Notifications
Clear all
Topic starter
06/09/2026 3:45 pm
TL;DR: API WAFs only protect APIs that are known, onboarded, and continuously mapped, while undiscovered interfaces receive no inspection, rate limiting, or monitoring, according to LEVO's analysis. The governance lesson is that API discovery must be treated as an ongoing control because static inventories quickly diverge from production reality.
NHIMG editorial — based on content published by LEVO: API WAF Blind Spots: Are You Protecting What You Can Actually See?
By the numbers:
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, reinforcing how control drift creates exposure.
Questions worth separating out
Q: What breaks when API discovery is incomplete?
A: When discovery is incomplete, security teams miss shadow APIs, forgotten integrations, and endpoints that no longer have an obvious owner.
Q: Why do undiscovered APIs create outsized risk in application security programs?
A: Undiscovered APIs create risk because teams cannot test, monitor, or govern what they do not know exists.
Q: How should security teams verify that WAF coverage is actually complete?
A: Start with external discovery, not policy documents.
Practitioner guidance
- Implement runtime API detection Use live traffic observation to surface endpoints, queries, and methods that documentation and gateways miss.
- Reconcile WAF scope against production reality Compare protected paths and services with runtime-discovered APIs on a fixed cadence.
- Treat discovery drift as a control exception Create a formal workflow for APIs that appear outside approved onboarding paths, including security review, ownership assignment, and enforcement enrollment before broad exposure continues.
What's in the full article
LEVO's full analysis covers the operational detail this post intentionally leaves for the source:
- How API detection, inventory, and monitoring are chained together in a practical enforcement model.
- Which protocol-specific surfaces, including GraphQL and gRPC, create the hardest discovery gaps.
- How runtime observation changes WAF scope assignment across internal, partner, and externally reachable APIs.
- Why continuous validation is needed to keep enforcement aligned with live traffic as systems change.
👉 Read LEVO's analysis of API WAF blind spots and discovery drift →
API WAF blind spots: what discovery gaps mean for security teams?
Explore further
06/09/2026 3:45 pm
API discovery debt is the real control gap here. The article shows that WAFs do not fail first at enforcement, they fail at scope definition. When discovery lags production, protection is applied only to the subset of interfaces already known to governance. That is structurally similar to identity blind spots in NHI programmes, where controls break down once assets exist outside the inventory. Practitioners should treat discovery debt as a first-class security risk, not an operational inconvenience.
A question worth separating out:
Q: Should organisations prioritise API discovery before deeper vulnerability testing?
A: Yes, when the estate is incomplete or fast-changing. If you cannot reliably identify all exposed APIs, deeper testing will understate risk because it will miss services that are live, reachable, and potentially sensitive but absent from the original scan plan.
👉 Read our full editorial: API WAF blind spots expose why discovery must be continuous
