Topic starter
02/08/2026 11:32 am
TL;DR: API incidents are still widespread, with Salt Security saying 95% of organisations experienced one and OWASP tying about 40% of API attacks to broken object level authorization, according to Salt Security. API programmes need fresh inventory, object-level checks, and token governance to keep valid access from turning into abuse.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “OWASP API Security Top 10 2023 Explained”.
By the numbers:
- 95% of organizations experienced some form of API security incident, according to Salt.
- Broken object level authorization is represented in about 40% of all API attacks, according to Salt.
Key questions
Q: Why do APIs with weak object-level authorization create such a large risk?
A: Because the attack is usually just a parameter change, not a noisy exploit.
Q: What are the signs that API inventory management is failing in practice?
A: Common signs include endpoints that are reachable in production but missing from the inventory, documented APIs that no longer receive traffic, and versioned or deprecated APIs that remain accessible.
Q: Where does API security fail when teams lose control of access and inventory?
A: API security fails when authentication, authorization, and inventory are treated as separate problems.
Practitioner guidance
- Tighten object-level authorization checks Validate every request against the specific object and business action being accessed, not just the authenticated session or token.
- Harden API authentication flows Review token issuance, expiry, revocation, and replay resistance for the APIs that handle customer and internal workflow access.
- Build a live API inventory Track active, deprecated, and externally exposed APIs so undocumented versions can be retired before they become shadow attack paths.
Bottom line: The article shows that API risk is not limited to vulnerable endpoints. It is also a governance problem involving authorization, authentication, and the ability to see every live API.
Glossary terms: Broken Object-Level Authorization, Broken Authentication, API Inventory Management, Sensitive Business Flow
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 12:47 pm
API governance debt is now an identity problem as much as an application problem: once an API estate loses reliable inventory and entitlement visibility, access control becomes partial and reactive. The article shows that broken authentication, BOLA, and unsafe consumption all rely on assumptions about who or what is calling the API. That means API security teams, IAM teams, and platform teams have to treat inventory, token scope, and authorization as one control plane.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
- 71% of organizations use third-party APIs, according to Gartner’s 2024 data.
A question worth separating out:
Q: What should teams do when API abuse targets business logic instead of technical flaws?
A: Treat the workflow itself as the control point. Add usage thresholds, abuse detection, and entitlement checks around sensitive API flows so legitimate authentication does not become a free pass for automation, mass data access, or repeated state changes.
👉 Read our full editorial: OWASP API security risks expose gaps in access and inventory