Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Securing AI: The New Frontier of API Security

A10 Networks' security experts, Jamison Utter, Diptanshu Purwar, and Madhav Aggarwal, discuss the security challenges of AI. They discuss the new world of API-enabled AI agents and the necessity for robust security controls. Learn how to prevent misuse within the enterprise as they explore data ingress/egress and API security in the context of large language models (LLMs).

Salt Security Achieves a Perfect "Platinum" Sweep in the 2025 EMA PRISM Report

Receiving recognition from one leading analyst firm is a notable achievement. When two firms acknowledge your leadership, it clearly establishes a consistent pattern of market dominance. Following its designation as an Overall Leader in the KuppingerCole 2025 Leadership Compass for API Security, Salt Security has achieved the highest rating in the 2025 EMA PRISM Report for API Security.

LevelBlue Managed WAAP Enables Organizations to Solve Day 1 WAAP Implementation Challenges

Deploying Web Application and API Protection (WAAP) systems is crucial for bolstering cybersecurity defenses. Akamai reported 108 billion API attacks over 18 months, underscoring the value of APIs to cybercriminals. Like any new security measure, the initial deployment brings various challenges during the "Day One" process. These Day One challenges should not compromise security effectiveness or disrupt business operations.

CISO Spotlight: AJ Debole on the Business-Tech Divide, Breach Readiness, and AI Risks

AJ Debole is Field CISO at Oracle, but her journey began far from the corporate boardroom. After starting out in law and government, she moved into healthcare and cyber defense, where she led teams through ransomware crises. In this spotlight, she explores the next wave of challenges – aligning security with business incentives, taming AI sprawl, and securing the APIs that connect it all.

Infinite payloads? The future of API Testing with dynamic fuzzing

What if we told you that our newly released API Scanner has 922 quintillion payloads for a single type of vulnerability test? A quintillion is a billion billion – an immense number that highlights the limitations of traditional API security testing. Old methods like relying on signatures, vulnerability-specific payloads, or a fixed set of fuzzing inputs just aren’t enough anymore, especially when dealing with custom-built software and unique API endpoints.

Telemetry Alone Won't Save You: Why Action Matters in API Security #telemetry #appsec #infosec

Collecting logs and metrics isn’t enough real API security requires actionable insights and the ability to respond fast. In this clip, Wallarm and Oracle experts explain why telemetry without a clear response plan is useless, and how building detection into your incident response process makes the difference between stopping threats and just observing them.

The Required API Security Checklist [XLS download]

APIs are the foundation of modern applications, and attackers know it well. A single misconfigured endpoint or exposed token can give adversaries a direct path into sensitive systems and data across your environment. Your already overburdened security teams can’t afford to miss what may be their fastest-growing attack surface. How fast-growing is the threat?

Automate Network Intelligence with the Forward Networks API

The Forward Networks platform creates a complete digital twin of your network—but the power of that data multiplies when it’s accessible via API. Whether you’re pushing insights into dashboards, validating changes before rollout, or automating ticket generation, the API puts your network state into your workflows.

API Security Testing with DAST vs. SAST Approaches

API security breaches have reached a crisis point, with 57% of organizations experiencing API-related breaches in the past two years. Only 13% of organizations can prevent more than 50% of API attacks, while 84% of security professionals experienced an API security incident in the past year. The average cost to remediate API incidents was $591,404 in the United States, increasing to $832,801 in the financial services sector.

Scaling API Security Without the Complexity: Lessons from Early Adopters

APIs are a blessing and a curse. They’re the backbone of the modern internet. They also expose complex behaviors that are often poorly documented, stitched together across legacy and cloud systems, and updated faster than security teams can review. Three key groups typically shoulder the burden of protecting them: When these groups work in silos, gaps appear. Security becomes fragmented, reactive, and expensive to maintain. This is where Wallarm Security Edge comes in.

When Secure Isn't Safe Uncovering OWASP Top 10 Business Logic Abuse

The OWASP Top 10 for Business Logic Abuse reveals the most critical ways attackers exploit the design of your applications, not just their code. Business logic abuse isn’t about SQL injection or XSS, it's about bypassing the rules, manipulating workflows, and triggering unintended behaviors in ways your functional tests never anticipated. Why this Matters? Attackers are shifting from exploiting code flaws to abusing the intended functionality of your applications.These logic-level threats are particularly dangerous because they.

This API Security Mistake Could RUIN Your Business #apitesting #hacking_or_secutiy #apisecurity

Testing your APIs after deployment is one of the biggest mistakes teams make. By the time vulnerabilities are discovered in production, the risk is higher, fixes take longer, and attackers may already exploit them. In this short clip from our API Security webinar, we explain why “shift-left” testing — securing APIs before deployment — is critical to prevent breaches.

Would You Like Data Leaks With That?

It’s been a rough few weeks for burger chains. First, McDonald’s McHire chatbot was caught serving up candidate data through insecure APIs. Then Restaurant Brands International (RBI), home of Burger King, Tim Hortons, and Popeyes, had its APIs flame-broiled by attackers who discovered they could generate tokens without authentication, escalate privileges, and even eavesdrop on live drive-thru audio. When APIs become the secret sauce, leaving them unprotected is a recipe for disaster.

Securing Third-Party EHR Integrations: Best Practices

Electronic Health Records (EHR) have become the backbone of modern healthcare, enabling providers to deliver coordinated, data-driven, and efficient care. Yet, as practices increasingly rely on third-party integrations-whether for billing, analytics, telehealth, or patient engagement-security becomes a pressing concern. A poorly secured integration can expose sensitive patient information, create compliance risks, or even compromise entire networks.

From Prompt Injection to a Poisoned Mind: The New Era of AI Threats

In our last post, we introduced the Model Context Protocol (MCP), the "brain" or "mission briefing" that guides an AI agent's actions. Most security teams are just getting familiar with prompt injection, the equivalent of tricking an AI with a single, misleading command. But that's like stopping a pickpocket at the door when a master spy is already inside, rewriting the mission plans. As AI agents become autonomous, the attacks become more profound.

Data Rejection and API Best Practice #cybersecurity

Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.

The Full Lifecycle Imperative: Why "Shift Left" Must Meet "Shift Right"

In this series, we examined the vital connection between AI and APIs, highlighting what makes a leader in the API security market through the 2025 KuppingerCole Leadership Compass. Now, we turn to the core strategy of true API security: the full-lifecycle approach, where security is a continuous, integrated process rather than a single action.

Reflecting on Wallarm's Journey: Growth, Resilience, and What Comes Next

When we started Wallarm, we focused on the APIs that power modern apps. We built an API-first platform, used AI from day one, and secured early patents in behavior-based detection and automated policy creation. The result: real-time, inline blocking with automatic API discovery that protects production, not just dashboards. Today’s investment isn’t only fuel for innovation—it’s proof of enterprise recognition.

The API Security Dilemma: Why Traditional Approaches Are Failing in the AI Era

Throughout the past few years, APIs have become the backbone of digital infrastructure. They enable software-to-software communication, improve integration and interoperability, support modular architecture, and more. But as API use has exploded, so has API traffic volume and complexity, making them increasingly difficult to secure. And the rise of AI agents and automation have complicated matters further. The result? APIs have become a favourite attack vector for cybercriminals.

Introducing Dynamic API Scanning

Application environments are more complex than ever, with APIs forming the critical connective tissue. But this proliferation has created a vast, often invisible, attack surface. Security teams are caught in a difficult position: compliance frameworks like PCI and SOC 2 demand API scanning, but offer little guidance. Meanwhile, you’re grappling with incomplete API inventories, and the market is a confusing mix of expensive, hard-to-instrument niche tools.