Topic starter
06/09/2026 3:45 pm
TL;DR: API gateways manage routing, authentication, and rate limiting while WAFs inspect traffic for malicious patterns, but LEVO’s analysis argues that neither control understands business logic or object-level authorisation inside APIs. That blind spot leaves valid requests, valid credentials, and data-extraction abuse largely outside perimeter defences, which is why API breaches keep rising.
Editorial analysis by NHI Mgmt Group, based on content published by LEVO: “API Gateway vs WAF”.
By the numbers:
- Over 90% of organisations now depend on APIs for revenue generating workflows, according to Postman’s State of the API Report cited by LEVO.
- The average global breach now costs USD 4.88 million, according to IBM’s 2024 Cost of a Data Breach Report cited by LEVO.
Key questions
Q: What breaks when API security depends only on gateways and WAFs?
A: Teams lose visibility into business logic abuse, object-level authorisation failures, and low-and-slow reconnaissance that looks legitimate at the transaction layer.
Q: Why do valid credentials create so much risk in API environments?
A: Valid credentials are risky when the API trusts them too broadly.
Q: What are the signs that API security monitoring is failing?
A: API monitoring is failing when teams cannot see request patterns, access failures, or unusual traffic in real time.
Practitioner guidance
- Map API trust boundaries Document which decisions are made at the gateway, which are made in the application, and which objects require service-side authorisation checks.
- Test object-level authorisation directly Build repeatable tests for IDOR, BOLA, and excessive data exposure against sensitive endpoints, then verify the application rejects cross-object access even when authentication succeeds.
- Inventory delegated API credentials Treat API keys, JWTs, and service tokens as machine identities with owners, scope, and expiry so access does not persist after the business use case ends.
Bottom line: API gateways and WAFs reduce exposure, but they do not decide whether a caller should see a specific object or workflow result.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 3:45 pm
API perimeter control is not API governance: gateways and WAFs can shape traffic, but they cannot govern whether a caller is entitled to a specific business action or data object. That distinction matters because API abuse usually succeeds inside valid sessions and valid requests, not through noisy malformed traffic. The practitioner conclusion is simple: if object ownership is not enforced at the application layer, perimeter controls only reduce exposure, they do not prevent abuse.
A question worth separating out:
Q: How should security teams govern API access as a non-human identity?
A: Security teams should inventory APIs as identities, assign an accountable owner, and enforce lifecycle controls for issuance, rotation, expiry, and revocation. The goal is to make access explicit and reviewable rather than hidden in code, pipeline variables, or shared credentials. Without that discipline, machine access becomes unmanaged trust instead of governed identity.
👉 Read our full editorial: API gateway vs WAF: why perimeter controls miss API abuse