Notifications
Clear all
Topic starter
02/08/2026 12:28 pm
TL;DR: API security issues affected 99% of organisations last year, 95% of attacks targeted authenticated users, and only 15% of teams felt very confident in their API inventory, according to Salt Security. That combination shows why perimeter-only defence and incomplete discovery leave critical API paths underprotected.
NHIMG editorial — based on content published by Salt: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
By the numbers:
- 99% of organizations encountered API security issues last year, with 95% of attacks aimed at authenticated users.
- only 15% of organizations feel very confident in the accuracy of their API inventory
- the average API breach leads to at least 10 times more leaked data than typical security breaches
Questions worth separating out
Q: What breaks when API security teams cannot see all exposed endpoints?
A: When teams lack a complete API inventory, they lose the ability to assign ownership, enforce policy, and review access consistently.
Q: Why do authenticated API attacks bypass traditional perimeter defences?
A: Because the attacker often uses valid credentials, tokens, or trusted sessions, the traffic looks legitimate at the edge.
Q: What do security teams get wrong about API posture governance?
A: They often treat it as a late-stage scan rather than an operating model.
Practitioner guidance
- Build a continuous API inventory process Reconcile gateway logs, code repositories, service meshes, and cloud discovery data so shadow APIs and zombie APIs are identified before policy drift becomes exploitable.
- Bind API access to identity and entitlement context Map each high-value API action to the human user, service account, OAuth app, or workload token that can invoke it, then review whether the current scope is broader than the business task requires.
- Enforce posture governance on exposed endpoints Check for misconfigurations, missing authentication boundaries, and overly permissive methods on externally reachable and partner-facing APIs.
What's in the full article
Salt's full article covers the operational detail this post intentionally leaves for the source:
- The vendor's API discovery and inventory model for uncovering undocumented and shadow endpoints.
- Detailed guidance on posture governance controls for misconfigurations, policy enforcement, and API lifecycle coverage.
- The behavioural detection approach used to identify low-and-slow API abuse patterns that signature tools miss.
- Checklist-style questions for evaluating purpose-built API security platforms before implementation.
👉 Read Salt's analysis of why good enough API security leaves authenticated attacks underdefended →
API security visibility gaps: what IAM and SOC teams miss?
Explore further
02/08/2026 1:26 pm
API inventory drift is becoming an identity governance problem, not just an application security issue. When organisations cannot see every API, they cannot govern the identities and tokens that access those APIs, which leaves machine access outside lifecycle control. That creates a blind spot across IAM, NHI, and third-party integration oversight. Practitioners should treat discovery coverage as part of access governance, not merely asset management.
A question worth separating out:
Q: How should organisations align IAM with API security governance?
A: They should treat APIs as access paths that carry identity, privilege, and lifecycle obligations. That means service accounts, OAuth applications, and workload tokens need the same ownership, scope review, and retirement discipline that human accounts receive. Without that alignment, API security remains fragmented across teams.
👉 Read our full editorial: API security visibility gaps leave authenticated attacks underdefended
