Topic starter
13/09/2026 7:02 pm
TL;DR: APIs have become the enterprise’s largest unmanaged attack surface because inventory gaps, broken authorization, and scanner blind spots let critical endpoints slip past traditional perimeter and AppSec controls, according to ArmorCode. The governance problem is not finding more issues, but building ownership, discovery, and prioritisation across distributed routes before attackers turn logic flaws into business impact.
Editorial analysis by NHI Mgmt Group, based on content published by ArmorCode: “API Security Vulnerabilities: The Hidden Attack Surface”.
By the numbers:
- Akamai’s 2026 data shows unauthorized workflows and abnormal behavior accounted for 61% of all API attacks in 2025, up from 30% the year before.
- Customers using ArmorCode to run correlated remediation reported remediation accelerated by up to 97% and alert volume cut by up to 90%.
Key questions
Q: What breaks when APIs are not inventoried and monitored properly?
A: Uninventoried APIs become shadow trust surfaces.
Q: Why do broken object and function authorisation keep causing API breaches?
A: Because the application often checks identity at login but fails to bind that identity to the object or action being requested at runtime.
Q: How do teams know if API security testing is actually effective?
A: Look for coverage of realistic workflows, successful reuse of returned values, and findings that map to business operations instead of only parameter errors.
Practitioner guidance
- Implement continuous API discovery Aggregate gateway, ingress, network, and repository signals into a live endpoint register that tracks exposure, owners, and data sensitivity.
- Test object ownership and function enforcement Validate every sensitive route for BOLA and BFLA by checking server-side ownership, role enforcement, and workflow authorization rather than relying on UI controls.
- Prioritise API findings by reachable business impact Correlate scanner output with ownership and data-flow context so remediation starts with routes that can expose records, invoke privileged actions, or trigger costly workflows.
Bottom line: API security weaknesses persist because many endpoints are never fully inventoried, owned, or reviewed before they reach production.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/09/2026 7:02 pm
API inventory debt is now a governance failure, not a tooling gap. When an organisation cannot enumerate its endpoints, it cannot assign ownership, enforce policy, or prove scope. That creates hidden routes that bypass the same controls teams rely on for web applications. Practitioners should treat discovery as a continuous control, not a one-time scan.
A few things that frame the scale:
- More than 80% of enterprises will have used generative AI APIs or deployed GenAI applications by 2026, up from 5% in 2023, according to Gartner.
A question worth separating out:
Q: How should organisations align IAM with API security governance?
A: They should treat APIs as access paths that carry identity, privilege, and lifecycle obligations. That means service accounts, OAuth applications, and workload tokens need the same ownership, scope review, and retirement discipline that human accounts receive. Without that alignment, API security remains fragmented across teams.
👉 Read our full editorial: API security vulnerabilities expose the enterprise's hidden attack surface