Fastly named Leader in IDC MarketScape WAAP assessment

Fastly has been named a Leader in the IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment, placing it among the vendors assessed in the web application and API protection market.

IDC MarketScape said Fastly's detection relies on two proprietary engines: SmartParse for web application firewall functions and the Adaptive Threat Engine for distributed denial-of-service protection. According to the assessment, both are delivered inline at every point of presence rather than through centralised scrubbing centres.

The assessment comes as companies face rising volumes of bot-driven web traffic and growing complexity in how applications are built and exposed through APIs. Fastly said bot traffic exceeded 50% in many industries, based on traffic on its network in January 2026. It linked that figure to broader shifts in online security as artificial intelligence tools and automated agents become more common.

Fastly's security products include Next-Gen WAF, Bot Management, DDoS Protection, API Security, AI Firewall and Client-Side Protection. The company said these services run inline on its global network as part of its broader edge cloud platform.

Security focus

The company has expanded that portfolio with features aimed at newer attack patterns and traffic management concerns. These include patent-pending deception technology designed to respond to account takeover attempts by returning false information to attackers, as well as cross-customer threat intelligence intended to support pre-emptive policy decisions.

Fastly also highlighted AI bot management tools that let customers control how AI crawlers and bots access their content. AI-generated traffic has become a growing issue for publishers, online retailers and digital platforms that need to distinguish between legitimate automated access, malicious scraping and abusive traffic.

The IDC MarketScape report also cited customer retention figures disclosed by Fastly. It noted that the company reported a 98.7% annual revenue retention rate for the fiscal year ended December 31, 2025, and a 117% last 12 months net retention rate as of June 30, 2026.

Those metrics offer one indication of customer stickiness in a competitive market, where vendors are trying to combine application delivery, cloud security and edge infrastructure into broader platforms. For customers, the appeal of that model often depends on whether one provider can reduce operational complexity across multiple layers of internet-facing services.

Market backdrop

Web application and API protection, often referred to as WAAP, has become a more prominent category as businesses shift more services online and expose more application interfaces to partners, developers and internal systems. APIs are now central to mobile apps, eCommerce systems, software integrations and machine-to-machine communications, making them a larger target for abuse and misconfiguration.

At the same time, cybersecurity teams are dealing with more fragmented environments. Organisations often use separate products for web application firewalls, bot mitigation, DDoS defence, API discovery and client-side monitoring. That can create operational overhead and leave gaps between tools.

Fastly argues that those defences should operate together on the same network layer. It has positioned its edge-based model as an alternative to architectures that route traffic to centralised cleaning or inspection points before it reaches applications.

Kelly Shortridge, Chief Product Officer at Fastly, said the volume of APIs and automated traffic has made older approaches less effective.

"Complexity is fractalising. Every enterprise has seen an explosion in APIs, speed of change, and AI agents and bots calling them. Single, siloed defences do not work. Fastly runs differentiated layers of defence that compound as applications multiply," Shortridge said.

Shortridge also linked the IDC MarketScape designation to the company's recent product development in application and AI-related security.

"I believe being named a Leader in this year's IDC MarketScape for WAAP Platforms reflects our depth of investment in protecting our customers' AI-native applications - from patent-pending Deception to our more recent API Enforcement and AI Firewall," Shortridge said.

IDC MarketScape's comments on Fastly's inline deployment model and its retention rates suggest the company is seeking to differentiate itself on both technical architecture and customer performance as WAAP buyers weigh how to protect increasingly automated application environments.