Topic starter
19/08/2026 3:41 pm
TL;DR: API security has become a core governance problem because APIs now sit in critical business flows, expose hidden attack surfaces, and fail in areas like discovery, authorization, and business logic, according to Pynt. For IAM and NHI teams, the lesson is that Zero Trust only works when every API call, token, and delegated access path is continuously governed.
Editorial analysis by NHI Mgmt Group, based on content published by Pynt: “How API Security became the Biggest Security Challenge in 2023”.
Key questions
Q: Where does API security fail in practice when discovery is incomplete?
A: It fails when teams cannot see every endpoint, owner, and calling identity, because hidden APIs bypass the controls that would normally enforce authentication, authorization, and monitoring.
Q: Why do valid API requests still create breach risk?
A: Valid API requests still create breach risk because authentication proves the caller is known, not that the caller is entitled to the specific object.
Q: How can teams tell whether API governance is actually working?
A: A working programme can answer four questions quickly: who owns the consumer, what it can access, where the policy is enforced, and how the call is logged.
Practitioner guidance
- Inventory every production API and undocumented endpoint Build a live inventory that ties each API to an owner, authentication method, token type, and business function so nothing remains outside governance.
- Map API access to specific identities and scopes Trace every service account, token, and delegated permission to the exact API actions it can perform, then remove scope that exceeds business need.
- Test business workflows for authorization bypass Use adversarial testing to validate object-level and function-level authorization across real user journeys, not just against generic injection cases.
Bottom line: API security is now a governance issue because access often lives in tokens, service identities, and workflow logic rather than in a single perimeter control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:20 pm
API security has become an identity governance problem, not just an application security problem. Modern APIs often carry the permissions that move data and trigger business actions, so authorization failures are really governance failures over delegated access. When a token or service account can reach more than it should, the API is exposing an access model, not just an endpoint. Practitioners should treat API authorization as part of identity governance.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
- 71% of organizations use third-party APIs, according to Gartner’s 2024 data.
A question worth separating out:
Q: Should organisations treat APIs as identity and access control points?
A: Yes. APIs increasingly carry user, service, and third-party access decisions, so they function as active identity control points. That means token scope, response minimisation, delegation, and lifecycle management all matter. If those controls are weak, the API becomes a pathway for unauthorised disclosure even when authentication is intact.
👉 Read our full editorial: API security is now an identity and governance problem