Security

When Hackers Come Knocking, Weak APIs Let Them In

Here are four steps to securing APIs in a zero-trust framework.

Tim Chang is global vice president and general manager of Imperva Application Security at Thales.

The security of application programming interfaces hasn’t kept pace with surging adoption, with many lacking safeguards needed for high-risk, highly regulated environments.

Imperva tracked more than 40,000 API incidents across about 4,000 monitored environments in the first half of 2025, a clear indication that the threat landscape is evolving faster than defenses.

APIs are the invisible messengers that make the internet work, connecting websites, applications and services so they can share data and function together seamlessly. They serve as digital partnership agreements that govern what information can be exchanged, how it’s shared and under what conditions — making them the backbone of modern digital government.

From citizen portals and payment systems to data exchanges and agency apps, APIs deliver the online experiences citizens now expect, but what makes threats to them so dangerous comes down to scale and stealth. As APIs multiply rapidly, each one creates another doorway into an organization’s digital environment, expanding the attack surface across interconnected systems.

Click the banner below to start implementing smarter security.

x_security_q325_animated_click_desktop_03

x_security_q325_animated_click_mobile_03

Many attacks blend in with legitimate traffic, exploiting subtle flaws in business logic to steal data without detection. The fallout goes far beyond financial loss for agencies, encompassing compliance violations, operational downtime and loss of public trust. APIs have become the new battleground for cyber defenders, so here’s what IT leaders can do now to get ahead.

The New Attack Vector: Business Logic Exploits

Hackers are increasingly moving past firewalls to target APIs directly, especially those connected to payments, authentication and citizen data. These endpoints are especially lucrative, giving attackers opportunities to steal payment information, take over user accounts or sell sensitive citizen data on the dark web for profit.

Rather than relying on brute-force tactics, hackers exploit flaws in how APIs process requests, known as business logic exploits. Because this malicious traffic often looks normal, it can evade traditional defenses. Common tactics include scraping sensitive citizen data from public-facing portals and hijacking user accounts through session or token abuse.

In the public sector, even a minor breach can disrupt critical services or expose national data, and business logic exploits have emerged as a key vulnerability in the attack chain. To defend against these risks, agencies should focus on protecting high-impact endpoints, securing login and payment APIs, and continuously monitoring token activity for signs of suspicious behavior.

Click the banner below for the latest federal IT and cybersecurity insights.

Protecting APIs Is a Matter of Public Trust

Agencies operate under some of the strictest security mandates, from the Federal Information Security Modernization Act and Federal Risk and Authorization Management Program to zero-trust architecture. A single, compromised API can quickly trigger violations, investigations and lasting reputational harm.

Not only can this result in consequences such as high response and remediation costs, loss in budgetary support, slower procurement cycles, or stricter oversight, it also often ends in greater public scrutiny. At the heart of digital government is public trust. When an API exposure leaks personal data or disrupts citizen services, it can weaken confidence in government systems — potentially slowing modernization efforts and putting broader digital transformation goals at risk.

Because APIs connect so many critical functions, such as citizen records, payments and identity verification, even one exploited endpoint can have a ripple effect across multiple systems. The rise of automated threats amplifies the challenge: Although APIs make up just 14% of the attack surface, they attract 44% of advanced bot traffic. The bottom line is that protecting APIs is essential for continuity and trust.

Securing APIs in a Zero-Trust Framework

APIs must be treated as critical assets, secured with the same rigor as networks, endpoints and identities. Strengthening API security starts with visibility and control. Agencies should consider the following.

Inventory all active and shadow APIs to uncover hidden risks.

One of the hardest parts of managing APIs is simply finding them. As more APIs are developed and deployed across digital services, many go undocumented or unmonitored, creating hidden entry points for attackers. A comprehensive inventory gives agencies the visibility needed to understand their true attack surface.

Use analytics to distinguish real users from bots.

Today’s bots are highly sophisticated, mimicking human behavior so convincingly that they often evade traditional detection. With bots now responsible for more than half of all internet traffic, agencies must invest in advanced analytics tools that can identify what’s behind the traffic on their servers and if they’re being targeted by automated threats.

Enforce least-privilege access and require strong authentication.

At the core of zero trust, least-privilege access ensures that only verified users can reach sensitive systems and data. This minimizes the scope of a potential breach. When paired with strong authentication, it prevents threat actors from accessing critical information, even if they manage to slip in through a weak API.

Regularly test business logic to identify weak spots before attackers do.

Business logic vulnerabilities are among the trickiest to detect, often hiding in the way APIs handle legitimate requests. Regular, proactive testing helps agencies anticipate how attackers might manipulate API behavior and patch weaknesses before they can be exploited. As more APIs are introduced across government architectures, this must become a continuous process embedded in every development cycle.

UP NEXT: CISA’s greenfield is a modernization model in the zero-trust era.

Securing the Future of Digital Government

APIs are not just back-end plumbing. They are the frontline of cyber defense. As threats continue to evolve, agencies must shift from reactive to proactive — embedding API security into every layer of their systems. By taking a zero-trust approach, agencies can protect sensitive data, maintain compliance and preserve the public trust that digital government depends on.

BlackJack3D/Getty Images