Notifications
Clear all
Topic starter
06/09/2026 5:18 pm
TL;DR: APIs account for more than 71% of web traffic, 84% of organisations have experienced an API security incident, and AI agents are now consuming APIs at machine scale, according to LEVO. The result is a broader attack surface where authorization failures, unsafe consumption, and inventory gaps turn API security into a governance problem, not just an engineering one.
NHIMG editorial — based on content published by LEVO: OWASP API Security Top 10 and its implications for modern APIs
By the numbers:
- API calls accounted for more than 71% of all web traffic in 2024.
- 84% of organisations experienced an API security incident.
Questions worth separating out
Q: What breaks when API authorization only checks the logged-in user, not the object being accessed?
A: Broken object-level authorization creates a gap where an authenticated caller can still reach records, properties, or functions it should never see.
Q: Why do AI coding agents make application security harder to govern?
A: AI coding agents increase risk because they can generate large volumes of code quickly, often optimised for function over security.
Q: How can security teams tell if they have a hidden API inventory problem?
A: The strongest signal is when teams cannot confidently name every internal, partner, and deprecated endpoint that still receives traffic.
Practitioner guidance
- Implement object-level authorization checks Require every API request to evaluate the caller against the specific object, property, or function being accessed.
- Scope API tokens for machine-scale use Use short-lived, narrowly scoped tokens and rotate secrets that back service-to-service access.
- Build continuous API discovery Automatically catalogue internal, external, partner, deprecated, and shadow APIs across environments.
What's in the full article
LEVO's full article covers the operational detail this post intentionally leaves for the source:
- A category-by-category walkthrough of the OWASP API Security Top 10 with implementation examples for each weakness.
- Practical mitigation guidance for discovery, runtime monitoring, and business logic testing in live environments.
- Expanded discussion of how AI agents and machine-scale consumers change API abuse patterns.
- Examples of how API security failures translate into revenue loss, breach cost, and operational disruption.
👉 Read LEVO’s analysis of the OWASP API Security Top 10 and AI-era API risk →
OWASP API security top 10: are your controls keeping up?
Explore further
06/09/2026 5:19 pm
API security is now an identity governance problem, not only an application security problem. Once APIs become the primary interface for humans, partners, and AI systems, the question shifts from whether an endpoint is reachable to whether the calling identity is authorised for the object, function, and business flow being touched. That makes IAM, PAM, and workload identity controls central to API governance, especially where secrets and tokens are reused across services. The practical conclusion is that API control design now belongs in identity governance discussions, not only in engineering backlog triage.
A question worth separating out:
Q: Should organisations prioritise API discovery or runtime controls first?
A: They should do both, but discovery comes first when the inventory is incomplete because you cannot govern what you cannot see. Runtime controls matter immediately for exposed interfaces, yet they will miss shadow and zombie APIs that remain outside policy. The best sequence is discover, classify, then enforce.
👉 Read our full editorial: OWASP API security top 10 now defines AI era attack surface
