Notifications
Clear all
Topic starter
02/08/2026 12:32 pm
TL;DR: 58% of organisations monitor APIs less than daily and lack confidence in inventory accuracy, while one in five have real-time oversight and 55% have slowed new application rollout because of API security concerns, according to Salt’s 2025 State of API Security Report. The real issue is governance drift: discovery, runtime visibility, and policy enforcement are no longer keeping pace with API sprawl.
NHIMG editorial — based on content published by Salt: 2025 State of API Security Report
By the numbers:
- 58% of organizations monitor their APIs less than daily and lack confidence in the accuracy of their inventories.
- 55% of organizations admitted to slowing down the rollout of new applications due to API security concerns.
Questions worth separating out
Q: How should security teams govern cloud workloads that rely on service accounts and API keys?
A: Treat workload identities as first-class governed assets, not implementation details.
Q: Why do API inventories become unreliable so quickly in cloud and SaaS environments?
A: They become unreliable because APIs change faster than manual ownership and documentation can be updated.
Q: What do security teams get wrong about API posture governance?
A: They often treat it as a policy document exercise instead of a live control.
Practitioner guidance
- Build a continuously reconciled API inventory Link discovery to asset ownership, authentication method, data sensitivity, and last-seen usage so the register reflects live environment state.
- Instrument runtime alerts for identity-sensitive API behaviour Detect token reuse, unexpected privilege changes, unusual client geographies, and access to endpoints outside normal service patterns.
- Map each API to an explicit control owner Assign ownership across application, IAM, and platform teams so authentication, authorization, logging, and exception handling are reviewed together.
What's in the full report
Salt's full report covers the operational detail this post intentionally leaves for the source:
- Benchmark detail on how often organisations monitor APIs and where their inventories are breaking down.
- Adoption data for OWASP Top Ten guidance and posture governance practices across security teams.
- Breakouts on budget, staffing, and tooling constraints that shape real API security programmes.
- The report’s discussion of generative AI risks affecting API quality, runtime assurance, and code security.
👉 Read Salt's 2025 State of API Security Report →
API inventories and runtime gaps: what security teams need to act on?
Explore further
02/08/2026 1:29 pm
API security now depends on identity-aware governance, not just endpoint discovery. Inventory accuracy matters, but inventories that do not capture the identity attached to each API call leave teams blind to privilege and trust relationships. APIs are often operated by service accounts, tokens, and automated workflows, so the real governance question is who or what is calling the interface and under what scope. Practitioners should treat API estate management as an IAM and NHI control problem, not only an application security task.
A question worth separating out:
Q: How do you know if API endpoint security controls are actually working?
A: Look for consistent method enforcement, low rates of anomalous requests, clear separation between read and write operations and stable auth outcomes across services. If the same credential can reach unexpected routes or if the gateway allows behaviour that the design never intended, the control is only partially effective.
👉 Read our full editorial: API security inventories are lagging behind usage and governance
