Web and API security is the set of products that protect a company's website and apps from attacks that come from the internet. These are the things the company offers to the public, such as its online shop, its booking pages and its mobile app. Here the attacker is usually not an intruder on the company's network. The attack is a flood of traffic, a harmful request or a script.
Most of these products run on a network that a security company operates. The security company has data centres in many cities. Every visitor's request reaches one of them first. There, the request is checked, and only clean requests are sent on to the company's own servers. The same network often keeps copies of the website near its users, so that pages load fast. This is called a content delivery network (CDN).
Imagine a bus ticket website based in Hyderabad, two days before Sankranti, when lakhs of people travel home. Five kinds of check run on its traffic. DDoS protection absorbs floods of fake traffic that try to knock the site offline. A web application firewall (WAF) reads each request for attacks, such as a database command typed into the search box. Bot management tells real travellers apart from scripts that grab seats to resell them. API security protects the APIs that the mobile app calls. An API is a set of requests that one program can send to another, such as "show me the free seats on this bus". DNS security protects the name lookups that almost every visit, and almost every connection from the company's own computers, begins with.
These checks must be fast. A traveller will not wait an extra second for a page. So the security company runs its checks close to users, and it keeps spare capacity in every city. Spare capacity of this kind is called redundancy. It means that one failure, or one attack, does not take the site down.
Inside the company's own data centre, load balancers spread the clean requests across many servers. Several load balancer makers now also sell this protection as a cloud service.
AI now helps on both sides. Attackers use it to write scripts that behave more like people, and defenders use it to spot them. The page on AI in cybersecurity covers this.
This zone protects what the company offers to the public. Network security protects the company's own staff and offices. Application security finds the flaws in the code before the website goes live.