---
title: Voidhawk | Application & API Visibility and Defense | ZioSec
description: "See what attackers are doing inside your apps and APIs. Voidhawk connects actors, intent, and outcomes from copied CDN traffic. Block through your existing edge controls when you choose."
url: https://ziosec.com/voidhawk
---

# See the attack. Choose when to block.

Voidhawk: visibility and defense for your applications and APIs.

A worker on your CDN copies requests and responses to Voidhawk out of band. Voidhawk groups traffic into actors, works out what each one is after, and shows what reached your application. When you choose to enforce, it writes scoped rules into the edge controls you already operate.

[Discuss Voidhawk](/contact?intent=voidhawk) | [Deployment details](/voidhawk/deployment)

## Your WAF shows what it blocked. See what got through.

Start in observe mode. Understand who is reaching your apps, what they are after, and what your applications sent back, even if you never enable blocking.

### One actor across changing infrastructure

Connect clients by behavior and TLS fingerprint to expose a campaign across addresses, sessions, and time.

### Intent with evidence

Understand credential stuffing, SSRF, and data theft through the sequence of actions, with the requests and responses behind each finding.

### An honest outcome

See what was stopped and what still reached the application, including evidence of data leaving in responses.

### A lead for AppSec

Identify the endpoint, field, and technique behind suspected exploitation so engineers can investigate a flaw before a signature exists.

## A campaign you can investigate

See the objective, the stages an actor went through, what reached the app, and what to investigate next. Separate verified crawlers and AI agents from linked attackers and unknown automation.

![Voidhawk situation board grouping actors by intent and outcome.](/images/voidhawk/situation-board.png)

Product view from the platform overview. Demo tenant with anonymized site names; this is not a customer incident.

## Recognize exploitation before a rule describes it

Voidhawk learns normal behavior per endpoint and field, recognizes attack structure, and connects it with actor history and response evidence. A finding gives AppSec the endpoint, field, technique, and supporting traffic to investigate.

1. **Copy.** Observe at your CDN. Copy requests and responses asynchronously. No additional proxy or appliance in the request path, and no application code changes.
2. **Understand.** Group sessions by behavior and TLS fingerprint. Interpret the sequence, the application’s responses, and what the actor is trying to achieve.
3. **Act.** Send findings to your SOC. When enforcement is enabled, push a scoped rule or list entry through your edge platform’s management API.

## Observe first. Enforce on your terms.

### Observe

See actors, intent, and outcomes without changing how traffic is handled. Visibility remains useful even if you never enable enforcement.

### Enforce via API

Write scoped rules and list entries through your platform’s management API. Your existing edge controls enforce them.

### Enforce in the worker

Optionally apply Voidhawk’s current decisions in the worker for actions the platform’s native rules cannot express.

Choose enforcement per site and per action. Review proposed rules before they ship, or enable automatic pushes. Rules are scoped, tagged to their actor and incident, and expire automatically. Cloudflare, Fastly, and AWS CloudFront integrations use the platform’s native controls. Available controls depend on your provider plan.

Responses never wait for a Voidhawk verdict. Traffic copies are processed in Voidhawk cloud.

[Deployment and platform details](/voidhawk/deployment)

## The attacker has an attack surface

An attacking agent relies on reasoning, context, and tools to achieve its goal. Each dependency creates a place where its plan can break. We understand those weaknesses because we build agents that plan, adapt, and exploit.

Inside ZioSec, our offensive agents generate adversarial scenarios to train and challenge Voidhawk. That work informs how it evaluates an actor’s objective across a sequence of actions, identifies weaknesses in the plan, and applies the configured response.

[Explore our methodology](/methodology)

## What reached your apps today?

Bring your CDN, the applications you defend, and the questions your existing controls cannot answer. We’ll scope an evaluation with your team.

[Talk about Voidhawk](/contact?intent=voidhawk)