Application Security Stack Audit Kit

You're paying for tools that were built to watch humans in browsers. An increasing share of your traffic is APIs nobody documented, and now agents nobody approved. This kit is the worksheet version of that mismatch: four sheets to fill in before you talk to your current vendor, or the next one.

‍

What's inside

• Current stack: one row per tool you pay for, what you bought it to solve, and whether it covers browser traffic, documented APIs, undocumented APIs, GraphQL/gRPC/WebSocket, and AI/agent traffic
• Where the gaps are: score your coverage 0–10 across five traffic types, then mark which team actually owns Discover, Observe, Enforce, and Govern for each
• Twelve questions to ask any WAF, WAAP, API, or AI security vendor, each with the answer that holds up, the one that sounds like an answer, and the one that's a red flag

Who it's for: AppSec, platform/SRE, and security leaders heading into a renewal, RFP, or budget conversation and want evidence in hand, not a vendor's word for it.