About Us

Neosec Launched ShadowHunt For API Security

Neosec launched ShadowHunt, a managed threat hunting service staffed by experts, to supplement its platform with human oversight from active threat hunters to identify the most hidden and obfuscated API abuse. Neosec’s SaaS platform discovers all APIs, analyzes their behavior, audits risk, and eliminates threats lurking within. It brings together security and development teams to protect modern applications at scale from threats.

Neosec applies threat hunting techniques like those used in EDR and XDR to API security. ShadowHunt provides security teams with the assurance that API security experts are investigating unusual behavior on their API estate.

Giora Engel, co-founder, and chief executive officer of Neosec stated, “The increasing potential for insiders or attackers to utilize business APIs for criminal or malicious gain requires a new level of scrutiny and sophistication. The new ShadowHunt service augments our platform with an expert team to monitor API usage and hunt for fraud, abuse, or critical vulnerabilities without any drain on an organization’s existing security team.”

Organizations can manage the growing risk of manipulation, theft, and misuse of core business systems, assets, and data by combining the ShadowHunt service with the Neosec cloud-based platform. Because APIs are increasingly used to connect important business systems to customers, suppliers, and partners, the service is ideal for companies where security teams are understaffed or lack the expertise required to identify threats in business API traffic.

The Neosec platform handles API vulnerabilities by automatically and continuously identifying all APIs in use by a company, assessing their risk posture, and monitoring user behavioral anomalies that could involve data theft or other misuses. Most businesses do not have a complete API inventory, let alone an understanding of the nature of typical API usage. The ShadowHunt service can now supplement the use of the Neosec platform with a team of experts to respond quickly to findings, investigate potential threats, and recommend immediate remediation and actions.

The ShadowHunt service and the Neosec platform work together to provide a quick way to incorporate full monitoring and investigation of anomalous business API usage without interfering with existing security operations or team workload. The combination can quickly and transparently add protection against vulnerability exploits and API business abuse.

Read more articles:

API Security Should Be Your Priority in 2022

API Security Should Be Your Priority in 2022

API security represents the application of any security best practice to APIs, which are widely used in modern applications. API security encompasses API access control and privacy, as well as the detection and remediation of API-related attacks such as API reverse engineering and the exploitation of API vulnerabilities.

Whether an application focuses on consumers, or anyone else, the client-side (mobile app or web app) interacts with the server-side via Application Programming Interface (API). APIs make it simple for a developer to create a client-side app. APIs enable microservice architectures as well.

An attack on API could include bypassing the client-side application to disrupt the operation of an application for other users or to compromise private information. API security is concerned with securing this application layer and addressing what might happen if a malicious hacker interacts with the API.

According to Infosecurity Outlook, “by 2023, API abuses will be the most common attack vector resulting in data breaches for enterprise web applications. To avoid these attacks, it is best to take a continuous approach throughout the API development and delivery cycle, designing security into APIs.”

Features of API Security

API security is concerned with securing the APIs that you expose directly or indirectly. API security is less concerned with the APIs you use that are provided by third parties, though analyzing outgoing API traffic, one can get valuable insights that can be used whenever possible.

It’s also worth noting that API security as a practice involves several teams and systems. API security includes network security concepts like rate limiting and throttling, as well as data security, identity-based security, and monitoring.

Technology advancements such as cloud services, API gateways, and integration platforms enable API providers to secure APIs in novel ways. The technology stack you use to build your APIs has an impact on, how secure they are.

Larger organizations have different departments, and they can develop their own applications using their own APIs. Large organizations also end up with multiple API stacks or API silos because of mergers and acquisitions.

As we know, API security requirements can be directly mapped to the technology of a single silo when all your APIs are contained within it. In the future, these security configurations should be portable enough to be extracted and mapped to another technology.

However, in heterogeneous environments, API security rules are typically defined using API security-specific infrastructure that operates across these API silos. The connectivity between API silos and API security infrastructure can be achieved by using the sidecars, sideband agents, and APIs integrated between cloud and on-premises deployments.

API Discovery

There are numerous barriers that prevent security operatives from having full visibility into all APIs exposed by their organization. API silos reduce API visibility by providing only a subset of APIs under disconnected governance.

API discovery is a tussle between API providers and hackers who will easily exploit the APIs once discovered. API traffic metadata can be used to locate APIs before they are discovered by attackers. This information is extracted from API gateways, load balancers, or directly inline network traffic, and then fed into a specialized engine that generates a useful list of APIs that can be compared to API management layer catalogues.

OAuth and API Access Control

To limit API resources to only those users who should be able to access them. The user, as well as any applications acting on their behalf, must be identified. This is typically accomplished by requiring client-side applications to include a token in API calls to the service, which can then validate that token and retrieve user information from it. OAuth is the standard that describes how a client-side application first obtains an access token. OAuth defines numerous grant types to accommodate different flows and user experiences.

API Data Governance and Privacy Protection

API leaks occur because data flows through APIs. As a result, API security must also include inspecting the structured data flowing into and out of your APIs and enforcing rules at the data layer.

Because data in your API traffic is structured predictably, enforcing data security by inspecting API traffic is an excellent choice for this task. API data governance, in addition to [yes/no] type rules, allows you to transform the data structured into your API traffic in real-time for redaction purposes. This pattern is commonly used to redact specific fields that may contain information that a user’s privacy settings dictate should be hidden from the requesting application.

API Threat Identification

API threat detection is a logical extension of general threat protection measures. APIs, for example, are frequently protected by a firewall, which provides some basic security. APIs are sometimes protected by a web application firewall (WAF). A WAF may scan API traffic to detect signature-based threats such as SQL injections and other injection attacks. API gateways also play a role in API-specific threat detection. A gateway may impose a strict schema on the way in as well as general input sanitization. In addition to acting as a policy enforcement point, it will look for deep nesting patterns, and XML bombs, and apply rate limits.

API Analytics and Behaviour

An AI engine can build models for what normal API traffic looks like using API traffic metadata and then use this model to look for anomalous behavior. These anomalies can aid in the detection of ongoing attacks, but they can also indicate system misbehaviors and other non-malicious disruptions to your services, such as friendly fire. Such a layer can pinpoint the source of this attack or misbehavior by analyzing API traffic metadata, and this information can then be used to cease the incident in progress and fix it.


APIs are highly regarded targets for malicious actors and are expected to become the primary attack. APIs require a dedicated approach to security and compliance due to the critical role they play in digital transformation and the access to internal sensitive data and systems they provide.

Read more articles:

What is API Security?

Cequence Security Collaborates with Software AG

The industry leader in API security, Cequence Security, has established a significant collaboration with Software AG, the software pioneer of the truly globalized world. API Security Platform’s integration with Software AG’s webMethods Gateway will provide enterprise security teams with an end-to-end API security solution.

President, and CEO of Cequence Security, Larry Link commented, “Research has shown a drastic uptick in data breaches and attacks targeted at APIs over the past year, and our mission is to give enterprises an easy button for all things API security-related through strategic integrations. We’re thrilled to partner with Software AG to extend their capabilities and carry out our dual mission to enable enterprises to successfully grow their revenue without the fear of API attacks.”

APIs have become the foundation of services, allowing companies to use a more sequential development technique in which apps are published and upgraded more frequently. Customers can use the Software AG webMethods Gateway to manage their APIs centrally, implement access controls, and minimize volumetric traffic spikes. The Cequence API Security Platform is the only solution today that natively mitigates API threats in real-time, complementing and extending the webMethods capabilities with holistic API attack surface area discovery, misuse, and attack detection.

Organizations have traditionally depended on perimeter security services to secure their APIs. This tendency has shifted: between July and December 2021, Cequence Security stopped over 80% of cyberattacks aimed at APIs. This connection will give security teams additional visibility into how the webMethods Gateway’s security features are being used, as well as more information on the demands put on their APIs, allowing them to identify and halt threats before they have a negative effect on the organization.

General Manager API, Integration & Microservices, Software AG, Suraj Kumar stated, “We are very excited to partner with Cequence Security to better address the growing need for enhanced API security in today’s digital business climate. Their comprehensive API security platform combines visibility and risk assessment to protect and prevent sophisticated attacks. Together with Software AG’s API management capabilities, our new partnership with Cequence Security will help organizations discover and better protect their APIs against all types of threats.”

Read more:

What is API Security?

What is API Security?

API security plays a vital role in today’s economy in securing the API (Application Programming Interfaces) devices. They enable us to share and protect critical data of useful business functionality among devices, applications, and individuals. While we may not notice them, APIs are all around us for example, while logging in, weather data, automobile companies, Twitter bots, streaming services like Netflix, etc.

According to Infosecurity outlook, an application programming interface (API) security is a method for one piece of software to communicate with another. It acts as a building block for the development of new interactions involving humans or varied smart devices. External clients can easily request services from a program or application that has an API.

APIs form the foundation of today’s digital ecosystems. They are deeply embedded in software systems and are a major driving force in the successful execution of applications. Because the tech sector is so reliant on APIs, organizations that provide API access must make them more secure and reliable.

APIs are now used by standard client-server applications to exchange data. Furthermore, third-party API consumption is a popular method of integrating APIs with existing systems. 

API security is an important aspect of web application security. Most modern web applications rely on APIs to work, and APIs add additional risks to the application by allowing third-party access to it.

What is the significance of API security?

APIs are used by businesses to connect services and transfer data. APIs that are broken, exposed, or hacked is to blame for major data breaches. They make sensitive medical, financial, and personal information available to the public. However, not all data is the same and should not be protected in the same way. The approach you take to API security will be determined by the type of data being transferred.

An application programming interface security can be used to simplify the process of managing existing tools or designing new ones. They are required to connect applications for them to perform a post function based on sharing relevant information and actualizing pre-defined methodologies.

APIs serve as a go-between for developers, allowing them to create new conceptual connections between different applications that individuals and businesses use on a regular basis inline.

API security is required in an increasingly digitized economy to secure new services, but the need for social media initiatives has made APIs more significant than ever before. Every organization faces the challenge of making rapid changes and adapting to new ways of doing business. API security helps to protect the process.


At last, security is everyone’s responsibility. APIs interact with backend services, databases, and IAM—all of which must be properly secured. This begins at the transport level with the use of SSL (HTTPS). It is also essential to get rid of HTTP basic authentication. APIs are the foundation of modular applications today, and their importance, impact, and massive amounts will only increase in the future.

Read News Related to API Security:

Salt Security introduced Salt Labs to increase API Security awareness around the world

 TripActions chooses Salt Security to protect the APIs operating its cloud-based corporate travel management platform