Topic starter
02/08/2026 12:17 pm
TL;DR: As organisations shift more business and customer activity onto digital platforms, unknown APIs, exposed sensitive data, and signature-based controls are creating blind spots that attackers can exploit, according to Salt. The core issue is not just API volume but weak inventory, weak prioritisation, and controls that do not match custom logic.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “Protecting Digital Platforms & Securing APIs — What I’m Hearing From CISOs”.
Key questions
Q: What breaks when APIs are not inventoried and monitored properly?
A: Uninventoried APIs become shadow trust surfaces.
Q: Why do signature-based controls miss many API attacks?
A: Signature-based controls miss many API attacks because the abuse happens in application logic, object access, and workflow misuse rather than in a known malicious payload.
Q: What are the signs that API risk is being under-governed?
A: Common signs include undocumented endpoints, unclear data exposure, repeated manual exception handling, and remediation work that stays reactive instead of risk-based.
Practitioner guidance
- Build a complete API inventory Create a live inventory of public, partner-facing, and development APIs, including owner, environment, authentication method, and data sensitivity.
- Classify APIs by business and data risk Prioritise exposed APIs that handle PII, IP, payments, or customer workflows.
- Move beyond signature-only detection Add behavioural monitoring that looks for abnormal object access, workflow abuse, and unusual caller context.
Bottom line: Unknown APIs and weak inventory are the main reason exposure grows faster than governance in digital platforms.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:19 pm
API inventory is now a governance control, not an admin task. When a platform team cannot say which APIs exist, which environments they belong to, and which data they expose, the security programme is already behind. That is a lifecycle problem as much as a detection problem, because exposure changes faster than most review cycles. Practitioners should treat API discovery as a standing governance requirement.
A few things that frame the scale:
- 71% of organizations use third-party APIs, according to Gartner’s 2024 data.
A question worth separating out:
Q: How should teams govern machine and third-party access to APIs?
A: Teams should treat API callers as privileged machine identities and apply least-privilege access, short-lived credentials where possible, and explicit lifecycle ownership. That reduces the chance that a token, service account, or integration can move beyond the narrow workflow it was meant to support.
👉 Read our full editorial: API exposure is outpacing security controls in digital platforms