Blog

Field notes on application security.

How-tos, research, and lessons on securing APIs, AI, and the modern application surface.

Bashar Abouseido, former Charles Schwab CISO, with the headline Hyper offense needs hyper defense.

October 28, 2026

Hyper Defense: Why Patching Faster Won't Stop AI-Speed Attacks

Former Charles Schwab CISO Bashar Abouseido explains why AI-driven attacks demand hyper defense, and why exploitability, not patch speed, sets priorities.

6 min

API unrestricted resource consumption – performance and security risk

November 19, 2025

Preventing Resource Abuse: Protect APIs from Harvesting

Unrestricted resource consumption makes APIs vulnerable to data harvesting and slowdowns. Learn to prevent DoS and control usage with rate limits and validation

November 19, 2025

Inside the Peloton Breach: Broken Authentication Lessons

Peloton’s API breach exposed user data due to broken authentication and poor authorization controls. Learn key lessons from this high-profile security failure

Security misconfiguration in APIs – vulnerabilities and best practices

November 19, 2025

Understanding Security Misconfiguration in APIs: OWASP 8 Explained

Learn how Security Misconfiguration (OWASP 8) exposes APIs to risk. See real-world examples, prevention tips, and how APIsec.ai automates API hardening.

Improper API inventory management – asset oversight risk illustration

November 19, 2025

Improper Inventory Management in APIs OWASP API9 Explained & How to Fix It

OWASP API9:2023 – Improper Inventory Management leaves undocumented APIs exposed. Learn what causes it, real-world risks, and how to audit your full API inventory.

November 19, 2025

Unsafe API Consumption: Securing Third-Party Integrations

Understand OWASP 10 – Unsafe Consumption of APIs. Learn how third-party API risks lead to data breaches and how APIsec.ai helps validate and secure external integrations.

November 19, 2025

Broken Authentication Explained: OWASP API Principle 2

Discover why broken authentication ranks in the OWASP API Top 10. See how attackers exploit APIs with insecure login, token, and session management flaws

Free API scanner comparison – evaluating value of free API security testing tools

November 19, 2025

Are Free API Scanners Actually Worth It?

Free API testing tools promise convenience, but do they truly secure APIs? Compare free API scanners vs. automated APIsec testing in this practical guide.

Choosing an API penetration testing tool – important criteria to consider

November 19, 2025

How to Choose the Right API Pen-Testing Tool

Greenslate secured 2,300+ undocumented endpoints with APIsec, integrating continuous testing to protect financial data despite limited resources.

BOLA vulnerability lessons – understanding broken object-level API authorization

November 19, 2025

Real-World Lessons of Broken Object Level Authorization (BOLA)

Uncover real-world lessons from BOLA attacks and learn how to protect your APIs from unauthorized data access

November 19, 2025

BOLA Explained: OWASP API Security Principle 1 for Teams

Broken Object Level Authorization (BOLA) is OWASP API Security API1:2023 — the #1 API risk. Learn how BOLA works, real-world examples, and how to prevent it.

Banking API security – protecting financial data via secure API practices

November 19, 2025

Real-World API Security Breaches: Lessons from Major Attacks

Learn from major API security breaches and how to safeguard your applications against evolving cyber threats

Application security technology landscape – software security architecture visual

November 19, 2025

AppSec Tech Landscape: Strengths, Gaps & What Teams Need

Understand the evolving application security technology landscape—see where security tools excel and where critical gaps persist to protect APIs