See what’s exploitable

Blog

Field notes on application security.

How-tos, research, and lessons on securing APIs, AI, and the modern application surface.

Bashar Abouseido, former Charles Schwab CISO, with the headline Hyper offense needs hyper defense.

October 28, 2026

Hyper Defense: Why Patching Faster Won't Stop AI-Speed Attacks

Former Charles Schwab CISO Bashar Abouseido explains why AI-driven attacks demand hyper defense, and why exploitability, not patch speed, sets priorities.

6 min

Best pen testing tools image

September 16, 2022

Best Pen-Testing Tools for Modern APIs

Compare today’s top pen-testing tools — and learn why automated API testing is the missing piece in your security strategy.

APIsec infographic – API security best practices visual aid

July 19, 2022

API Testing Automation: How It Transforms DevSecOps

Bug Bounty programs have been the norm for a while, but they often leave your APIs more vulnerable than before; this article explains why.

API monitoring risks – visual highlighting hidden dangers of monitoring APIs

July 12, 2022

The Hidden Risks of API Monitoring That Leave APIs More Vulnerable

In this blog post, we'll take a look at the most critical vulnerabilities API monitoring misses that actually leave your APIs at risk.

Image showing shift-left security process

March 31, 2024

Shift Left Security: The Ultimate Guide

Find out how shift left impacts security and identify steps you can take to implement it to boost your security posture.

Shift left security concept – moving API security earlier in development

May 19, 2022

Shift Left for DevOps: Key Benefits and 5 Best Practices to Follow

Find out how shift left can help your business and explore some best practices to get you started.

Shift left testing guide – software development lifecycle and early security practices

May 16, 2022

Shift-Left vs Traditional Testing: Choosing the Best Approach

In this guide, you will learn how shift left testing benefits your business and how to build a strategy that implants this approach.

May 11, 2022

What is Broken Object Level Authorization (BOLA) and How to Fix It

Use this guide to learn how to protect yourself from #1 API security threat according to OWASP.

Penetration testing guide – illustrated overview of API pen testing steps

May 13, 2022

Penetration Testing Best Practices for Every Stage of Testing

APIs power modern applications but remain top attack targets. Discover why securing APIs is now more critical than ever.

Business constraint exploitation – API vulnerability infographic

May 5, 2022

Business Logic Flaws in APIs: The Silent Threat

Business constraint exploits can break your app's logic — automated testing spots them before attackers do.

HTTP verb tampering in APIs – hacking method and risk illustration

May 2, 2022

HTTP Verb Tampering: Key Risks and Fixes

Move security left in your API lifecycle — automated testing finds flaws sooner, before code even reaches production.

Sensitive data exposure illustration – safeguarding APIs against leaks and threats

April 20, 2022

Sensitive Data Exposure: What It Is and How to Avoid It

Sensitive Data Exposure poses a serious threat to businesses. Find out what it is and how to prevent it.

October 28, 2022

How to Generate OpenAPI (OAS) Specs for REST APIs

Step-by-step guidance on generating OpenAPI (OAS) documentation for REST APIs, tools to use, and why specs matter for API security.