Notifications
Clear all
Topic starter
02/08/2026 12:14 pm
TL;DR: Cyber insurers are scrutinising API discovery, testing, and runtime protection more closely because shadow APIs, BOLA, weak authorisation, and poor monitoring can drive losses, exclusions, or higher premiums, according to Salt. The governance gap is not the gateway alone, but whether teams can prove they control the full API attack surface.
NHIMG editorial — based on content published by Salt: Navigating the cyber insurance market in 2025 through API security readiness
Questions worth separating out
Q: How should security teams prove API security maturity to cyber insurers?
A: They should show evidence, not just policy.
Q: Why do shadow APIs increase insurance and breach risk?
A: Shadow APIs expand the attack surface without corresponding ownership, testing, or monitoring.
Q: What do teams get wrong about API gateway protection?
A: Teams often assume that a clean request and a documented schema mean the transaction is safe.
Practitioner guidance
- Implement continuous API discovery Build and maintain an authoritative inventory of internal, external, third-party, shadow, and zombie APIs.
- Test object-level authorisation Add negative testing for BOLA and related access-control failures in pre-production and regression pipelines.
- Extend identity controls to API endpoints Review whether service accounts, API keys, and tokens have the minimum permissions needed for each endpoint.
What's in the full article
Salt's full article covers the operational detail this post intentionally leaves for the source:
- How the vendor maps API discovery, posture checks, and runtime monitoring into insurance readiness.
- The specific control categories underwriters are likely to ask about when evaluating API exposure.
- Practical examples of API security evidence that can support renewal discussions.
- The vendor's checklist-style guidance for teams trying to close API governance gaps.
👉 Read Salt's analysis of API security and cyber insurance readiness →
API security and cyber insurance: is your control evidence enough?
Explore further
02/08/2026 1:17 pm
API security has become a governance evidence problem, not just a tooling problem. Insurers are asking organisations to prove that they can discover, test, and monitor APIs because blind spots map directly to loss potential. That shifts the conversation from deployment status to control assurance. Practitioners should treat API inventories and testing results as underwriting evidence, not just internal security artefacts.
A question worth separating out:
Q: What should organisations do if APIs are already part of their cyber insurance review?
A: They should treat API controls as renewal evidence. Prioritise inventory completeness, negative testing for logic flaws, behavioural monitoring, and remediation reporting. If these controls are fragmented across application, cloud, and identity teams, assign clear ownership so the underwriting story reflects a coherent control framework rather than isolated technical checks.
👉 Read our full editorial: API security is becoming a cyber insurance governance issue
