Airlock and the OWASP Top 10 Web Application Security Risks 2025

Airlock's Gateway/Microgateway acts as a central policy enforcement point, denying access by default – only explicitly mapped resources are reachable, each configurable with roles and access restricitions. Airlock IAM propagates role information upon successful authentication, enabling consistent, session-aware authorisation decisions across all protected applications. Requests are additionally validated against defined and learned policies, providing protection against tampering, path traversal, and SSRF.

• Upstream authentication [IAM] and authorisation
• Step-up and step-down authentication
• Deny-by-default access model
• CSRF protection
• Deny rules for SSRF and path traversal

Airlock provides secure defaults and a configuration model where requests are explicitly mapped to backend services. Configuration validators and policy learning reduce misconfigurations. Responses and headers are rewritten to enforce security best practices and suppress sensitive information.

• Secure default configuration
• Policy learning
• Configuration validation
• OpenAPI specification enforcement
• GraphQL schema validation
• Security header Injection, header filtering and response rewriting
• Cookie Store
• Error page replacement

Airlock Gateway/Microgateway mitigates vulnerabilities in backend components through virtual patching and protocol termination, reducing exposure without requiring application changes. This is particularly relevant when third-party components cannot be patched immediately. The Airlock platform itself is hardened through measures such as SELinux, compiler-level protections (NX, ASLR), and strict privilege separation. The software supply chain is continuously monitored, and necessary security patches are delivered promptly outside of regular release cycles when required.

• Virtual patching
• Infrastructure as code (IaC)
• Enforce MFA authentication
• HTTP protocol termination and regeneration
• Security compartments  / least privilege
• Continuous monitoring of the software supply chain with prompt security patch delivery outside regular release cycles

Airlock terminates TLS with strong configurations including support for post-quantum cryptography. Sessions and cookies are protected against theft and manipulation. Authentication data is separated from applications and handled securely.

• TLS termination (front-end & back-end)
• Post-quantum cryptography support
• HSM support

Airlock detects and blocks injection attempts using deny rules and dynamic allowlisting. Protocol validation and request parsing prevent malformed or ambiguous requests from reaching applications. Rather than relying solely on signature-based detection of known exploits, Airlock's rules target attack classes and patterns - providing proactive protection against new and unknown variants.

• Deny rules
• Dynamic allowlisting & allowlist learning
• HTTP protocol validation and regeneration
• JSON, GraphQL, multipart parsing

Airlock compensates for insecure application designs by enforcing controls at every enforcement point - from perimeter to service-to-service communication in zero-trust architectures. Rate limiting, session management, and API protection address common design weaknesses. Consistent protection is ensured across Kubernetes and VM-based deployments.

• Deny-by-default access model
• Secure segregation of tenants
• Upstream authentication [IAM] & privilege/session management
• Anomaly Shield (machine learning-based threat detection)
• Native Kubernetes integration for zero-trust architectures

Airlock centralises authentication using Airlock IAM and supports risk-based authentication by evaluating context against historical patterns to adapt authentication strength. Sessions are protected against hijacking and manipulation.

• Support for multiple authentication schemes including OIDC/OAuth2, FIDO2/Passkeys, form-based, Kerberos, client certificates (mTLS)
• Risk-based authentication [IAM]
• Multi-factor authentication (MFA) [IAM]
• Secure session management / Cookie Store
• Client fingerprinting

Airlock protects the communication layer between client and application and therefore has no visibility into integrity failures that occur within the application itself, such as unverified updates or unsafe dependency loading.

• Signed Airlock software updates

Airlock detects and logs attacks in real time and integrates with external SIEM systems to support rapid incident response and analysis.

• Centralised logging & event generation
• Tracing support
• Metrics for allowed and blocked requests
• Masking of sensitive data in logs
• Real-time dashboards
• SIEM integration (CEF/JSON)

Airlock detects abnormal behaviour, limits resource usage and ensures stable operation even under exceptional conditions. Backend error pages are replaced to prevent leakage of sensitive information such as stack traces or version details.

• Anomaly Shield
• Rate limiting & DoS protection
• Backend health checks & failover clustering
• Error page replacement