Traceable AI is an API security tools platform that leverages distributed tracing technology to discover, test, and protect APIs while tracking sensitive data flows across microservices architectures.
Harness acquired Traceable in March 2025 , merging API security with its DevSecOps platform. The closest technical-architecture peer is Levo.ai , which uses eBPF for similar east-west visibility through different instrumentation.
What is Traceable AI?
Traceable AI provides comprehensive API security through a platform that was purpose-built around distributed tracing.
While other API security tools observe traffic at network boundaries, Traceable follows requests through your entire application stack, understanding how data flows between services, databases, and external APIs.
The platform was founded by Jyoti Bansal, who previously created AppDynamics (acquired by Cisco for $3.7B).
This background shows in Traceable’s deep understanding of service meshes, microservices communication patterns, and the challenges of securing distributed applications.
Traceable covers the complete API security lifecycle: discovering APIs automatically, testing them for vulnerabilities during development, protecting them at runtime, and providing forensic investigation capabilities when incidents occur.
Key Features
Distributed Tracing-Based Discovery
Traceable discovers APIs by analyzing distributed traces rather than just network traffic:
- Complete service maps: Sees every service-to-service API call, including internal APIs never exposed externally
- Data flow tracking: Follows sensitive data from ingress through every service it touches
- Dependency mapping: Understands which services depend on which APIs
- Change detection: Identifies when API behavior changes between deployments
This trace-based approach catches shadow APIs and internal services that perimeter-focused tools miss entirely.
Sensitive Data Flow Tracking
The platform tracks sensitive data as it moves through your applications:
- Identifies where PII, financial data, and credentials enter your system
- Maps how that data propagates across services
- Detects when sensitive data appears in unexpected locations
- Alerts when data reaches services that should not have access
This data lineage capability helps with compliance requirements (GDPR, CCPA) and reduces data exposure risk.
API Security Testing
Traceable tests APIs for vulnerabilities using context from production traffic:
- OWASP API Top 10: Comprehensive coverage of API-specific vulnerabilities
- Business logic testing: Uses learned API behavior to test authorization and access controls
- Attack surface analysis: Identifies API endpoints that accept sensitive data
- Fuzzing: Generates test payloads based on observed data patterns
Tests run against staging environments but benefit from production traffic analysis.
Runtime Threat Detection
Real-time protection identifies attacks against your APIs:
- Behavioral anomaly detection: Alerts when API usage patterns deviate from baseline
- Attack signature detection: Identifies known attack patterns (injection, enumeration)
- Account takeover prevention: Detects credential stuffing and session hijacking
- Rate limiting evasion: Catches distributed attacks that circumvent simple rate limits
The platform can operate in detection or blocking mode depending on your risk tolerance.
GenAI API Security
Traceable provides specific protections for LLM and GenAI applications:
- Identifies API endpoints connected to LLM services
- Detects prompt injection attempts
- Monitors for data exfiltration through AI responses
- Tracks which data is sent to third-party AI APIs
The same distributed-tracing engine surfaces broken object-level authorization (BOLA — OWASP API1:2023) by following the trace from the inbound request through the service mesh to the underlying data store, and flagging access patterns that bypass intended role boundaries between services.
Because the BOLA / broken authorization testing signal lives in the trace graph rather than network metadata, it picks up east-west authorization gaps that perimeter-only platforms miss.
Acquisition by Harness
Harness completed its acquisition of Traceable in March 2025, folding the platform into the company’s broader DevSecOps suite. The combined offering keeps Traceable’s distributed-tracing core but lands it inside the Harness Software Delivery Platform alongside CI/CD, feature flags, chaos engineering, and the Harness Security Testing Orchestration module.
For existing Traceable customers the practical change has been on the contract side rather than the product side.
Renewals now run through Harness’s enterprise sales motion, support and professional services moved over the months following the close, and customers who held active contracts kept the platform under the existing terms until renewal — at which point the agreement converted into a Harness commercial line item.
The rebranded product is now sold as part of the Harness AppSec portfolio, not as a standalone Traceable subscription.
The same distributed-tracing engine ships under Harness, and Harness has been extending it with deeper CI/CD-native API security testing — pull-request-time API checks, contract drift detection between staging and production, and tighter integration with Harness STO so the same finding can route into the existing security review queue.
If you are evaluating Traceable AI today, the canonical path is the Harness Security Testing Orchestration entry point. Traceable is no longer separately marketed as an independent product, no separate Traceable trial exists, and the technical sales motion runs through Harness’s AppSec team.
I keep this page indexed because the legacy Traceable brand still gets organic search interest from buyers researching the historical product and the Harness transition.
How to use Traceable AI
The deployment model assumes you either already operate distributed tracing or are willing to introduce it as part of the security rollout.
- Deploy the distributed-tracing instrumentation. Most teams attach the Traceable agent to their existing OpenTelemetry or Jaeger setup, with eBPF-style sidecars for service-to-service visibility where instrumentation is too invasive. Traffic mirroring is available for environments where inline deployment is not on the table.
- Connect data sources. The collector ingests traces, API gateway events, cloud audit logs, and service mesh telemetry, then reconciles them into a single API inventory keyed by service ownership.
- Review the API inventory and the trace graph. The discovery output is the foundation for everything else, so leave it running across at least one representative traffic window before tuning detection rules.
- Configure detection rules. Behavioral baselines, OWASP API Top 10 patterns, and sensitive-data-flow policies attach to the discovered endpoints; tuning runs against your own traffic so the false-positive rate stabilizes.
- Integrate findings into the Harness AppSec dashboard. After the acquisition, Traceable findings can route into Harness Security Testing Orchestration alongside SAST, SCA, and container scan results, which gives the security team a single review queue across the pipeline.
Integration
Deployment Options
Traceable integrates with your infrastructure through multiple methods:
Tracing Agent: Deploy alongside your existing OpenTelemetry or Jaeger setup:
# Kubernetes deployment with tracing agent
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-service
spec:
template:
spec:
containers:
- name: my-service
env:
- name: OTEL_EXPORTER_OTLP_ENDPOINT
value: "http://traceable-collector:4317"
- name: OTEL_SERVICE_NAME
value: "my-service"
- name: traceable-agent
image: traceable/agent:latest
env:
- name: TRACEABLE_API_KEY
valueFrom:
secretKeyRef:
name: traceable-config
key: api-key
Traffic Mirroring: Analyze mirrored traffic without inline deployment:
# AWS Traffic Mirroring configuration
Resources:
TraceableMirrorTarget:
Type: AWS::EC2::TrafficMirrorTarget
Properties:
NetworkLoadBalancerArn: !Ref TraceableNLB
Description: Mirror to Traceable analyzer
API Gateway Integration: Native connectors for Kong, AWS API Gateway, and Apigee.
CI/CD Pipeline Integration
Run API security tests during development:
# GitHub Actions — using the official Traceable AST Action
name: API Security Testing
on:
pull_request:
branches: [main]
jobs:
traceable-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Deploy to staging
run: docker-compose up -d
- name: Run Traceable AST
uses: Traceableai/ast-action@main
with:
scan_name: "CI Security Scan"
traffic_env: ${{ secrets.TRACEABLE_TRAFFIC_ENV }}
token: ${{ secrets.TRACEABLE_TOKEN }}
SIEM and Alerting Integration
Traceable integrates with SIEMs through webhook-based alert forwarding configured in the Traceable platform UI. Supported SIEM integrations include Splunk, Datadog, and Sumo Logic.
Alert rules and severity thresholds are managed from the Traceable dashboard.
OpenTelemetry Integration
If you already use OpenTelemetry, Traceable can consume your existing traces:
# Traceable uses its own platform agent for trace collection
# Deploy via Helm: helm install traceable-agent traceable/traceable-agent
# The agent runs as a DaemonSet or sidecar proxy
# See: https://docs.traceable.ai/docs/k8s
When to Use Traceable AI
Ideal for organizations that:
- Run microservices architectures with service-to-service API communication
- Already use or plan to use distributed tracing (OpenTelemetry, Jaeger)
- Need to track sensitive data flows for compliance
- Want API security that understands internal APIs, not just external endpoints
- Build GenAI applications with LLM API calls
- Require deep forensic investigation capabilities for security incidents
Consider alternatives if:
- Your architecture is monolithic with few internal APIs
- You need a simple, lightweight API gateway security solution
- Budget constraints favor open-source alternatives
- You prefer detection-only without runtime protection needs
Traceable AI brings the observability mindset to API security.
By building on distributed tracing foundations, it provides visibility into API behavior that network-perimeter tools cannot match, making it particularly valuable for organizations with complex, distributed architectures.
Traceable AI alternatives
Traceable’s distributed-tracing model is unusual in API security, so the closest alternatives split by which architectural choice you want to keep.
- Levo.ai is the closest technical-architecture peer. It uses eBPF for east-west API discovery and shares Traceable’s emphasis on internal service-to-service visibility, with a more open-source-friendly distribution model. Pick Levo when the OpenTelemetry stack is not already in place.
- Salt Security is the canonical behavioral-runtime alternative. It runs continuous detection against live API traffic without distributed tracing, which makes it the obvious second choice when the requirement is API security without instrumenting the application stack.
- Akamai API Security , formerly Noname Security before the June 2024 acquisition, pairs runtime detection with Akamai’s edge. It is the right fit when multi-CDN coverage matters more than internal east-west visibility.
- 42Crunch takes the contract-first stance. Every check ties back to the OpenAPI spec and a runtime micro API firewall enforces the same contract in production — the right choice when the security model has to live and die with the spec rather than with traces.
- Wallarm bundles WAAP heritage with developer-focused API discovery and runtime detection. It suits product engineering teams who want one tool to handle the WAF replacement decision and the API security purchase in the same cycle.
The buying signal that consistently favors Traceable (and now Harness’s API security module) is needing east-west visibility across microservices when distributed tracing is already part of the stack.
Traceable AI FAQ
**Is Traceable AI still sold standalone? ** No. Traceable was acquired by Harness in March 2025 and the platform is now part of the Harness DevSecOps suite.
New evaluations should start at the Harness Security Testing Orchestration entry point rather than the legacy Traceable product page.
**How does Traceable’s distributed-tracing model differ from Salt’s behavioral approach? ** Traceable propagates security context through the trace graph — request ID, identity, sensitive data tags — and flags exploits when those attributes break expected service boundaries.
Salt builds behavioral ML baselines from network-level traffic without code or trace instrumentation. Both catch BOLA and credential stuffing, but Traceable picks up east-west authorization gaps that pure-network platforms cannot see.
Does Traceable cover OWASP API Top 10? Yes. The platform covers the full OWASP API Security Top 10 — BOLA, broken authentication, broken object property level authorization, unrestricted resource consumption, broken function-level authorization, and the rest — surfaced through trace analysis rather than signature matching.
**Can Traceable replace my APM? ** No. Traceable consumes distributed-tracing data for security context, not application performance management.
APM tools focus on latency, throughput, and error budgets; Traceable focuses on attack surface, authorization, and data flow. Most deployments keep an APM (Datadog, New Relic, AppDynamics) running alongside Traceable.
**Does Traceable require code instrumentation? ** Partial. Traceable can ingest existing OpenTelemetry or Jaeger traces, deploy its own agent as a sidecar, or analyze traffic mirrored from API gateways and load balancers.
Teams already on OpenTelemetry typically integrate without changing application code; teams with no tracing in place introduce the agent during the rollout.
