Imagine a customer logged in to your online portal. Their token is valid, and so is their session. Then one number at the end of an API call changes, and the response comes back with a different customer's account. The WAF sees a well-formed request from an authenticated user. The schema check passes. Nothing in the log says attack.

That is an abuse of business logic; cybersecurity analyst Jonathan Care refers to it as a series of "perfectly valid calls in a sequence you never anticipated, doing something you never intended."

In this episode of The Security Strategist podcast, Jonathan Care, lead analyst at KuppingerCole, sat down with Uri Dorot, Senior Product Marketing Manager at Radware, to talk about possibilities and impossibilities of API tooling, how detection can tell the difference between an attacker and an unusual customer, and the steps a CISO can take when working with a limited budget.

Also Watch: Can Runtime Security Keep Autonomous AI Under Control?

• Majority of enterprises fail to detect more than 90% of their APIs.
• Developers are familiar with Shadow APIs, whereas zombie APIs are not.
• Endpoint tools can be located cheaply via AI tools and crawlers.
• Attacks based on business logic make use of valid calls; schema checks can’t detect them.
• Business logic attacks use valid calls, so schema checks miss them.
• Response inspection catches reused tokens and PII leaving.
• Identity alone is insufficient; behaviour and context also matter.
• A gateway does not replace an API security platform.
• Every discovered API needs a named owner.

• 00:01 Business logic abuse and the 90% figure
• 05:34 Shadow, zombie and deprecated APIs
• 11:18 Telling abuse from legitimate use
• 22:20 AI agents and behavioural detection
• 42:35 Budget and ownership

Connect with Jonathan Care on LinkedIn

Connect with Uri Dorot on LinkedIn

Explore more episodes on The Security Strategist podcast

#APISecurity #Cybersecurity #Radware #TechPodcast #CloudSecurity #Infosec #ArtificialIntelligence #businesslogic #APIGateway #AITraffic #AIBotTraffic #GuardrailsforAI