Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

salt security

Seeing Your APIs Attack Surface Through an Attacker's Eyes: Introducing Salt Surface

Jul 31, 2025 By Eric Schwake In Salt Security
Your API attack surface is larger and more exposed than you realize. In today's complex, cloud-native environment, APIs are deployed at an astonishing rate. While this rapid pace fuels innovation, it also creates a significant visibility gap. The APIs you are aware of and manage are only the tip of the iceberg. Your actual risk exists beneath the surface, in the undocumented, unmanaged, and forgotten APIs that traditional security tools completely overlook.
Read Post

Why Are APIs Easier to Attack Than Apps?#apiattacks #apisecurity #pentest #nist

Jul 31, 2025 By Wallarm In Wallarm
Discover why over 70% of application attacks now target APIs instead of web apps. Learn from Wallarm and Oracle experts how automation, low entry barriers, and the rapid growth of APIs have changed the security landscape—and what you need to know to protect your organization.
View Video
appsentinels

Business Logic Vulnerabilities Explained: Real Examples, Impact & How to Prevent Them

Jul 29, 2025 By AppSentinels In AppSentinels
Imagine an online retailer running a promotion: “Spend $100 this month, get a $25 gift card.” It sounds simple encourage loyal shoppers to spend more. But due to a flaw in the app’s logic, a clever user discovers a loophole. They place enough orders to reach the $100 threshold and receive the gift card. Then, they cancel a small order to drop below the threshold only to make a new one that pushes their total back over $100.
Read Post
salt security

Securing the Next Era: Why Agentic AI Demands a New Approach to API Security

Jul 28, 2025 By Roey Eliyahu In Salt Security
I’ve spent my career building solutions to protect the API fabric that powers modern businesses. I founded Salt because I saw that traditional security tools such as WAFs, gateways, and CDNs weren’t designed to see or secure APIs. That gap led to breaches, blind spots, and billions in risk. Today, we’re facing a new wave of risk that’s even bigger than the last. The rise of Agentic AI has brought us to a true inflection point. Agentic AI isn’t just another software layer.
Read Post
salt security

LLMs Are Not Goldfish: Why AI Memory Poses a Risk to Your Sensitive Data

Jul 27, 2025 By Michael Callahan In Salt Security
We’ve all heard the myth: goldfish have a memory span of just a few seconds. While that’s debatable in marine biology circles, it’s useful as a metaphor in tech, especially when talking about memory, risk, and AI. The problem is, large language models (LLMs) are not goldfish. In fact, they have incredible memory. And increasingly, that memory isn’t just session-based. It’s persistent, long-term, and system-connected. That changes everything.
Read Post
wallarm

ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770)

Jul 27, 2025 By Wallarm In Wallarm
On July 19, 2025, a critical remote code execution (RCE) vulnerability (CVE-2025-53770, also referred to as ToolShell) was publicly disclosed, impacting on-premises Microsoft SharePoint Server installations. This vulnerability allows unauthenticated attackers to execute arbitrary code remotely by leveraging insecure deserialization techniques.
Read Post
How to Manage Digital Gifting in B2B With a Compliant Gift Card API

How to Manage Digital Gifting in B2B With a Compliant Gift Card API

Jul 24, 2025 By SecuritySenses In SecuritySenses
Modern businesses face mounting pressure to strengthen relationships with employees, clients, and partners through meaningful rewards. Traditional gifting methods create logistical nightmares, compliance headaches, and budget overruns that drain resources. Companies need solutions that streamline reward distribution while meeting strict regulatory requirements. Digital gifting platforms offer the answer, but only when backed by robust API infrastructure that ensures security, compliance, and seamless integration with existing business systems.
Read Post

Mastering API Security Testing: Stop BOLA and the OWASP Top 10 Before Deployment

Jul 23, 2025 By Wallarm In Wallarm
APIs drive modern applications, but their increasing complexity leaves them vulnerable to attacks. How can you ensure robust API security? Join Wallarm’s webinar to discover how to tackle today’s toughest API security challenges with advanced API security testing strategies. In this webinar we will cover: Learn how Wallarm’s innovative solutions can help you identify vulnerabilities, implement reliable security measures, and streamline your API testing process. Gain actionable insights into tools, best practices, and strategies to protect your APIs effectively.
View Video
salt security

When AI Agents Go Rogue: What You're Missing in Your MCP Security

Jul 16, 2025 By Roey Eliyahu In Salt Security
We’re at a major inflection point in how software operates. And I don’t say that lightly. For the past decade, we’ve seen a steady evolution toward microservices, APIs, and cloud-native architectures. But Agentic AI is something different. We’re no longer talking about static services. We’re now dealing with autonomous agents that reason, remember, and act in real-time across live environments.
Read Post
salt security

CISO Alert: Lessons from McDonald's Chatbot Breach

Jul 14, 2025 By Eric Schwake In Salt Security
In June 2025, a disturbing security failure surfaced involving McDonald’s AI-powered hiring assistant, Olivia, operated by Paradox.ai. The platform, designed to screen job applicants via chatbot, exposed the personal information of over 64 million people. That included names, contact info, shift preferences, and even chat transcripts. The root cause? A combination of missteps that highlight the growing risk of insecure APIs in modern, AI-driven systems.
Read Post

Autonomous Vulnerability Remediation: Securing Web & API Apps Instantly

Jul 11, 2025 By Indusface In Indusface
One-third of critical and high vulnerabilities remain open for 180+ days from the time they are discovered. When it comes to business growth vs security, business always wins by prioritizing features over vulnerabilities. This gives hackers enough time to exploit the vulnerabilities, putting the organization at risk. However, most of these vulnerabilities can be virtually patched within a few hours using solutions like AppTrana's SwyftComply, with zero impact on business continuity.
View Video
wallarm

Fail-Open Architecture for Secure Inline Protection on Azure

Jul 11, 2025 By Wallarm In Wallarm
Every inline deployment introduces a tradeoff: enhanced inspection versus increased risk of downtime. Inline protection is important, especially for APIs, which are now the most targeted attack surface, but so is consistent uptime and performance. This is where a fail-open architecture comes in.
Read Post
wallarm

CISO Spotlight: Andrew Storms on Trust, AI, and Why CISOs Need to Be Optimists

Jul 11, 2025 By Wallarm In Wallarm
Andrew Storms, VP of Security at Replicated, has spent three decades on the frontlines of cybersecurity. From building Unix systems in the early ‘90s to leading incident response and AI security strategies today, he has seen the CISO role evolve from back-office function to boardroom mainstay. In this spotlight, he shares the lessons that shaped his thinking, why storytelling is a critical CISO skill, and how API security is no longer optional.
Read Post
wallarm

Debunking API Security Myths

Jul 11, 2025 By Wallarm In Wallarm
I recently sat down with Tejpal Garwhal, Application Security and DevSecOps Leader, for a conversation debunking some of the most common API security myths. From zombie endpoints to the limits of WAFS and gateways, we covered what’s really happening on the ground; and what security teams need to do differently. Here’s a quick rundown of the key takeaways, but for the full picture, watch the full webinar.
Read Post
salt security

The Next Security Frontier: AI Agents, MCP, and the Coming API Wave

Jul 9, 2025 By Roey Eliyahu In Salt Security
I’ve seen this story before, and I’m seeing it again. When we founded Salt Security in 2016, APIs already powered the digital economy, Kubernetes started to accelerate the growth of APIs, yet almost nobody was monitoring them. Visibility was near zero, context was missing, and protection was an afterthought. Fast-forward to 2025, and the same blind spot is forming, only bigger. AI agents are no longer just generating content; they are also creating it.
Read Post
wallarm

Understanding the NCSC's New API Security Guidance

Jul 9, 2025 By Wallarm In Wallarm
Legislative, regulatory, and advisory bodies the world over are waking up to the importance of API security. Most recently, the UK’s National Cyber Security Centre (NCSC) has published detailed guidance on best practices for building and maintaining secure APIs. In this blog, we’ll break down that guidance and explore how Wallarm’s platform can help you align with each one.
Read Post
salt security

The CISO's API Security Paradox: High Priority, Huge Blind Spots

Jul 8, 2025 By Eric Schwake In Salt Security
In today’s digital-first world, APIs serve as the core infrastructure of modern business. They power mobile applications, facilitate critical cloud integrations, and support digital transformation initiatives. It's therefore understandable that 73% of CISOs consider API security a top or critical concern. However, a recent survey of 300 security leaders uncovers a troubling paradox: a large gap between awareness and action.
Read Post
wallarm

Inside the AI Threat Landscape: From Jailbreaks to Prompt Injections and Agentic AI Risks

Jul 6, 2025 By Wallarm In Wallarm
AI has officially moved out of the novelty phase. What began with people messing around with LLM-powered GenAI tools for content creation has rapidly evolved into a complex web of agentic AI systems that form a critical part of the modern corporate landscape. However, this transformation has given new life to old threats, transforming the API security landscape all over again.
Read Post
wallarm

What CISA's BOD 25-01 Means for API Security and How Wallarm Can Help

Jul 2, 2025 By Wallarm In Wallarm
The US government has taken another significant step towards strengthening cloud security with the release of CISA’s Binding Operational Directive (BOD) 25-01. Aimed at improving the security posture of federal cloud environments, BOD 25-01 mandates robust configuration, visibility, and control across cloud-based services. While the directive doesn’t explicitly name API security, securing modern cloud systems relies on securing APIs - including the ones security teams don’t know about.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.