Topic starter
06/09/2026 5:18 pm
TL;DR: Web applications and APIs now absorb most attacker attention, with LEVO citing 271 million API attacks in a single quarter of 2024, APIs facing about 85% more attacks than standard web applications, and the average breach costing 4.45 million dollars. Traditional WAFs cannot keep pace with API discovery, schema abuse, bot automation, and runtime behaviour, so WAAP has become the practical baseline for modern application protection.
Editorial analysis by NHI Mgmt Group, based on content published by LEVO: “What is Web Application and API Protection (WAAP)”.
By the numbers:
- LEVO cites more than 271 million API attacks in a single quarter of 2024.
- LEVO says APIs faced roughly 85% more attacks than standard web applications.
- LEVO notes that the average data breach now costs enterprises 4.45 million dollars.
Key questions
Q: What breaks when a WAF is used without WAAP for modern APIs?
A: A WAF alone often misses the controls that matter most for APIs, including discovery, schema validation, object-level authorisation, and behavioural abuse detection.
Q: Why do APIs need different controls from traditional web applications?
A: APIs expose structured requests, machine-to-machine access, and business actions that are not visible in the same way as browser traffic.
Q: How do security teams know whether WAAP is actually reducing risk?
A: Look for fewer successful abuse attempts, lower false-positive rates, complete coverage of critical APIs, and telemetry that shows blocked anomalies without breaking legitimate traffic.
Practitioner guidance
- Inventory every exposed web application and API Build a complete catalogue of internet-facing services, shadow endpoints, and partner integrations before onboarding policy.
- Enforce schema and object-level checks Require request validation against approved schemas and object identifiers, especially for JSON and GraphQL traffic.
- Run WAAP in monitor mode before blocking Use a learning period to separate benign variation from true abuse, then move to enforcement in stages.
Bottom line: WAAP is becoming the control baseline because modern attacks target application logic, machine-to-machine calls, and bot abuse that traditional WAF rules do not govern well.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 5:19 pm
WAAP is becoming the practical baseline because application security has shifted from page protection to request governance. The article’s central point is not that WAFs disappeared, but that they no longer cover the full decision space around modern APIs. Once endpoints become dynamic and distributed, request legitimacy depends on schema, caller context, and runtime behaviour. Practitioners should treat WAAP as the minimum control layer for externally reachable applications.
A question worth separating out:
Q: Should teams prioritise API discovery or enforcement first?
A: Discovery comes first when shadow endpoints or incomplete inventories exist, because enforcement cannot protect what the team has not identified. Once the exposed surface is known, prioritise the most sensitive and most attacked APIs for schema validation, bot controls, and runtime enforcement.
👉 Read our full editorial: WAAP is becoming the baseline for web and API attack defence