Notifications
Clear all
Topic starter
06/09/2026 5:18 pm
TL;DR: API incidents affected 84% of organisations in the past year, while only 27% believe they have an accurate inventory of APIs that return sensitive data, according to LEVO's analysis. Standards matter because API security now depends on continuous discovery, authorization checks, and runtime monitoring, not just design-time documentation.
NHIMG editorial — based on content published by LEVO: API security standards and runtime governance for modern APIs
By the numbers:
- 84 % of organizations experienced an API security incident in the past year
- only 27 % believe they have an accurate inventory of the APIs that return sensitive data
- more than 60% of enterprises update APIs monthly or weekly
Questions worth separating out
Q: How should security teams govern APIs that change frequently?
A: Security teams should treat fast-changing APIs as continuously governed assets, not quarterly review items.
Q: Why do broken object level authorization issues keep appearing in API programs?
A: They appear because many teams authenticate the caller but do not re-check ownership at the object or function level.
Q: What are the signs that API security monitoring is failing?
A: API monitoring is failing when teams cannot see request patterns, access failures, or unusual traffic in real time.
Practitioner guidance
- Implement continuous API discovery Build an inventory that updates as services change, including endpoints that return sensitive data, internal APIs, and shadow interfaces.
- Enforce object and function level authorization Test every high-risk endpoint for broken object level authorization, broken function level authorization, and overbroad response fields.
- Generate audit evidence from live traffic Use runtime traces, logs, and policy evaluation results to prove how sensitive data moves and how access decisions are enforced.
What's in the full article
LEVO's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance for securing REST, SOAP, and GraphQL APIs across design, testing, and runtime phases
- Examples of how runtime traces are used to generate audit-ready evidence for compliance teams
- Detailed mappings to API security standards and regulatory expectations for payment and data protection environments
- Operational patterns for continuous discovery and automated validation across large API estates
👉 Read LEVO's full analysis of API security standards and runtime governance →
API security standards: are your controls keeping up with runtime drift?
Explore further
06/09/2026 5:19 pm
API security has become a governance problem, not just an application security problem. The article shows that design-time standards are insufficient when APIs change weekly or daily and live behaviour determines exposure. For identity teams, this is the same structural problem seen in token and service-account governance: policy only matters if runtime enforcement and verification keep pace. Practitioners should treat API security as a continuous control plane, not a documentation exercise.
A question worth separating out:
Q: Should organisations treat APIs as identity and access control points?
A: Yes. APIs increasingly carry user, service, and third-party access decisions, so they function as active identity control points. That means token scope, response minimisation, delegation, and lifecycle management all matter. If those controls are weak, the API becomes a pathway for unauthorised disclosure even when authentication is intact.
👉 Read our full editorial: API security standards are becoming a runtime governance problem
