Today, API security company Salt Security has announced multiple advancements in discovery, posture management and AI-based threat protection to the industry leading Salt Security API Protection Platform. Salt leapfrogs traditional posture management by providing the industry’s first API posture governance engine delivering operationalised API governance and threat detection across organisations at scale.
This news follows a successful year for Salt Security in 2023, which saw the company win multiple awards and release various pieces of research, including their State of the CISO report.
Roey Eliyahu, CEO at Salt Security, says: “APIs sit at the core of today’s modern applications, connecting enterprises to vital data and services. However, with the ever-growing abundance of APIs, businesses are struggling to keep track of the APIs they have within their environment and even more so, are unsure of their current API posture against best practice policy and their own custom policies. By providing the industry’s first API posture governance engine, Salt is helping organisations govern their API-first journeys using API intelligence to discover and effectively manage API assets, ensuring that corporate standards and industry best practices are followed throughout an API’s lifecycle.”
More API sprawl means more opportunity for threat actors targeting APIs and this trend will only continue in 2024. According to the Salt Labs State of API Security Report, Q1 2023, 94% of organisations experienced security problems in production APIs in the past year, and an unfortunate 59% have experienced application rollout delays resulting from security issues identified in APIs.
With the latest expansion to its AI-based platform, Salt now delivers:
Industry’s first API posture governance engine – Which helps organisations minimise risk on their API first journey, by having the ability to author corporate standards for API posture, and assess compliance with those standards, along with industry best practices, and regulatory requirements. Unlike typical API security solutions that focus primarily on detection and mitigation of threats, Salt’s platform introduces the first-ever engine dedicated to API posture governance. The new functionality helps ensure that all API lifecycle stakeholders (architects, developers, API product managers, AppSec, SecOps) are in sync and security standards are followed as an API makes its way through its lifecycle.
New API filtering and querying capabilities – Which provides context rich API asset discovery and management, helping organisations mine more intelligence from their discovered API assets. This feature allows organisations to extract detailed insights about their APIs, such as their purpose, usage patterns and associated risks. The ability to create posture governance policies directly from these insights is a significant leap forward, offering a new level of depth and customisation.
Enhanced behavioural threat response capabilities – Which will provide SecOps personnel with the capability to more effectively prioritise, triage, and analyse API related security events, and drastically reduce mean time to respond and resolve. More API sprawl means more opportunity for threat actors targeting APIs. This trend will continue in 2024, as evidenced by Salt Security’s latest State of API Security Report, Q1 2023, which found a 400% increase in unique API attackers this last year and its State of API Security for Financial Services and Insurance Report where 92% of respondents say they have experienced a significant security issue in production APIs over the past year, with nearly one out of five have suffered an API security breach. Salt’s new attacker activity filtering, querying and threat hunting capabilities leverages findings derived from industry’s most mature and advanced behavioural threat detection platform, coupled with its context rich API asset intelligence. The integration of this advanced threat detection with API asset intelligence equips security teams with the tools to rapidly and effectively address API-related security events.
New ecosystem enrichment capabilities – Which will share API intelligence with the broader lifecycle ecosystem. The platform’s enhanced integrations with application security testing
platforms, data enrichment through its public API, and advanced outbound integrations (like syslog and Splunk) are designed to ensure that API security is not a standalone effort but an integrated part of the broader security infrastructure. This holistic approach to API security, focuses on both internal asset management and external ecosystem integration. All of these improvements help organisations more easily share and operationalise Salt’s API asset and threat intelligence with existing security technology investments.
Enterprise onboarding and operationalisation improvements – Which reduce API risk quickly with minimal operational friction. These latest updates aim to help ease this burden with new improvements in role based access control, improved integrations to corporate identity systems, enhanced system health management and audit controls, and improved data collection and data protection mechanisms.
