Topic starter
08/02/2026 8:30 pm
TL;DR: API security protects the hidden machine-to-machine layer between SaaS apps, where OAuth tokens, API keys, and other non-human identities can bypass SSO and MFA, and SaaS-to-SaaS data moves 10x faster than human-to-SaaS interactions, according to Obsidian Security. Static inventories are not enough because compromise is visible in behavior, not possession alone.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “What is API Security? Protecting the Hidden Layer Between SaaS Apps”.
By the numbers:
- SaaS-to-SaaS data moves 10x faster than human-to-SaaS interactions, according to Obsidian Security.
Key questions
Q: What breaks when API security is managed like human SSO security?
A: SaaS integrations keep working outside the login flow, so SSO and MFA only protect the human front door.
Q: Why do compromised API keys create such a broad security impact in hybrid work environments?
A: A compromised API key can authenticate as a trusted non-human identity, so the attacker inherits whatever actions that key can perform.
Q: What are the signs that third-party app or API activity is being abused?
A: Warning signs include unusual access patterns, unexpected data retrieval, abnormal cache behaviour, unexplained directory exposure, and activity from third-party applications outside normal business timing.
Practitioner guidance
- Discover all SaaS integrations and machine identities Build and maintain a complete inventory of OAuth apps, API keys, webhooks, and service accounts across core SaaS platforms, including shadow integrations created outside formal review.
- Recertify inherited integration privileges Review scopes, admin-level grants, and dormant third-party access on a defined cadence so inherited permissions do not outlive the business need that approved them.
- Detect behavioural anomalies in API activity Baseline request volume, data export patterns, source IPs, and access timing for each integration, then alert on deviations that indicate valid credentials are being abused.
Bottom line: API security is the control layer that governs SaaS-to-SaaS trust, and human-centric controls do not cover it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
08/10/2026 4:32 pm
API security is now SaaS supply chain security in practice. The article shows that the exposed layer is not the login screen but the machine-to-machine trust fabric underneath it. SSO and MFA still matter for humans, but they do not govern OAuth tokens, API keys, or inherited integration scopes. The implication is that identity programmes must treat connected SaaS relationships as part of the access model, not as a separate technical detail.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: When should organisations prioritise API behavioural monitoring over static inventory?
A: When integrations are numerous, privileges are inherited, and long-lived credentials already exist, behavioural monitoring should come first because inventory cannot show misuse. Inventory is still useful for discovery, but it does not reveal active abuse or anomalous use of valid credentials. The priority is to detect what is happening, not just what is connected.
👉 Read our full editorial: API security and SaaS supply chain risk: what teams miss