Notifications
Clear all
Topic starter
01/08/2026 10:49 pm
TL;DR: API attacks are increasingly exploiting shadow APIs, business logic flaws, and stolen credentials, while most organisations still lack centralized discovery and governance, according to Salt and the 2023 State of the CISO report. The control gap is not just detection; it is continuous visibility into every API that can expose data or impersonate legitimate users.
NHIMG editorial — based on content published by Salt: Understanding API Attacks, Why Are They Different and How Can You Stop Them
By the numbers:
- 95% of CISOs worldwide say their organization has made API security a planned priority over the next two years.
Questions worth separating out
Q: How should security teams handle API keys and tokens as part of identity governance?
A: Security teams should treat API keys and tokens as governed identities, not just technical secrets.
Q: Why do APIs create more risk when they are not centrally inventoried?
A: APIs create more risk because unknown or stale endpoints can remain accessible without current policy, logging, or ownership.
Q: What do security teams get wrong about API-based integration?
A: They often treat APIs as a technical convenience instead of an access boundary.
Practitioner guidance
- Implement continuous API discovery Build an always-on inventory of internal, external, shadow, and retired APIs, then tie ownership to each endpoint so no interface exists without a responsible team.
- Treat API keys as governed identities Assign owners, expiry, rotation, and revocation rules to every API key, token, and service credential.
- Test the business logic, not just the endpoint Add authorisation and workflow-abuse tests to API security reviews so teams can detect object-level access flaws, function abuse, and privilege confusion.
What's in the full article
Salt's full eBook covers the operational detail this post intentionally leaves for the source:
- Practical attack-pattern breakdowns for API misuse, business logic abuse, and credential theft scenarios.
- Discussion of how continuous API discovery can be operationalised across large, changing environments.
- Examples of defensive approaches for identifying anomalies during reconnaissance and access abuse.
- Coverage of the OWASP API Security Top 10 issues referenced in the source material.
👉 Read Salt's eBook on why API attacks differ and how to stop them →
API attacks and governance gaps: what security teams need to know?
Explore further
01/08/2026 10:57 pm
API governance is now an identity security issue, not only an application security issue. Salt's framing is correct in one important respect: once APIs rely on keys, tokens, and delegated service access, the control problem moves into IAM and NHI governance. API security programmes that ignore identity lifecycle, privilege scope, and third-party access will continue to miss the highest-risk failure modes. Practitioners should treat API access paths as governed identities with clear ownership and review.
A question worth separating out:
Q: How do organisations reduce the impact of stolen API credentials?
A: Organisations reduce impact by shortening credential lifetime, removing credential reuse, and limiting each API identity to the smallest possible scope. They should also monitor for unusual usage patterns that suggest impersonation or automation abuse. If a credential is stolen, the organisation should be able to revoke it quickly without breaking unrelated services.
👉 Read our full editorial: API attacks are exploiting governance gaps and stolen credentials
