Topic starter
06/09/2026 5:18 pm
TL;DR: SOAP APIs still underpin high-value banking, healthcare, telecom, and government workflows, but LEVO argues they are disproportionately exposed to XML parser abuse, WSDL reconnaissance, and WS-Security misconfiguration, alongside broader API abuse trends including 681% growth in malicious API traffic and incidents affecting 95% of organisations. The security problem is not SOAP itself, but the gap between its criticality and the weaker governance, visibility, and testing most teams apply to it.
Editorial analysis by NHI Mgmt Group, based on content published by LEVO: “SOAP API Security Testing: Complete 2026 Guide to Securing SOAP, WS-Security & XML-Based APIs”.
By the numbers:
- Malicious API traffic has risen by 681%, according to LEVO.
Key questions
Q: What breaks when SOAP services keep exposing WSDL contracts publicly?
A: Public WSDL exposure shortens attacker reconnaissance by revealing operations, schemas and endpoints in advance.
Q: Why do SOAP APIs need stricter XML validation than modern JSON APIs?
A: SOAP relies on parser-heavy XML processing, which creates unique abuse paths such as XXE, entity expansion and schema manipulation.
Q: What do security teams get wrong about WS-Security in SOAP environments?
A: Teams often assume that signatures or encryption automatically protect the whole message, when in practice only parts of the payload may be validated.
Practitioner guidance
- Map every SOAP endpoint and WSDL Build and maintain an inventory of live SOAP services, exposed contracts and deprecated interfaces so owners know what is still reachable.
- Harden XML parsing and schema validation Disable external entity resolution, constrain recursive processing and enforce strict schema checks on all inbound SOAP messages.
- Test WS-Security message handling Validate signature coverage, timestamp freshness, replay handling and element substitution across authenticated SOAP operations.
Bottom line: SOAP remains embedded in critical workflows, but many organisations still underinvest in its inventory, testing and message-layer controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 5:19 pm
SOAP security debt is really interface governance debt: the article shows that the core weakness is not the protocol but the way long-lived interfaces escape modern visibility, ownership and testing. SOAP remains embedded in critical workflows, yet many teams still treat it as inherited infrastructure rather than a governed control surface. Practitioners should manage SOAP as a live access and integrity domain, not as legacy plumbing.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
A question worth separating out:
A: Teams should treat SOAP and XML services as part of the same API estate as modern REST, not as legacy exceptions. A practical approach is to centralise policy enforcement, validate message structure, transform payloads where needed, and route requests through a consistent governance layer. That reduces ad hoc handling and gives security, integration, and operations teams one place to control access and behavior.
👉 Read our full editorial: SOAP API security gaps persist in legacy systems and critical workflows