Commerzbank Strengthened API Security with Akamai 

Commerzbank, one of Europe’s largest financial institutions with a strong international presence, delivers value to customers through innovative, API-powered digital services. From the very beginning, the bank emphasized creating highly reusable solutions, starting with its CRUD (Create, Read, Update, Delete) operations. This approach laid the foundation for exceptional scalability and extensibility, making it easier to integrate internal and external APIs into its ecosystem over time.

But in an era accelerated by AI, Commerzbank recognized that traditional security-by-design measures weren’t sufficient to maintain customer trust and meet growing expectations for secure, seamless access. The bank implemented a wide range of robust mechanisms, including adherence to OWASP principles, well-defined and clean interface definitions, strict policies, secure token concepts, and regular penetration testing. Yet as threats and complexity grew, Commerzbank needed a solution that could adapt in real time.

To that end, the bank partnered with Akamai and Deloitte to deploy a dedicated API security layer that strengthened and extended its existing API management platform. The initiative helped the bank detect anomalies, uncover unmanaged shadow APIs, and strengthen governance across departments — all while maintaining agility, compliance, and the ability to scale securely as its API ecosystem expands.

Commerzbank processes over 6 billion API calls each month, supporting a vast digital ecosystem of customer, partner, and internal applications. Since 2017, it has relied on the Axway Amplify API Management Platform to manage both internal and internet-facing APIs. But as threats grew more sophisticated, Principal Software Engineer and Solutions Architect Volker Sulzbach recognized the need for strong API defense.

“Our API management platform does its job well,” Sulzbach said. “But we wanted a way to identify abnormal API behaviors and potential attacks before they caused problems.”

While the bank’s SOC handled broader network protection such as firewalls, Sulzbach’s team wanted direct oversight of all business-related APIs to detect anomalies and shadow APIs early — without slowing innovation.

After evaluating multiple vendors, Commerzbank selected Akamai’s API Security solution, which continuously discovers, classifies, and protects APIs across environments. “Anomaly detection was our top priority,” Sulzbach said.

“We needed behavior-driven evaluation, not just call-by-call inspection. Akamai enables that,” he continued. Using machine learning–powered anomaly detection, API Security identifies abnormal API behavior, potential misuse, and shadow APIs, providing full visibility into both managed and unmanaged endpoints.

“We were impressed that API Security helps identify ‘rogue’ APIs and incorporate security during the development phase,” explained Sulzbach.

The first phase of implementation began with Commerzbank’s sandbox gateway, used to simulate and test APIs before they go live. Once the team validated API Security’s accuracy and responsiveness, it initially secured about 25 production APIs.

“We first wanted to shape rules, reduce false positives, and ensure our teams can act on alerts. The next phase would expand the use of API Security,” Sulzbach explained.

That expansion will eventually cover thousands of APIs and endpoints, providing continuous visibility and security across both internal and external traffic.