Topic starter
02/08/2026 12:26 pm
TL;DR: KuppingerCole’s 2025 Leadership Compass says securing AI depends on securing APIs first, with Salt Security cited for agentless API visibility, AI-powered threat detection, posture governance, and support for LLM-specific protections across REST, GraphQL, SOAP, and gRPC. The wider message is that API security is moving from point products to lifecycle governance, and identity-linked access controls now matter as much as detection.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “Beyond the Hype: What True API Security Leadership Looks Like”.
Key questions
Q: How should security teams govern APIs that change frequently?
A: Security teams should treat fast-changing APIs as continuously governed assets, not quarterly review items.
Q: Why do APIs create more risk when AI and automation depend on them?
A: Because APIs become the enforcement layer for machine and AI access, so weak authorization can widen blast radius quickly.
Q: What are the signs that API security monitoring is failing?
A: API monitoring is failing when teams cannot see request patterns, access failures, or unusual traffic in real time.
Practitioner guidance
- Map API inventory to lifecycle ownership Tie every API to an owner, a system of record, and a change process so discovery does not end as a static spreadsheet.
- Scope machine and AI access tightly Review tokens, service accounts, and delegated permissions for overbroad access to business functions, especially where automation or LLM calls are involved.
- Validate posture continuously across protocols Check that REST, GraphQL, SOAP, and gRPC APIs follow the same posture and policy baseline after deployment, not just during build.
Bottom line: API security is shifting from finding endpoints to governing them across build, deploy, and runtime stages.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:25 pm
Full-lifecycle API governance is becoming the real control plane. Discovery alone no longer describes API risk in modern environments because exposure changes after deployment and across multiple protocols. The stronger model combines inventory, posture, and runtime behavior into one governance loop. That matters for IAM and NHI programmes because APIs are often the enforcement layer for human users, service accounts, and AI systems alike.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: How do IAM and platform teams share responsibility for API security?
A: IAM teams should own entitlement model, lifecycle policy, and review standards, while platform teams enforce those decisions in gateways and service controls. The goal is not split accountability, but one operating model for machine access that both teams can measure and enforce consistently.
👉 Read our full editorial: API security leadership is shifting toward full-lifecycle protection