Notifications
Clear all
Topic starter
06/09/2026 5:18 pm
TL;DR: APIs now carry more than 90% of global web traffic, and LEVO says insecure APIs are a rising breach driver, with IBM putting the average data breach at US $4.44 million and shadow AI or ungoverned APIs adding US $670,000 on average. The shift from periodic scans to continuous validation matters because static testing cannot keep pace with microservices, CI/CD, and changing access scopes.
NHIMG editorial — based on content published by LEVO: API security testing checklist and continuous validation guidance
By the numbers:
- APIs handle over 90% of global web traffic, however, that reach comes with the risk of exposure.
- By 2026, Gartner predicts 80% of data breaches will involve insecure APIs.
Questions worth separating out
Q: What breaks when API testing is only done on a schedule?
A: The control breaks whenever business logic, authentication behaviour, or integrations change between assessments.
Q: Why do unsecured APIs create operational and security risk in modern environments?
A: Unsecured APIs create risk because they often move sensitive data between systems and are exposed to broad, automated access.
Q: How do teams know if API security testing is actually effective?
A: Look for coverage of realistic workflows, successful reuse of returned values, and findings that map to business operations instead of only parameter errors.
Practitioner guidance
- Map API authentication to identity governance Inventory every API that accepts OAuth tokens, JWTs, service credentials, or keys, then assign an owner for scope review, revocation, and exception handling.
- Add continuous secret exposure checks Scan repositories, CI/CD variables, and deployment manifests for hardcoded API keys and other embedded secrets on every build.
- Test business logic, not just syntax Build test cases for IDOR, privilege escalation, replay, and workflow skipping across registration, payment, and account-management paths.
What's in the full article
LEVO's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step API security testing checklist items for authentication, input validation, and configuration review
- Practical automation guidance for combining SAST, DAST, and runtime analysis inside CI/CD pipelines
- Levo.ai's implementation details for eBPF-based monitoring and zero-data processing
- Examples of how the platform scores risk by exploitability, authentication level, and data sensitivity
👉 Read LEVO's API security testing checklist for continuous runtime validation →
API security testing checklist gaps - are your controls keeping up?
Explore further
06/09/2026 5:19 pm
API security has become an identity governance problem, not just an application testing problem. The article is right to centre authentication, authorization, and token handling because APIs are now where machine access is translated into business access. That means IAM and PAM teams have a direct stake in how service accounts, OAuth scopes, and API keys are tested and monitored. The practitioner conclusion is simple: if identity controls are weak at the API layer, the application layer is already compromised.
A question worth separating out:
Q: Should organisations prioritise static testing or runtime testing first?
A: Prioritise based on where the risk appears first. If the main issue is insecure logic and code quality, start with static testing. If the main concern is deployed behaviour, APIs, or authentication flow, runtime testing deserves earlier attention. Mature programmes eventually need both to avoid false confidence.
👉 Read our full editorial: API security testing now depends on continuous runtime validation
