--- title: Will APIs be the Greatest Cyber Threat to Your Business in 2022? description: Digital transformation and the shift to hybrid working triggered a rapid rise in the use of APIs. Now, the associated risks are under the spotlight image: https://www.coriniumintelligence.com/hubfs/Imported_Blog_Media/BoIS-website-graphics-1-Nov-24-2022-03-48-46-2377-PM.png --- [Skip to content](https://www.coriniumintelligence.com/content/articles/are-apis-the-greatest-cybersecurity-threat-to-your-business-in-2022#main-content) [![Corinium](https://www.coriniumintelligence.com/hs-fs/hubfs/Corinium%20logo%20+%20branding/Corinium-logo_horizontal_reversed.png?width=646&height=196&name=Corinium-logo_horizontal_reversed.png "Corinium")](https://www.coriniumintelligence.com/) - [Home](https://www.coriniumintelligence.com/content) - [About](https://www.coriniumintelligence.com/aboutus) Show submenu for About - [Services](https://www.coriniumintelligence.com/content/services) - [Events](https://www.coriniumintelligence.com/events-calendar) - [Data Insights](https://www.coriniumintelligence.com/content/tag/data) - [InfoSec Insights](https://www.coriniumintelligence.com/content/tag/infosec) - [AssetOps](https://www.coriniumintelligence.com/assetops) - [Subscribe](https://www.coriniumintelligence.com/content/subscribe) - [More](https://www.coriniumintelligence.com/content/articles/are-apis-the-greatest-cybersecurity-threat-to-your-business-in-2022#) Show submenu for More - [Articles](https://www.coriniumintelligence.com/content/tag/articles) - [Videos](https://www.coriniumintelligence.com/content/tag/videos) - [Podcast](https://www.coriniumintelligence.com/content/tag/podcast) - [Reports](https://www.coriniumintelligence.com/content/tag/reports) - [Home](https://www.coriniumintelligence.com/content) - [About](https://www.coriniumintelligence.com/aboutus) Show submenu for About - [Services](https://www.coriniumintelligence.com/content/services) - [Events](https://www.coriniumintelligence.com/events-calendar) - [Data Insights](https://www.coriniumintelligence.com/content/tag/data) - [InfoSec Insights](https://www.coriniumintelligence.com/content/tag/infosec) - [AssetOps](https://www.coriniumintelligence.com/assetops) - [Subscribe](https://www.coriniumintelligence.com/content/subscribe) - [More](https://www.coriniumintelligence.com/content/articles/are-apis-the-greatest-cybersecurity-threat-to-your-business-in-2022#) Show submenu for More - [Articles](https://www.coriniumintelligence.com/content/tag/articles) - [Videos](https://www.coriniumintelligence.com/content/tag/videos) - [Podcast](https://www.coriniumintelligence.com/content/tag/podcast) - [Reports](https://www.coriniumintelligence.com/content/tag/reports) #### Search: 18 Oct, 2021 [Articles](https://www.coriniumintelligence.com/content/tag/articles) # Will APIs be the Greatest Cyber Threat to Your Business in 2022? ![](https://www.coriniumintelligence.com/hubfs/Imported_Blog_Media/BoIS-website-graphics-1-Nov-24-2022-03-48-46-2377-PM.png) ### Digital transformation and the shift to hybrid working triggered a rapid rise in the use of APIs. Now, the associated risks are under the spotlight During his years working in elite security cybersecurity units in the Israeli Defense Force, Salt Security Co-founder & CEO Roey Eliyahu saw firsthand how APIs can be a significant vector for attacks by cybercriminals. Today, as enterprise businesses walk the path of digital transformation, web applications and associated APIs have multiplied rapidly. This dynamic ecosystem has increased the attack surface as well as the associated risk factors for many businesses. The problem has become so severe that Gartner recently predicted that APIs would become the [most frequent](https://www.gartner.com/en/webinars/4002323/api-security-protect-your-apis-from-attacks-and-data-breaches#:~:text=Gartner%20predicts%20that%20by%202022,a%20wide%20range%20of%20organizations.) vector for cyberattacks on enterprise web applications in 2022. “When you [have] a large attack surface that is dynamically changing, plus the fact that [businesses are] adding more sensitive data and that their security tools were not really designed to protect APIs the way they are today, the inevitable result is that we see more and more incidents every month,” Eliyahu observes. This article, adapted from a presentation at our recent online event, [CISO Champions, US](https://ciso-co.coriniumintelligence.com/), delves into the increasing risk posed to enterprises by the proliferation of APIs and looks at some of the key challenges when keeping APIs secure. ### Panelists: - Roey Eliyahu, Co-founder & CEO, Salt Security - Curtis Simpson, CISO, Armis ## How the Pandemic Led to Increased API Risk Leaky APIs have already been causing problems for major international firms in 2021. In May, a [security researcher discovered](https://techcrunch.com/2021/05/05/peloton-bug-account-data-leak/?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce_referrer_sig=AQAAAEN26D7kf1MG-W7LGUkP1PPUY-QQoYf29FERFSdP0OQkQ0763B_fmkbOfeU6p0OXjqIYMJrPOBbxKDAJeOM6GPIPvUQssh8ZMmb66vCm78mK-O-42bvh4xBQFC6sgYuxACcHjMmag0tSX-yVcssXWI_rWS6yY1ld0HL8A5NHzW19) that the account data and personal information of Peloton home exercise bike owners were freely available online via an API. And, in the same month, [it was revealed](https://cloudentity.com/2021/05/03/the-experian-credit-score-breach-what-happened-and-how-to-prevent-future-api-data-breaches/) that the credit scores of millions of Americans were viewable without authentication via an Experian partner API. According to computer and network security firm Armis CISO Curtis Simpson, at least part of the problem was the rapid shift to working from home required by the pandemic, and the resulting increase in enterprise applications and associated APIs. "What ultimately happened is when everyone went remote we ran into this challenge – we had to enable a lot of integrations that, again, were planned, but *immediately*,” Simpson notes. “So, what this ultimately turned into is that we went from a small number of APIs to 10x that number of APIs in a very short period.” Of course from a risk perspective, such a large increase in APIs led to a significant increase in the potential attack surface. “The world has drastically evolved,” Simpson observes. “And the attack vectors themselves go alongside how we're actually integrating, sharing data, and passing data between systems.” ## What are the Key Challenges When Keeping APIs Secure? As we have said, the ‘new world’ of enterprise applications is characterized by a dynamic network of APIs in far greater quantity than have existed in the past. The first stage of managing API risk is quite simply to map your existing APIs. While this may sound simple, Eliyahu notes that according to their analysis it’s common for 40% or more of a company’s APIs to be either undocumented or poorly documented. “Once you have so many [APIs] – you have hundreds of thousands and they can change weekly or daily depending on where are you in your journey, it just results in a big gap in API visibility,” Eliyahu says. Another key challenge in the modern API environment is the changing nature of the attacks. In the past, attackers favored one-off attacks targeting the apps themselves. Today, however, attackers are more likely to target the API, looking for vulnerabilities that can be exploited over the long term. “Any data that typically belongs to one user, an attacker will try to probe and manipulate the business logic to access data of other users and exfiltrate data,” Eliyahu warns. In fact, Eliyahu goes on to explain that without an overarching system to monitor all of the APIs and how data is being exchanged between them, it may be impossible to detect a breach until it is too late. "If a solution does not have the full context of what data should be viewed by which users, what data can be modified by which user, and be able to see the bigger picture, not just one API at a time,” Eliyahu concludes. “[a breach may] simply be impossible to detect.” --- ###  Discover more about how securing APIs as well many other insights by registering to view the full presentation on-demand at [CISO Champions, US](https://ciso-co.coriniumintelligence.com/) here ## Related Posts [![](https://www.coriniumintelligence.com/hs-fs/hubfs/Imported_Blog_Media/BoIS-website-graphics-26-Nov-24-2022-03-48-13-4310-PM.png?width=352&name=BoIS-website-graphics-26-Nov-24-2022-03-48-13-4310-PM.png) ](https://www.coriniumintelligence.com/content/articles/exploring-the-reality-of-ransomware-attacks-in-2021) ### [Exploring the Reality of Ransomware Attacks in 2021](https://www.coriniumintelligence.com/content/articles/exploring-the-reality-of-ransomware-attacks-in-2021) In this discussion from CISO Champions Live, US, our panel of experts discusses how to mitigate the... [![](https://www.coriniumintelligence.com/hs-fs/hubfs/Imported_Blog_Media/BoIS-website-graphics-20-Nov-24-2022-03-48-14-3772-PM.png?width=352&name=BoIS-website-graphics-20-Nov-24-2022-03-48-14-3772-PM.png) ](https://www.coriniumintelligence.com/content/videos/2021-global-top-100-linkedin-live-panel-discussion-north-america-episode-two-recording) ### [2021 Global Top 100 LinkedIn Live Panel Discussion – North America: Episode Two](https://www.coriniumintelligence.com/content/videos/2021-global-top-100-linkedin-live-panel-discussion-north-america-episode-two-recording) Facing up to fast-evolving threats was top of the agenda at the lively Business of InfoSec North... [![](https://www.coriniumintelligence.com/hs-fs/hubfs/Imported_Blog_Media/Untitled-design-28-3.png?width=352&name=Untitled-design-28-3.png) ](https://www.coriniumintelligence.com/content/reports/2022-business-of-data-global-advisory-board-report) ### [Welcome to the 2022 Business of Data Global Advisory Board Report!](https://www.coriniumintelligence.com/content/reports/2022-business-of-data-global-advisory-board-report) Featuring NINE new members for 2022! The Business of Data advisory board features 30... [![Corinium-logo_horizontal_reversed](https://www.coriniumintelligence.com/hs-fs/hubfs/Corinium%20logo%20+%20branding/Corinium-logo_horizontal_reversed.png?width=646&height=196&name=Corinium-logo_horizontal_reversed.png "Corinium-logo_horizontal_reversed")](https://www.coriniumintelligence.com) Corinium Global Intelligence 20-22 Wenlock Road, London, N1 7GU 0203 432 2335 #### Our Recent Posts - [About Us](https://www.coriniumintelligence.com/aboutus) - [Subscribe](https://www.coriniumintelligence.com/content/subscribe) - [Privacy Policy](https://www.coriniumintelligence.com/privacy-policy) #### Follow Us [Follow us on LinkedIn ](https://www.linkedin.com/showcase/corinium-data-%26-analytics/?isFollowingPage=true) [Follow us on Facebook ](https://www.facebook.com/coriniumglobal/) [Follow us on Twitter ](https://twitter.com/coriniumglobal) [Follow us on YouTube ](https://www.youtube.com/channel/UCnuGiXMWAH5bhfXOfWkPIuw) [Follow us on Facebook ](https://open.spotify.com/show/4op8cNfQRNrZMP5i79Aze9) [Follow us on Facebook ](https://podcasts.apple.com/gb/podcast/the-business-of-data-podcast/id1528796448) ![](https://px.ads.linkedin.com/collect/?pid=182706&fmt=gif) ![](https://px.ads.linkedin.com/collect/?pid=306561&fmt=gif) ![](https://px.ads.linkedin.com/collect/?pid=60306&fmt=gif) ![](https://px.ads.linkedin.com/collect/?pid=1749329&fmt=gif) ![](https://px.ads.linkedin.com/collect/?pid=5553244&fmt=gif) ![](https://px.ads.linkedin.com/collect/?pid=5583316&fmt=gif) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Gareth Becker", "url" : "https://www.coriniumintelligence.com/content/author/gareth-beckercoriniumgroup-com" }, "dateModified" : "2022-11-24T15:49:33.565Z", "datePublished" : "2021-10-18T18:20:57.000Z", "headline" : "Will APIs be the Greatest Cyber Threat to Your Business in 2022?", "image" : [ "https://www.coriniumintelligence.com/hubfs/Imported_Blog_Media/BoIS-website-graphics-1-Nov-24-2022-03-48-46-2377-PM.png" ], "mainEntityOfPage" : { "@id" : "https://www.coriniumintelligence.com/content/articles/are-apis-the-greatest-cybersecurity-threat-to-your-business-in-2022", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.coriniumintelligence.com/hubfs/Corinium-logo_+tagline_horizontal_web-header.png" }, "name" : "Corinium Global Intelligence Limited" } } ```