Salt Security delivers API Posture Governance Engine

Salt Security has announced multiple advancements in discovery, posture management and AI-based threat protection to the industry leading Salt Security API Protection Platform. Salt leapfrogs traditional posture management by providing the industry's first API posture governance engine delivering operationalised API governance and threat detection across organisations at scale.

*According to Gartner®, “API usage is increasing, but most organisations still lack knowledge about how to secure it. As API exploits become widely available, and the impact of API attacks grows, CISOs and software engineering leaders need to understand how to tackle API security”. Proper governance helps bring more context and more value to behavioural threat protection.*

With the latest expansion to its AI-based platform, Salt now delivers:

Industry’s first API posture governance engine - Which helps organisations minimise risk on their API first journey, by having the ability to author corporate standards for API posture, and assess compliance with those standards, along with industry best practices, and regulatory requirements. Unlike typical API security solutions that focus primarily on detection and mitigation of threats, Salt's platform introduces the first-ever engine dedicated to API posture governance. The new functionality helps ensure that all API lifecycle stakeholders (architects, developers, API product managers, AppSec, SecOps) are in sync and security standards are followed as an API makes its way through its lifecycle.

New API filtering and querying capabilities - Which provides context rich API asset discovery and management, helping organisations mine more intelligence from their discovered API assets. This feature allows organisations to extract detailed insights about their APIs, such as their purpose, usage patterns and associated risks. The ability to create posture governance policies directly from these insights is a significant leap forward, offering a new level of depth and customisation.

Enhanced behavioural threat response capabilities - Which will provide SecOps personnel with the capability to more effectively prioritise, triage, and analyse API related security events, and drastically reduce mean time to respond and resolve. More API sprawl means more opportunity for threat actors targeting APIs. This trend will continue in 2024, as evidenced by Salt Security’s latest State of API Security Report, Q1 2023, which found a 400% increase in unique API attackers this last year and its State of API Security for Financial Services and Insurance Report where 92% of respondents say they have experienced a significant security issue in production APIs over the past year, with nearly one out of five have suffered an API security breach. Salt’s new attacker activity filtering, querying and threat hunting capabilities leverages findings derived from industry's most mature and advanced behavioural threat detection platform, coupled with its context rich API asset intelligence. The integration of this advanced threat detection with API asset intelligence equips security teams with the tools to rapidly and effectively address API-related security events.

New ecosystem enrichment capabilities - Which will share API intelligence with the broader lifecycle ecosystem. The platform's enhanced integrations with application security testing

platforms, data enrichment through its public API, and advanced outbound integrations (like syslog and Splunk) are designed to ensure that API security is not a standalone effort but an integrated part of the broader security infrastructure. This holistic approach to API security, focuses on both internal asset management and external ecosystem integration. All of these improvements help organisations more easily share and operationalise Salt’s API asset and threat intelligence with existing security technology investments.

Enterprise onboarding and operationalisation improvements - Which reduce API risk quickly with minimal operational friction. These latest updates aim to help ease this burden with new improvements in role based access control, improved integrations to corporate identity systems, enhanced system health management and audit controls, and improved data collection and data protection mechanisms.

“APIs sit at the core of today’s modern applications, connecting enterprises to vital data and services,” said Roey Eliyahu, CEO at Salt Security. “However, with the ever-growing abundance of APIs, businesses are struggling to keep track of the APIs they have within their environment and even more so, are unsure of their current API posture against best practice policy and their own custom policies. By providing the industry's first API posture governance engine, Salt is helping organisations govern their API-first journeys using API intelligence to discover and effectively manage API assets, ensuring that corporate standards and industry best practices are followed throughout an API’s lifecycle.”

More API sprawl means more opportunity for threat actors targeting APIs and this trend will only continue in 2024. According to the Salt Labs State of API Security Report, Q1 2023, 94% of organisations experienced security problems in production APIs in the past year, and an unfortunate 59% have experienced application rollout delays resulting from security issues identified in APIs. The Salt posture governance engine captures API data with ease, simplifying how organizations share and respond to API threat intelligence. The platform provides pre-packaged templates for accelerated ramp up time, allowing organisations the ability to create their own posture rules, organize and categorise their rules and extensively filter their APIs. Unlike other API governance solutions, the Salt AI-based runtime engine pulls from the largest data lake in order to continuously train the engine.