Cequence Security

Cequence Security is a cybersecurity company focused on protecting applications, APIs, and AI-driven traffic for large enterprises. Its platform combines bot management, web application and API protection (WAAP), API security, and, more recently, agentic AI governance and an AI Gateway. The company positions its offering around monitoring the behavior of humans, bots, and AI agents interacting with enterprise applications, and constraining agents to the specific tools and tasks they are assigned.

The API security side of the platform discovers and inventories internal, external, and third-party APIs, enforces schema conformance to eliminate shadow APIs, performs risk assessment, detects sensitive data flowing through APIs, and blocks threats including those in the OWASP API Top 10 and automated business logic abuse that leads to fraud. The company states its approach is network-based and requires no modification to protected applications, mitigating issues in real time and natively blocking detected threats without depending on third-party integrations for enforcement. Deployment options include SaaS, fully on-premises, or a mixture of both.

For AI use cases, Cequence discovers where generative and agentic AI are used, monitors API transactions for inappropriate sharing of sensitive data, blocks AI scraping bots using a continuously updated global list, protects large language models from malicious access, and meters usage to prevent runaway costs ("denial-of-wallet"). The Cequence AI Gateway makes applications MCP-accessible without coding and provides OAuth 2.1 identity provider support, backend credential mapping across OAuth, API keys, basic auth and pass-through, per-user per-tool rate limiting, stateless request isolation, continuous monitoring, and separate pre-production and production modes.

Founding story

Cequence was founded in 2014 by Ameya Talwalkar and Shreyans Mehta, both previously at Symantec, together with Michael Barrett from PayPal. The founders identified an unmet need in application security for a way to protect web, mobile, and API applications from attack without modifying those applications, having been frustrated by first-generation tools such as WAFs and RASP. Early efforts were focused on stopping malicious bot attacks against large organizations.

Business model

Cequence sells a security platform to enterprises, packaged as products and services spanning agentic AI enablement, bot defense, and API security, delivered as SaaS, on-premises, or hybrid deployments.

Enterprise software/platform sales, with SaaS and on-premises deployment options; specific pricing structures are not detailed.

Traction

Cequence reports securing 10 billion daily application/API interactions, safeguarding 4 billion user accounts, covering 1 in 15 mobile users worldwide, and handling 200 million daily agentic interactions, while defending more than $10 trillion in assets for Fortune and Global 500 enterprises. Customer-cited outcomes include 99.3% fewer CAPTCHA challenges, 609,000 account takeover attacks blocked with an estimated $2 million saved, and 85.9 million malicious requests blocked over two months. At the December 2021 Series C the company reported serving more than 85 global brands and processing over 2 billion API transactions per day.

Latest developments

Cequence has extended its platform to the "agentic enterprise," adding agentic AI governance and the Cequence AI Gateway, which connects AI agents to enterprise and SaaS applications and MCP-enables applications without coding. Company leadership has published a series of articles on MCP security and AI agent trust models, and third-party commentary has characterized the AI Gateway as a reference implementation of the agent gateway policy enforcement point pattern.