCP servers and APIs, including shadow and zombie APIs, giving a baseline before any contract.
SOC-centered security programs
Integrations with CrowdStrike, Wiz and Veracode let findings reach teams that already triage in those tools. Check that your ticketing path is supported.
Salt Security plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Agentic Security Assessment | Free (0 USD) | A free attack surface assessment that maps agents, MCP servers and APIs across the environment. |
| Agentic Discovery and Posture Management | Book a demo | Discovery of agents, MCP servers and APIs, plus analysis of misconfigurations, excessive permissions and exposed credentials in the security graph. |
| Runtime Protection | Book a demo | Detection of abuse, anomalous behavior and active attacks across the graph in real time, enforced through existing gateways, WAFs and SOC tools. |
Checked November 2026.
What Salt Security does
- Agentic Security Graph
- The graph connects prompts, agents, MCP servers, tools, APIs and data so a finding can be traced across the full agentic path instead of one layer.
- Agentless discovery
- Discovery starts without installing agents, and the company says it requires no rerouting of traffic, which shortens the first proof of concept. That reduces change-control work.
- Posture analysis
- Posture Management checks components for misconfigurations, excessive permissions and exposed credentials, with the page giving an example of tracing an export request to unauthorized access.
- Runtime detection
- Runtime Protection looks for abuse and anomalous behavior in real time and acts through the tools a team already uses. Enforcement relies on gateway connectors.
- Model-layer checks
- Prompt injection and PII detection are included, though the page presents them as one part of a wider picture of API and agent risk. Ask for test cases.
How Salt Security handles your data
The privacy policy names Salt Security, Inc. as database controller under Israeli law and gives only an email for privacy matters. It says personal data is stored and processed in the United States, Israel, the European Union and other locations through service providers it does not name. Retention is as long as reasonably necessary, with a separate retention policy not shown. Customer data is processed on the customer's instructions under a data processing addendum. AI training on personal data was not addressed, and the home page lists no certification.
Where Salt Security falls short in practice
- No price at any layer. Only the assessment is free. Discovery, posture and runtime modules require a demo, so cost cannot be modeled before a sales cycle. Plan a long sales cycle.
- Certification not on the page. No SOC 2 or ISO mark appears on the home page. Procurement teams must request reports separately. Ask for SOC 2 or ISO reports in the vendor review before you shortlist.
- Breadth depends on integrations. Protection runs through gateways and WAFs you already own. Gaps in those tools, or older gateways without a listed connector, limit what runtime enforcement can do.
Works with
Alternatives to Salt Security
Salt Security: common questions
What does the free Salt assessment include?
The home page offers an Agentic Security Assessment listed at zero dollars that maps agents, MCP servers and APIs across your environment. It does not state its duration, data access or output format, so ask what access it needs before you run it.
Does Salt need agents installed to start?
The page says discovery is agentless as a starting point, with protection enforced through existing gateways, WAFs and SOC tools, and no rip-and-replace or traffic rerouting. Confirm in a proof of concept which data sources the agentless mode reads. Test this on staging.
Where does Salt process personal data?
The privacy policy says data is maintained, stored and processed in the United States, Israel, the European Union and other locations by service providers. It does not name them, so request the subprocessor list and the regions that apply to customer data.
Which integrations does Salt list?
Over 40 technology integrations across cloud, gateways, edge, code and the SOC, with named partners such as AWS, Azure, Google Cloud, Cloudflare, Akamai, Kong, Apigee, MuleSoft, F5, CrowdStrike, Wiz, Veracode, Docker and Kubernetes. Check that your exact versions are supported.
Does Salt use my data to train AI models?
The policy does not say whether personal data trains models. It lists AI and machine-learning services among providers and mentions aggregated or anonymized data for improving services. Ask for a written statement for customer data and put it in the addendum.