Topic starter
06/09/2026 5:18 pm
TL;DR: APIs now carry more than 90% of global web traffic, and LEVO says insecure APIs are a rising breach driver, with IBM putting the average data breach at US $4.44 million and shadow AI or ungoverned APIs adding US $670,000 on average. The shift from periodic scans to continuous validation matters because static testing cannot keep pace with microservices, CI/CD, and changing access scopes.
Editorial analysis by NHI Mgmt Group, based on content published by LEVO: “API Security Testing Checklist (2026)”.
By the numbers:
- APIs handle over 90% of global web traffic, which makes them a dominant attack surface for security teams.
- By 2026, Gartner predicts 80% of data breaches will involve insecure APIs.
- IBM’s 2025 Cost of a Data Breach Report says organisations with shadow AI or ungoverned APIs added US $670,000 on average to breach cost.
Key questions
Q: What breaks when API security is based only on vulnerability scanning?
A: What breaks is the assumption that every API risk is a code flaw.
Q: Why do insecure APIs so often become breach drivers?
A: APIs concentrate authentication, authorisation, and data access into a small number of machine-to-machine trust paths.
Q: What are the signs that API security monitoring is failing?
A: API monitoring is failing when teams cannot see request patterns, access failures, or unusual traffic in real time.
Practitioner guidance
- Continuously inventory every API endpoint Tie each endpoint to an owner, environment, authentication method, and retirement date so shadow APIs do not sit outside governance.
- Test live authorisation paths after deployment Run automated checks whenever routes, scopes, tokens, or dependencies change so runtime auth drift is detected before attackers abuse it.
- Validate business workflows, not just endpoints Exercise multi-step flows such as registration, reset, checkout, and delegated access to expose sequence abuse and IDOR patterns.
Bottom line: APIs now sit at the intersection of application security and identity governance, because they carry the tokens, scopes, and access decisions that attackers abuse.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 5:19 pm
Continuous validation is now the control boundary for API trust. API security can no longer be treated as a pre-release testing exercise because the risk changes after deployment. Once scopes, routes, and dependencies shift, the control that matters is whether the live API still enforces the intended identity and authorisation model. Practitioners should treat runtime validation as part of access governance, not just application testing.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: How should teams govern APIs that are increasingly consumed by agents?
A: Teams should govern them as production capabilities with explicit trust tiers, version policy, schema ownership and lifecycle controls. The key change is that machine consumers do not behave like human developers, so governance must be enforced at publication, promotion and revocation rather than relying on informal usage patterns.
👉 Read our full editorial: API security testing now depends on continuous runtime validation