API Security Testing: The Overlooked Frontline in Application Penetration Testing

SaaS providers face rising API and multi-tenant threats; regular pentesting aligned to OWASP and PTES across the SDLC reduces breach risk and supports SOC 2, ISO 27001, GDPR, and HIPAA.

The 2023 OWASP API Security Top 10 keeps BOLA and Broken Authentication on top while adding SSRF, unrestricted resource consumption, and unsafe API consumption; industry pros react.

API security remains underprioritized as usage surges; the 2023 OWASP API Security Top 10 still leads with BOLA and broken authentication, and manual testing is needed where scanners fall short.

From a year of thick-client pentests, NetSPI ranks its top critical findings: cleartext and hardcoded credentials, embedded encryption keys, and two-tier designs exposing backend databases.

For the past five years it seems like almost everything in information security has focused on application security and, for the NetSPI consulting practices, our application security business (app pen testing, code review, etc.) has significantly increased.

Since its formal recognition by the security community in 2007 on the OWASP Top Ten list, Cross Site Request Forgery (CSRF) has stepped out of the shadows and joined the ranks of vulnerability all-stars like Cross Site Scripting (XSS) and SQL injection.