Notifications
Clear all
Topic starter
02/08/2026 12:19 pm
TL;DR: Edge controls can block obvious traffic, but they miss shadow APIs, third-party API flows, and slow-moving abuse patterns such as BOLA, according to Salt. API security needs discovery, posture governance, and runtime monitoring because perimeter enforcement alone cannot govern what it cannot see.
NHIMG editorial — based on content published by Salt: why API security cannot be fully addressed at the edge
Questions worth separating out
Q: How should security teams discover APIs that bypass gateways and WAFs?
A: Use continuous discovery that blends traffic analysis, service mapping, and inventory reconciliation.
Q: Why do third-party API calls create identity governance risk?
A: Because they move sensitive data and delegated authority outside the control points that IAM teams usually monitor.
Q: What do teams get wrong about detecting BOLA attacks?
A: They often look for a single malicious request instead of a pattern of repeated, low-signal access over time.
Practitioner guidance
- Inventory every exposed and internal API Reconcile gateway logs, service catalogs, and application telemetry to find undocumented APIs, direct routes, and shadow endpoints that bypass perimeter controls.
- Monitor east-west and outbound API traffic Inspect workload-to-workload and third-party API calls for sensitive payloads, token use, and logging risks that never appear at the edge.
- Correlate object access across time Detect BOLA-style abuse by linking repeated identifier changes, cross-account requests, and low-and-slow enumeration into a single behavioural view.
What's in the full article
Salt's full article covers the operational detail this post intentionally leaves for the source:
- Practical examples of how edge tools miss undocumented APIs and direct workload traffic
- Salt's explanation of posture governance for APIs across the lifecycle
- Runtime detection examples for low-and-slow API abuse such as BOLA
- Implementation-oriented detail on discovering and securing third-party API dependencies
👉 Read Salt's analysis of why API security cannot stop at the edge →
API security beyond the edge: are your controls keeping up?
Explore further
02/08/2026 1:20 pm
Perimeter-first API security creates a visibility gap, not a governance model. WAFs and gateways are enforcement points, but they cannot govern what bypasses them. That means shadow endpoints, internal service calls, and third-party API flows become unmanaged by default. The governance failure is not just incomplete detection, but a broken assumption that the edge is the system boundary.
A question worth separating out:
Q: What should organisations do when an API is discovered outside approved controls?
A: Treat it as an unmanaged production asset and suspend blind trust until ownership, exposure, and authorisation are verified. Then determine whether the API handles identity data, secrets, or sensitive business functions, because that changes both the monitoring threshold and the remediation priority.
👉 Read our full editorial: API security beyond the edge: why discovery and runtime matter
