Topic starter
02/08/2026 12:23 pm
TL;DR: 96% of attack attempts originate from authenticated entities, 80% of organisations still lack continuous API monitoring, and 50% have slowed or halted releases because of API risk, according to Salt’s H2 2025 State of API Security report. The message for security teams is clear: agentic AI increases API dependency faster than governance, so authorization, inventory accuracy, and runtime visibility now matter more than perimeter assumptions.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “From Bottleneck to Enabler: A New Approach to API Security in the Age of AI”.
By the numbers:
- 96% of attack attempts originate from authenticated entities, according to Salt.
- 80% of organisations still lack continuous API monitoring, according to Salt.
- 19% of organisations say they are very confident in the accuracy of their API inventories, according to Salt.
Key questions
Q: How should security teams govern API access for AI agents and service accounts?
A: Security teams should treat API access as a governed identity path, not a transport detail.
Q: Why do authenticated API calls create so much risk in agentic AI environments?
A: Because authentication only proves identity, not intent or scope.
Q: What breaks when API inventories are incomplete?
A: When inventories are incomplete, teams cannot reliably know which APIs exist, what data they expose, or which identities and tokens can reach them.
Practitioner guidance
- Establish a real-time API inventory Map every exposed, internal, and agent-facing API to an owner, caller type, credential type, and business function.
- Enforce object-level authorization checks Review every high-risk endpoint for broken object-level authorization and function-level overreach, especially where service accounts or agents can enumerate resources.
- Monitor authenticated API behaviour in runtime Build detections for unusual request volume, sequence changes, privilege drift, and machine-speed repetition from otherwise valid identities.
Bottom line: API security is no longer a narrow application concern because agentic AI, service identities, and human users now meet at the same control plane.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:23 pm
API security has become identity governance by another name. When AI agents, service accounts, and human users all operate through APIs, the governance question is no longer only who logged in. It is what each authenticated identity can do, at what object scope, and under which runtime conditions. For IAM and NHI teams, API authorization is now a primary control boundary, not a secondary application detail.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should organisations prioritise runtime monitoring over periodic API reviews?
A: Prioritise runtime monitoring when APIs support high-frequency automation, agentic workflows, or business-critical data flows. Periodic reviews cannot keep up with call volume, privilege drift, or changing dependencies. Continuous observation is the only way to see misuse after authentication and before it becomes release disruption or data exposure.
👉 Read our full editorial: API security is now the control plane for agentic AI