Notifications
Clear all
Topic starter
25/06/2026 1:12 am
TL;DR: Over 80% of enterprises have API defenses misaligned with data sensitivity, according to Raidiam, while one of 68 organisations in its survey used full mTLS and certificate-bound tokens, and 70% lacked contextual or fine-grained access control. The core issue is not API volume but identity assurance, authorisation depth, and monitoring discipline that current programmes still underweight.
NHIMG editorial — based on content published by Raidiam: API Security Checklist: Your Essential Guide to Protecting APIs in 2025
By the numbers:
- Over 80% of enterprises had API defenses dangerously misaligned with the sensitivity of their data.
- Only one of 68 organizations in Raidiam’s survey used full mTLS and certificate-bound tokens.
- Over 70% of surveyed organizations lacked any form of contextual or fine-grained access control.
Questions worth separating out
Q: How should security teams secure APIs that expose sensitive data?
A: Start by binding access to stronger identity proofs, then narrow authorisation to the specific transaction or resource being called.
Q: Why do APIs create NHI governance risk?
A: APIs often rely on non-human identities such as service accounts, tokens, and partner credentials.
Q: What breaks when API authorisation is too coarse?
A: Coarse authorisation usually allows authenticated callers to reach more data or more functions than the use case requires.
Practitioner guidance
- Replace static API keys with bound credentials Move sensitive APIs to certificate-bound tokens, private_key_jwt, or mTLS so stolen strings cannot be replayed outside the original client context.
- Scope API authorisation to context and transaction Use scopes, attributes, and endpoint-level policy to limit each caller to the smallest data set and operation set needed for the workflow.
- Unify API and identity telemetry Correlate gateway logs, token claims, and request behaviour so abnormal access patterns can be detected before bulk extraction succeeds.
What's in the full article
Raidiam's full research covers the operational detail this post intentionally leaves for the source:
- A deeper breakdown of the API security checklist items, including the authentication and transport controls behind each recommendation.
- Survey detail on where enterprises are most misaligned, including the specific control categories that remain weakest across sectors.
- The full set of standards references and implementation prompts for teams working toward financial-grade API security.
- Further examples of real-world API abuse patterns and the governance lessons practitioners can use when prioritising remediation.
👉 Read Raidiam's API security checklist for 2025 →
API security in 2025: where identity controls are still failing?
Explore further
25/06/2026 10:28 am
API security is now an identity governance problem, not just an application hardening task. The checklist is really about whether organisations can prove who or what is calling an API, with what assurance, and under which scope. That is classic IAM and NHI territory because APIs carry delegated machine access, partner access, and workload access across business boundaries. Practitioners should stop treating API controls as a separate silo and align them to identity lifecycle and access governance.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: How do organisations know if API monitoring is actually working?
A: Good monitoring shows who called which endpoint, with what scope, how often, and whether the request pattern matches normal business use. If teams can only see traffic volume but not identity and request intent, they do not have enough context to detect scraping, overuse, or delegated abuse. Monitoring must answer behaviour questions, not just availability questions.
👉 Read our full editorial: API security in 2025 exposes identity and access control gaps
