Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk

Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss potential approaches for improving API security posture.

API Security with Cloudflare API Shield Demo

Cloudflare API Shield provides many capabilities across API discovery & management, posture management, and runtime protection. This demo highlights some of these capabilities including machine learning discovery, sequence analysis and mitigation, schema learning, schema validation, volumetric abuse protection, organizational / user-created labels, risk labels, sensitive data detection, and posture management.

Reality Bites: You're Only as Secure as Your Last API Deployment

In agile and DevOps-driven environments, APIs are frequently updated to meet evolving business demands, from adding new features to addressing performance issues. However, each deployment introduces potential security risks, as new code, configurations, and endpoints can expose vulnerabilities. In an environment of continuous integration and continuous deployment (CI/CD), the security of an organization’s APIs hinges on rigorous, continuous testing and proactive risk management.

Fireblocks' New Developer APIs: Build on Blockchain Without Complexity

Blockchain innovation is accelerating, offering new opportunities for developers to create secure applications. However, integrating blockchain infrastructure is getting increasingly complex. With more fragmentation, developers often have to juggle multiple tools, workarounds, and technical intricacies to manage network data, retrieve asset properties, and execute transactions effectively. This slows down innovation, increases operational overhead, and diverts focus from building great products.

Securing Canada's Digital Backbone: Navigating API Compliance

Canada's digital infrastructure relies heavily on APIs, facilitating a range of services from citizen interactions to vital government data exchanges. This interconnectedness, though revolutionary, brings forth intricate security challenges. Comprehending and complying with the Government of Canada's API standards is now imperative rather than optional. We will delve into these standards, the increasing threat landscape, and examine how solutions like Salt Security can protect your APIs.

AI Agents and API Security: The Hidden Risks Lurking in Your Business Logic

Modern organizations are becoming increasingly reliant on agentic AI, and for good reason: AI agents can dramatically improve efficiency and automate mission-critical functions like customer support, sales, operations, and even security. However, this deep integration into business processes introduces risks that, without proper API security, can compromise sensitive data and decision-making.

Kong Gateway Integration: Secure API Traffic with Astra

Kong API Gateway is widely used to manage API traffic efficiently, but ensuring its security requires a proactive approach. By integrating Astra’s API Security Platform with Kong, you can gain real-time insights into API activity, detect vulnerabilities, and block potential threats before they impact your systems.

API Security Risks and How to Mitigate Them

The industry treats API security like a checklist—patch a few issues, enforce some rules, and move on. But these risks aren’t isolated flaws; they’re symptoms of a deeper failure in how APIs are designed and secured. Built for speed and interoperability, APIs often expose more than intended, making security an afterthought.

Top 10 API Security Testing Tools for Mobile Apps in 2025

According to Salt Security's 2024 State of API Security Report, 80% of API attacks attempt to exploit one or more OWASP API Security Top 10 vulnerabilities. Yet, only 58% of organizations prioritize protection against these well-known threats. This gap leaves many businesses exposed to cyber risks that could have been prevented. Investing in API testing tools helps safeguard your mobile application ecosystem against evolving threats.

Postman API Security Testing Tutorial

According to a recent study by OWASP, 70% of all web applications are vulnerable to security risks. API security testing is one of the most effective ways to mitigate these risks. Postman is a popular tool for API security testing, with over 10 million users worldwide. In today's digital world, APIs are the backbone of most applications. As a result, they are also a prime target for hackers. This is why it's important to perform security testing on your APIs to ensure that they are not vulnerable to attack.

Why API Security Can't Wait: Protecting Your Business in an API-Driven World

In today’s hyper-connected digital landscape, APIs (Application Programming Interfaces) are the backbone of innovation. They power seamless integrations, drive generative AI applications, and enable businesses to scale rapidly. But with great power comes great risk. The explosive growth of APIs has created a sprawling attack surface that cybercriminals are eager to exploit.

Top 10 API Security Best Practices

Every day, organizations expose their APIs, unknowingly allowing cybercriminals to try and exploit them. A single vulnerability can lead to massive data breaches or help gain unauthorized access. Worst Part? Most organizations realize the weakness when it’s already too late. Without strong security measures, your API is a prime target for attackers trying to exploit unpatched vulnerabilities or misconfigurations in the environments.

APIs: The New Target for AI-Powered Attacks

With the rapid evolution of artificial intelligence (AI), attackers are now leveraging machine learning (ML) to mount sophisticated attacks on Application Programming Interfaces (APIs). These AI-powered threats, including adaptive bots, automated vulnerability scanning, and synthetic identity generation, represent a new wave of risks that traditional defenses are unable to address effectively.

Collaborate & Protect: The Future of API Security Strategy #CyberThreats #CISAReport #APISecurity

The API attack surface is rapidly expanding, with 50% of known exploited vulnerabilities now API-related (CISA). Security leaders must prioritize API security, implement real-time monitoring, and foster cross-team collaboration to stay ahead of threats. Strengthen your defenses now!

Data Leaks and AI Agents: Why Your APIs Could Be Exposing Sensitive Information

Most organizations are using AI in some way today, whether they know it or not. Some are merely beginning to experiment with it, using tools like chatbots. Others, however, have integrated agentic AI directly into their business procedures and APIs. While both types of organizations are undoubtedly realizing remarkable productivity and efficiency benefits, they may not know they are putting themselves at a significant security risk.

APIs: The Silent Highway for Sensitive Data

Think about how your banking app connects to payment processors or how your healthcare provider’s system shares records securely – APIs have become essential for modern digital interactions, enabling applications to communicate and share data effortlessly. However, this convenience comes at a cost: APIs often handle vast amounts of Personally Identifiable Information (PII), making them prime targets for API data exfiltration.

API Honeypot Results: How Fast Do Hackers Strike? #CyberThreats #InstantDefense #HackerSpeed

New APIs are attacked in just 29 seconds, according to Wallarm’s API honeypot test. Batch requests can extract 10M records in under 10 seconds, making real-time protection essential. Learn how to secure APIs before attackers strike.

Beyond Checkboxes: The Essential Need for Robust API Compliance

APIs serve as essential links in today’s digital infrastructure, enabling data sharing and application integration. However, their widespread use has made them prime targets for attackers. Hence, strict compliance with security regulations is not just optional; it is imperative for business success. The increasing frequency of data breaches and the sophistication of cyber threats highlight the pressing need for strong API security.

One PUT Request to Own Tomcat: CVE-2025-24813 RCE is in the Wild

A devastating new remote code execution (RCE) vulnerability, CVE-2025-24813, is now actively exploited in the wild. Attackers need just one PUT API request to take over vulnerable Apache Tomcat servers. The exploit, originally published by a Chinese forum user iSee857, is already available online: CVE-2025-24813 PoC by iSee857.

AI Security = API Security: 10x Surge in AI-Related CVEs #AIExploits #APIAttacks #SecureAI

AI-driven applications rely on APIs, making them a prime target for attackers. In 2024, AI-related CVEs increased 10x, with 98.6% of vulnerabilities linked to APIs. As AI agents interact with systems via APIs, security risks grow. Learn why securing AI means securing APIs.

Secure Your AI: Protecting Agentic AI in an API-Driven World

As enterprises embrace agentic AI for transformative business opportunities, they face a critical challenge: ensuring these intelligent systems operate securely. Wallarm, the leader in API-first security, invites you to an exclusive webinar to explore how to safeguard AI agents, APIs, and sensitive data from emerging threats. Learn how to protect your AI ecosystem and ensure business continuity with actionable insights from Wallarm Security Lab. Discover why 90% of agentic AI deployments are vulnerable and how to defend them.

Bringing Shadow and Zombie APIs to Light

Application Programming Interfaces (APIs) have revolutionized connectivity and data sharing, but their pervasiveness has also created a new set of cybersecurity challenges. As businesses continually expand and update their applications, they often overlook APIs left behind by developers — shadow and zombie APIs — that continue to operate undetected. These abandoned APIs become silent risks, operating in the background, unknown to most security teams, and they can pose serious security threats.

API Security Pricing: Complete Guide

Picture a company like a global logistics platform. On a regular Tuesday morning, shipments are crossing continents when the tracking updates suddenly stop. Then, delivery routes are rerouted by themselves, and thousands of customers are left with no information. A single exposed API endpoint or an authentication check that was left incomplete had drastic consequences for this company.

API Security Failures: What Went Wrong at Dell & Twilio? #APIBreach #DataLeak #DellHack

Major companies like Dell and Twilio suffered API breaches due to poor validation, broken access control, and missing rate limits. Dell’s 49M records were exposed at 5000 requests per minute, while Twilio’s API leak allowed attackers to validate accounts. Learn how insecure API views lead to massive data breaches—and how to protect your APIs.

Learn about API security risks with the new Snyk Learn Learning Path

Snyk Learn, our developer security education platform, now includes lessons on API security! Check out the new learning path that covers the OWASP Top 10 for API security risks. APIs power the modern web, connecting applications and services in ways that drive innovation and efficiency. However, with this interconnectivity comes significant security risks.

Wallarm's Top API Threats: What You Need to Know #InjectionAttacks #AttackVectors #APIHacks

API threats are evolving fast—but are security standards keeping up? While OWASP updates API security guidelines yearly, real-world threats like injections remain a top attack vector. Learn why Wallarm’s research reveals a different API security reality and what organizations must do to stay protected.

The Definitive API Security Testing Checklist [XLS download]

What would happen if a malicious actor managed to access your API without authorization and compromise sensitive user data? The repercussions can be horrendous. You could incur significant financial losses or even worse harm your reputation. There is also a higher risk of security, just last year a 37% increase in API security incidents were reported. which means that developers of API-based goods and services need to pay extra attention to this.

Why API Discovery Is Critical to Security

For Star Trek fans, space may be the final frontier, but in security, discovering Application Programming Interfaces (APIs) could be the technology equivalent. In the iconic episode “The Trouble with Tribbles,” the legendary starship Enterprise discovers a space station that becomes overwhelmed by little fluffy, purring, rapidly reproducing creatures called “tribbles.” In a modern IT department, APIs can be viewed as the digital tribble overwhelming security teams.

API Specifications: Why, When, and How to Enforce Them

APIs facilitate communication between different software applications and power a wide range of everyday digital experiences, from weather apps to streaming services and everything in between. They are also a critical ingredient of AI. However, if not structured and standardized properly, APIs can become inconsistent, insecure, and difficult to maintain. This is where API specifications come into play.

API Risks & Threats: What Wallarm's Reports Reveal #APIThreats #CyberResearch #APIExploitation

Wallarm conducts quarterly and annual API threat reports to provide data-driven insights on API vulnerabilities, risks, and attacks. This research helps the industry understand emerging threats and improve API security strategies. Stay informed with the latest findings!