Topic starter
02/08/2026 12:18 pm
TL;DR: API abuse, shadow and zombie APIs, third-party dependencies, and AI-assisted detection will shape API security in 2025 as attackers increasingly target legitimate API functionality rather than only classic vulnerabilities, according to Salt. The underlying problem is governance gap, not just tooling gap: organisations need visibility, control, and accountability across exposed APIs before misuse becomes routine.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “Future-gazing: How API Security Will Evolve in 2025”.
Key questions
Q: What breaks when API discovery is incomplete?
A: When discovery is incomplete, security teams miss shadow APIs, forgotten integrations, and endpoints that no longer have an obvious owner.
Q: Why do shadow APIs create such a large security gap?
A: Shadow APIs bypass ownership, policy enforcement, and change control, so defenders cannot reliably classify the data they expose or the identities that can reach them.
Q: How should security teams govern third-party retail API access?
A: They should inventory every partner integration, define the minimum access scope, and require logging and offboarding controls for each trust relationship.
Practitioner guidance
- Implement continuous API discovery Inventory public, partner and internal APIs continuously, then reconcile them against service ownership, business purpose and retirement status.
- Classify shadow and zombie endpoints Flag undocumented APIs and dormant endpoints as security exceptions until an owner confirms access scope, monitoring and decommissioning.
- Review delegated third-party access Treat partner API keys, tokens and service accounts as privileged access paths and require explicit lifecycle review for each integration.
Bottom line: API abuse is shifting attention away from classic vulnerability hunting and toward legitimate business logic being used at scale for scraping, automation and fraud.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:20 pm
API estate governance is now an access-control problem, not just an application-security problem. The article’s threat pattern is not a single bug class but the accumulation of unmanaged interfaces, delegated trust and business logic exposure. Once APIs become the default path into services, ownership and lifecycle control matter as much as code review. Practitioners should treat API inventory, entitlements and revocation as governance controls, not housekeeping.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
- More than 80% of enterprises will have used generative AI APIs or deployed GenAI applications by 2026, up from 5% in 2023, according to Gartner.
A question worth separating out:
Q: What signals show that bot abuse is becoming a governance problem?
A: Look for repeated returns from the same device family, unusually fast account replacement after bans, and clustered sessions that behave like one operator rather than many users. Those signals show the issue is not isolated abuse but a governance gap in identity correlation and enforcement persistence.
👉 Read our full editorial: API security in 2025: why abuse, shadow APIs and AI matter