Akamai security products licensing covers two different constructs. Security services that run on the Akamai platform, such as App & API Protector, Bot Manager, Prolexic and Enterprise Threat Protector, are ordered like other Akamai services: a Transaction Document sets an entitlement, Akamai measures use and bills overage.[2][9] Security software that runs in the customer’s own environment comes with a separate licence agreement: Guardicore Segmentation, App & API Protector Hybrid, API Security, the Enterprise Application Access client and connectors, and Prolexic On-Prem appliances.[3][4][5][6][7] The second group is where a software asset manager has real counting work to do. For the framework, see Akamai Technologies licensing.
Editions
| Product | Delivery | What is licensed (Akamai documents) |
|---|---|---|
| App & API Protector (AAP) | Akamai network | Rate controls, network and application layer controls, bot visibility, Adaptive Security Engine and Akamai Security Foundation[1] |
| AAP Hybrid | Customer infrastructure | Application layer controls and Adaptive Security Engine installed in the customer’s environment[1] |
| Advanced Security Management, Malware Protection | Add-ons to AAP | Extra policies, rate controls and API registration; interception of malicious file uploads[1] |
| API Security | SaaS, Self-hosted or Hybrid | API discovery, inventory, risk scoring and runtime analysis under a Usage Commitment[1] |
| Guardicore Security Platform | On-premises or SaaS | Agents for servers and endpoints, Management instances, integrations and add-ons[1] |
| Enterprise Defender | Akamai network | User-count bundle of Enterprise Application Access, Enterprise Threat Protector, Kona Site Defender and IP Application Accelerator[2] |
| Prolexic | Akamai scrubbing centers or on-premises | Routed, IP Protect and Network Cloud Firewall versions, Always-On or On-Demand; On-Prem appliances powered by Corero[1] |
Akamai Security Foundation, included with AAP, bundles API Discovery, DDoS Fee Protection, SIEM Integration and one Site Shield map; additional maps cost extra.[1] The Guardicore platform is sold as components: Guardicore-Agents-Servers, Guardicore-Agents-EndPoint, Guardicore-Management (per instance, with additional on-premises, disaster recovery and lab or staging instances), Guardicore-Integration (priced separately, for example F5, Citrix or AS400), Guardicore-Add-Ons such as Deception and Insight, and Guardicore-Other services.[1] Either the on-premises or the SaaS deployment requires a licence with Akamai.[1]
Metrics
| Product | Catalog row | Unit |
|---|---|---|
| API Security | Million Requests | API requests processed per month; non-API traffic filtered out does not count.[1] |
| API Security (end of sale 2027) | APIs | Number of APIs discovered and protected.[1] |
| AAP, Kona Site Defender, Bot Manager | Digital Property and traffic units | Fees are per Digital Property unless otherwise indicated; traffic is measured with the delivery units.[2] |
| Guardicore | Agent; Management Server | Agents installed on virtual machines, physical servers, endpoints, workstations or containers; the management and dashboard component.[3] |
| Enterprise Defender, Enterprise Threat Protector | Enterprise user | Users registered in the identity store (and, for Enterprise Defender, observed accessing the Services).[2] |
| Enterprise Threat Protector | Location | Retail locations offering Wi-Fi to people not in the identity store.[2] |
Guardicore’s “License Scope” is the set of limits in the Order Form, such as licensed modules, the volume of Management Server and Agent licences, the installation environment and features.[3] Akamai’s public documents give no single “workload” definition; the countable unit is the Agent, wherever it is installed.
Counting / floors
API Security. Usage is measured monthly against the purchased Usage Commitment and resets at the start of each month. If usage stays above the commitment, Akamai may stop monitoring or sample requests for the rest of the month. If usage exceeds 150% of the commitment for three consecutive months, or any three months in a rolling 12-month period, Akamai may increase the Usage Commitment and bill accordingly.[1] Catalog: API Security commitments may be raised after three months above 150%.
Enterprise Defender. Billed monthly on users registered in the identity store and observed accessing the Services in the billing period. Each component service carries its own usage entitlement and overage rate.[2] Catalog: Enterprise Defender counts users registered and observed. A dormant directory account that never accesses the Services is therefore not billed under Enterprise Defender, but it is counted when Enterprise Threat Protector is bought standalone on a user count basis, which uses registered users only.[2]
Enterprise Threat Protector locations. On a location count basis, each retail location may have no more than 50 simultaneous devices on the Wi-Fi network.[2] Catalog: ETP location licences cover up to 50 simultaneous devices.
Managed Kona Site Defender. Up to five WAF policies are included; each additional policy adds a monthly fee.[2] Catalog: Managed Kona Site Defender charges for each WAF policy beyond five.
Guardicore. The licence lets the customer install Agents in the volume the Order Form authorizes and, unless the Management Server is SaaS, install Management Servers in the authorized volume.[3] Catalog: Guardicore Agents may be installed only in the volume on the Order Form. The customer must keep an Installation Record of the location of each copy and the location, identity and total number of virtual machines, physical servers and workstations running the Software.[3]
Prolexic. For Prolexic Routed, clean inbound traffic must stay below the contracted Committed Information Rate (95th percentile) at each provisioned data center unless Akamai approves otherwise.[1] Akamai may rate limit above the Committed Information Rate for the GRE or Connect options.[8] Service Validation must be completed every year for the Prolexic service level agreement to apply.[1]
Virtualization & partitioning
Guardicore is the only Akamai security product with an explicit anti-pooling clause. The customer may not use any hardware, software, device or technique to pool connections or reduce the number of servers, machines, Agents or users that access the Software, “sometimes referred to as ‘virtualization’, ‘multiplexing’ or ‘pooling’”, to exceed or circumvent the License Scope.[3] Catalog: Guardicore prohibits pooling or multiplexing to reduce counted Agents. Because Agents are counted on virtual machines and containers as well as physical servers, a dynamic virtual estate needs an inventory process that matches the Installation Record. See virtualization and partitioning.
Cloud / BYOL
AAP, Bot Manager and Prolexic routed services are cloud services, so no customer licence is moved. Guardicore Management can be bought on a SaaS basis, in which case the licence does not cover installing the Management Server.[3] API Security can be hosted on Akamai infrastructure, on customer infrastructure, or split between the two.[1]
Programs
DDoS Fee Protection is available with Kona Site Defender, Kona DDoS Defender, Web Application Protector, App & API Protector and API Security. It replaces overage fees for an attack month with the Capped Burst Fee when the overage exceeds twice the six-month average and Akamai verifies the attack. It is not available to customers on consolidated invoices across Services or Transaction Documents.[1] Catalog: DDoS Fee Protection needs overage above twice the six-month average. For customers that order it, service levels of the underlying DDoS service do not apply during an attack that triggers the credit.[8]
Trial Services last up to 90 days from first use unless stated otherwise.[9]
Guardicore through Channel Partners. The Guardicore licence assumes an Order Form submitted by a Channel Partner. Excess usage found in a Usage Audit may be invoiced to the Channel Partner, and the customer agrees to pay the Channel Partner for it.[3]
Licence terms for customer-installed software
Guardicore. The licence is limited, worldwide, non-exclusive, non-transferable and non-sublicensable, for the License Term in the Order Form, and ends automatically when the Order Form expires or terminates.[3] Catalog: The Guardicore licence ends with the Order Form. Restrictions include no resale, time-sharing or service bureau use, no competing product and no publication of benchmark results without Akamai’s approval. Support and maintenance are included during the License Term and cover the current and two preceding Releases.[3] Assignment needs Akamai’s written consent.[3]
AAP Hybrid and API Security. Both licences grant a limited, worldwide, non-exclusive, non-sublicensable right to use the Product for internal business purposes, non-transferable subject to the Akamai Order Form.[4][5] Catalog: AAP Hybrid and API Security are licensed for internal use by Authorized Users. Access may be given only to employees and independent contractors working for the customer (Authorized Users), and the customer must install Updates that Akamai requires.[4][5] Catalog: API Security access is limited to Authorized Users. Where API Security is bought through a reseller, the reseller terms fill gaps that the licence does not cover.[5]
Enterprise Application Access and SIA connectors. The client and connector software is licensed non-exclusively, personally and non-transferably, may be used only with the customer’s authorized use of Akamai’s services, and ends with the order for the Service. It is provided as is, without entitlement to maintenance or updates under that licence. Open source components are listed in a schedule and governed by their own licences.[6] Catalog: EAA and SIA connectors may be used only with the subscribed service.
Prolexic On-Prem. The agreement is with Corero Network Security, not Akamai, although the customer orders through Akamai. Corero grants a temporary, non-transferable licence to the Appliance Software for use with the listed Appliances, keeps title to the Appliances and requires their return after the Term. The customer must insure the Appliances for at least 36 times the monthly Subscription Fee.[7] Catalog: Prolexic On-Prem appliances stay Corero property and are returned at the end.
Audits and compliance
The Guardicore licence has the only general software audit clause in Akamai’s security portfolio. On request the customer provides its Installation Record, and Akamai may audit deployment and use from time to time with the access it reasonably requests, including remote access.[3] Catalog: Guardicore customers keep an Installation Record and accept Usage Audits. Unlike many software audit clauses, it sets no notice period, frequency limit or cost-shifting threshold. Cloud security services are metered by Akamai, so their compliance risk is overage rather than audit. See software license audit.
Out of scope
- Prices, which are set in Transaction Documents and partner quotes.
- Account Protector, Content Protector, Brand Guardian, Firewall for AI and Akamai Workforce Protector beyond their mention in the Service Descriptions.
- Secure Internet Access consumer and SMB editions, which have their own end-user licence.
- The AI feature terms in the Service Descriptions, which are opt-in for Guardicore and for optional AAP features.