AI and API: How to Leverage AI Tools for API Security
November 08, 2023

Dotan Nahum
Check Point Software Technologies

The marriage between AI and API security seems like an odd pairing at first. Dubbed a threat to API security, generative AI applications can be easily customized to create and run multiple scenarios to expose weaknesses in APIs. Moreover, given the right datasets, hackers can train AI to plan and execute attacks that evade traditional API security solutions. However, those qualities make artificial intelligence and machine learning the technology that may be missing in your API security stack.

Before we discuss how you can harness AI to secure your APIs, let's talk about why API security is now considered a C-level cybersecurity concern.

Why API Security is the New AppSec

API communications today make up over 80% of all traffic on the internet, and the average enterprise uses over 15,000 APIs. The same report found that 41% of organizations surveyed experienced an API security incident last year, and other reports claim the number is much higher — up to 76% in some cases. In monetary terms, the average annual cost associated with API-related cyber loss is around $12 to 23 billion in the US alone — hefty, to say the least.

But what is it that makes APIs so attractive to malefactors?

A combination of two factors: the sheer volume of API traffic (which is expected to grow twice as fast as HTML traffic) and the ease with which bad actors can bypass traditional API security solutions like WAF, log analysis, and API gateways.

An emerging threat should require advanced protection, yet this isn't necessarily the reality. 77% of businesses admit that their existing tools aren't very effective in preventing API attacks. The same survey revealed that 31% of businesses surveyed had experienced a sensitive data exposure or privacy incident, and 17% were the victims of a security breach resulting from an API attack.

How Can AI/ML Tools Help?

Can the answer to API security challenges be AI? Many answer with an optimistic yes, but only a few envision where AI fits their API security strategies — and how. So, what can AI do for API security?

Secure API Development

The use of AI/ML tools in software development is nothing new, and API developers avidly adopt AI in various aspects of their workflows. 60% of API developers already use AI tools in their work, though only 18% said they use AI to flag potential vulnerabilities in API code.

While not directly related to coding, another way AI/ML tools help secure APIs from the core is by producing and updating the documentation for the many APIs businesses employ.

API Discovery

It takes about forty hours to discover, document, migrate, refactor, and remediate security issues for each API. Considering the API sprawl plaguing enterprises, lack of visibility into the APIs employed is one of the main challenges in API security. Often, organizations focus on high-risk APIs while turning a blind eye to shadow APIs and zombie APIs that may leak sensitive information.

AI-enhanced API management tools can help discover and document the different exit points and provide infosec teams with contextual intelligence on managing and protecting the APIs (or eliminating them if they are no longer used).

API Testing

The most apparent use for AI/ML tools in API security is in testing and validating APIs. Compared to humans, AI tools can write thousands of tests and scenarios to run against your API, and they don't require as much time and resources to achieve broad coverage. So, it's no wonder numerous API management and security products have added AI features to their testing tools.

Behavior Analysis

Another advantage AI has over humans is its ability to instantly spot anomalies in behavior across masses of API calls to uncover potential malefactor activity in their search for exploitable application logic flaws. The tools traditionally used to protect APIs lack the context to detect such supposedly unrelated malefactor actions over time. They also don't protect against API abuse and attacks over authenticated APIs, which count for up to 80% of all API attacks.

Prioritization and Contextualization of Alerts

One of the challenges with cybersecurity overall and API threats is the volume of logs and alerts produced. While AI can never fully replace human analysis, it can provide IT, infosec, and DevOps teams with more actionable and contextualized information, as well as prioritize the severity of incidents or vulnerabilities to help resolve the most critical ones in a timely manner.

The Future of API Security With AI/ML Tooling

APIs are vital in modern applications, but traditional API security tools and policy-based mechanisms are no longer enough. As bad actors explore the capabilities of AI, so do API security vendors.

To be effective and accurate, AI must be trained on masses of historical API traffic logs and best practices for threat detection and validation. But, once trained, AI tools can monitor and analyze all API traffic to detect increasingly sophisticated attacks and arm security professionals with the information they need when they need it to stop attacks from becoming breaches.

Dotan Nahum is Head of Developer-First Security at Check Point Software Technologies
Share this

Industry News

December 06, 2023

ngrok unveiled its JavaScript and Python SDKs, enabling developers to programmatically serve their applications and manage traffic by embedding ingress with a single line of code.

December 06, 2023

Data Theorem introduced API Attack Path Visualization capabilities for the protection of APIs and the software supply chain.

December 05, 2023

Security Journey announced support for WCAG, SCIM and continued compliance with SOC2 Type 2, which are leading industry standards.

December 05, 2023

Vercel announced a new suite of features for its Developer Experience (DX) Platform, made for enterprise teams with large codebases.

December 04, 2023

Atlassian Corporation has completed the acquisition of Loom, a video messaging platform that helps users communicate through instantly shareable videos.

December 04, 2023

Orca Security announced that the Orca Cloud Security Platform has achieved the Amazon Web Services (AWS) Built-in Competency.

November 30, 2023

Parasoft, a global leader in automated software testing solutions, today announced complete support for MISRA C++ 2023 with the upcoming release of Parasoft C/C++test 2023.2.

November 30, 2023 achieved the Amazon Elastic Kubernetes Service (Amazon EKS) Ready designation from Amazon Web Services (AWS).

November 29, 2023

CircleCI implemented a gen2 GPU resource class, leveraging Amazon Elastic Compute Cloud (Amazon EC2) G5 instances, offering the latest generation of NVIDIA GPUs and new images tailored for artificial intelligence/machine learning (AI/ML) workflows.

November 29, 2023

XM Cyber announced new capabilities that provide complete and continuous visibility into risks and vulnerabilities in Kubernetes environments.

November 29, 2023

PerfectScale has achieved the Amazon Elastic Kubernetes Service (Amazon EKS) Ready designation from Amazon Web Services (AWS).

November 28, 2023

BMC announced two new product innovations, BMC AMI DevX Code Insights and BMC AMI zAdviser Enterprise.

November 28, 2023

Rafay Systems announced the availability of the Rafay Cloud Automation Platform — the evolution of its Kubernetes Operations Platform — to enable platform teams to deliver automation and self-service capabilities to developers, data scientists and other cloud users.

November 28, 2023

Bitrise is integrating with Amazon Web Services (AWS) to provide compliance-conscious companies with greater access to CI/CD capabilities for mobile app development.

November 28, 2023

Armory announced a new unified declarative deployment capability for AWS Lambda.