Topic starter
01/08/2026 8:56 pm
TL;DR: Zero trust is widely adopted, with 57% calling it a major consideration and 83% of internet traffic now described as API traffic in Salt Security’s webinar discussion, but the same controls can fail when APIs are unknown or abused by authenticated users. The governance gap is not trust alone, it is inventory, privilege, and exposure management across machine-access pathways.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “3 Top Takeaways on API Security and Zero Trust”.
By the numbers:
- 57% said zero trust is a major consideration in their current security architecture.
Key questions
Q: What breaks when zero trust is applied to APIs without lifecycle and inventory controls?
A: Zero trust does not fail because the access model is wrong.
Q: Why do authenticated API users still create security risk?
A: Because valid credentials can still be abused.
Q: How can security teams tell whether API exposure is becoming a governance problem?
A: Look for endpoints that return personal data without a clear identity decision, weak logging around record retrieval, and approval gaps between development and production.
Practitioner guidance
- Implement continuous API discovery Maintain an authoritative inventory of internal, external, and partner APIs, with named owners and retirement dates, so shadow and zombie interfaces cannot sit outside policy.
- Tighten API authorisation scope Review service tokens, user keys, and delegated permissions to ensure each API path only exposes the data and actions required for its business function.
- Separate authentication from data-use controls Apply monitoring for unusual query patterns, excessive data access, and function misuse even when requests are authenticated and accepted by zero trust policy.
Bottom line: Zero trust improves verification, but it does not automatically solve API exposure, lifecycle, or misuse problems in hybrid environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:04 pm
API security is not solved by zero trust alone: zero trust changes how access is verified, but it does not eliminate the need to know which APIs exist, who owns them, and what data they expose. The article’s core lesson is that authenticated reachability is not the same as governed access. Practitioners should treat API discovery, authorisation scope, and exposure management as first-class identity controls, not downstream technical details.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat zero trust and API security as separate programmes?
A: No. They are linked but not interchangeable. Zero trust governs how access is verified, while API security governs what reachable services can expose and how they can be abused after authentication. Teams should align the two so identity controls and API lifecycle controls reinforce each other.
👉 Read our full editorial: Zero trust does not solve API security gaps in hybrid environments