Notifications
Clear all
Topic starter
01/08/2026 10:44 pm
TL;DR: API usage has increased by 167% in the past year while only 58% of organisations have API discovery procedures, leaving periodic scanning unable to keep pace with fast-changing attack surfaces, according to Salt. Real-time scanning is now a governance requirement because every undiscovered or stale API extends the window for misconfiguration, abuse, and business-logic exploitation.
NHIMG editorial — based on content published by Salt: real-time API scanning, discovery gaps, and the case for runtime protection
By the numbers:
- The API count increasing by 167% in the past year.
- Only 58% of organizations have procedures in place for API discovery.
Questions worth separating out
Q: How should security teams handle API discovery when services change daily?
A: They should treat discovery as a continuous control, not a periodic audit.
Q: Why do APIs create identity governance risk across machine and human access?
A: APIs often carry the real access decision for service accounts, tokens, and human sessions.
Q: What breaks when organisations rely on periodic API scans?
A: Periodic scans leave a gap between deployment and detection, which is enough time for exposed endpoints, weak business logic, or misconfigured authentication to be abused.
Practitioner guidance
- Implement continuous API discovery Maintain an always-current inventory of exposed APIs, owners, and authentication methods so new or changed interfaces are not left outside the control boundary.
- Move to runtime API monitoring Use real-time inspection for anomalous request patterns, unexpected authentication failures, and suspicious payload behaviour.
- Map machine-to-machine access to NHI governance Review service accounts, tokens, and API keys that authenticate critical integrations, then enforce ownership, rotation, and revocation rules alongside API security reviews.
What's in the full article
Salt's full article covers the operational detail this post intentionally leaves for the source:
- Specific real-time scanning approaches for identifying malicious intent versus benign API anomalies.
- Practical considerations for embedding API security into CI/CD pipelines and release workflows.
- The article's discussion of how AI is accelerating API creation while also raising security and data-handling concerns.
- Salt Labs' referenced findings on ChatGPT ecosystem flaws and third-party account access.
👉 Read Salt's analysis of real-time API scanning and discovery gaps →
API discovery lag and real-time scanning: are your controls keeping up?
Explore further
01/08/2026 10:53 pm
API discovery debt is now a governance problem, not just a tooling gap. When organisations cannot enumerate their APIs quickly enough, they cannot govern exposure, ownership, or authentication with confidence. That creates blind spots for both application security and IAM because machine-to-machine access often rides on tokens and service accounts. The practical conclusion is that API discovery must be treated as a control prerequisite, not a hygiene task.
A question worth separating out:
Q: How do teams decide whether real-time API scanning is necessary?
A: If APIs are frequently created, modified, or exposed through cloud-native delivery, real-time scanning is usually justified. The stronger the linkage to sensitive data, privileged workflows, or machine-to-machine authentication, the less defensible batch-only review becomes.
👉 Read our full editorial: API discovery lag is widening the real-time security gap
