Topic starter
02/08/2026 9:41 am
TL;DR: 68% of organisations do not have complete visibility into their API attack surface, while AI-accelerated development is creating APIs faster than security teams can catalog them, leaving shadow APIs and runtime abuse exposed, according to StackHawk’s 2026 AppSec survey. The core issue is governance lag: discovery, testing, and ownership models are still built for slower software cycles.
Editorial analysis by NHI Mgmt Group, based on content published by StackHawk: “5 Best API Security Solutions of 2026”.
By the numbers:
- 68% of organizations admit they do not have complete visibility into their API attack surface.
Key questions
Q: What breaks when an organisation cannot see its full API attack surface?
A: Teams lose control over discovery, ownership, and testing scope, which means shadow APIs can remain reachable without formal authentication review or remediation.
Q: Why do undocumented APIs increase exposure even when authentication is in place?
A: Authentication only confirms that a caller has some recognised identity or credential.
Q: How can security teams tell whether API risk controls are actually working?
A: Look for reduced abuse volume, fewer successful automated attacks, and clearer visibility into which non-human clients are making requests and why.
Practitioner guidance
- Build a continuous API inventory Map APIs from source code, service meshes, and traffic analysis so undocumented endpoints are identified before they become permanent blind spots.
- Validate authentication and authorisation on live paths Test OAuth, JWT, API key, and service-to-service flows against real requests so broken authentication and object-level abuse are caught in context.
- Tie API ownership to deployment ownership Assign a named business and technical owner to each API, including shadow and internal-only interfaces, so remediation and retirement are not ambiguous.
Bottom line: Incomplete API visibility is now a governance problem because unknown interfaces cannot be owned, tested, or retired on schedule.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:35 pm
API visibility debt is now a governance failure, not a tooling gap. When organisations cannot enumerate their full API attack surface, they cannot enforce ownership, testing scope, or remediation accountability. That leaves undocumented interfaces outside the normal control plane and turns shadow APIs into a standing exposure problem. The practical conclusion is that API inventory must be treated as a governed asset register, not a side effect of tooling.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should teams prioritise shift-left testing or runtime API monitoring first?
A: They should do both, but runtime monitoring becomes the deciding control once APIs reach production. Shift-left testing reduces defects before release, while runtime visibility catches drift, abuse, and access violations that only appear under live traffic.
👉 Read our full editorial: API attack surface visibility gaps are outpacing security teams