Topic starter
02/08/2026 12:26 pm
TL;DR: API usage rose for 92% of organisations over the past year, while many now run hundreds or thousands of undocumented shadow APIs, according to KuppingerCole’s 2025 Leadership Compass cited in Salt Security’s analysis. Point tools miss the lifecycle risk, because insecure design, weak discovery, and runtime abuse must be governed as one control plane.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “The Full Lifecycle Imperative: Why "Shift Left" Must Meet "Shift Right"”.
By the numbers:
- 92% of organizations increased API usage over the past year, with many operating hundreds to thousands of undocumented or unmonitored shadow APIs.
Key questions
Q: What breaks when API security is treated as a perimeter problem instead of an identity problem?
A: Controls miss the real attack path, which now often begins with valid credentials and moves through excessive authorization.
Q: Why do shadow APIs create such a large security gap?
A: Shadow APIs bypass ownership, policy enforcement, and change control, so defenders cannot reliably classify the data they expose or the identities that can reach them.
Q: How can security teams tell whether API risk controls are actually working?
A: Look for reduced abuse volume, fewer successful automated attacks, and clearer visibility into which non-human clients are making requests and why.
Practitioner guidance
- Implement continuous API discovery Map every external and internal API to an owner, data classification, and authentication method, then refresh that inventory continuously as services change.
- Unify design-time policy with runtime enforcement Use the same governance rules for development checks and live traffic so missing authentication, exposed data, and business logic risks are handled consistently.
- Treat API tokens as governed machine identities Assign scope, ownership, rotation, and offboarding rules to service tokens and other API credentials so they cannot outlive the application or integration they support.
Bottom line: API security breaks down when organisations rely on isolated tools instead of a lifecycle control model that covers design, discovery, deployment, and runtime.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:25 pm
API security debt is now lifecycle debt: the real governance failure is not a missing tool, but a control model that treats design, discovery, and runtime as separate obligations. Once API usage scales faster than inventory, every disconnected phase becomes a place where risk accumulates outside policy. Practitioners should judge API programmes by how well controls persist from build to runtime, not by how many point tools are deployed.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
- 71% of organizations use third-party APIs, according to Gartner’s 2024 data.
A question worth separating out:
Q: Should API governance treat service tokens like ordinary application secrets?
A: No. Service tokens carry machine identity and authorization scope, so they need ownership, rotation, offboarding, and scope review aligned to the API lifecycle. If teams manage them like static application secrets, credentials can outlive the service and preserve access long after intended use.
👉 Read our full editorial: API security must shift from point tools to full lifecycle control