In today’s digital landscape, where APIs have transformed every business into a software company, the security challenges are evolving just as rapidly as the technology itself. From supply chain management to mobile ordering systems, APIs have become the backbone of modern business operations – and consequently, an attractive target for attackers.
In this exclusive Q&A, Scott Gerlach, Co-Founder of StackHawk, discusses why traditional security approaches fall short when it comes to API protection, and why empowering developers – who outnumber security professionals by roughly 100 to 1 – is crucial for addressing vulnerabilities effectively. Gerlach shares insights on the company’s developer-first approach to API security, the critical components of a robust API security program, and how StackHawk’s new Oversight product is giving security teams unprecedented visibility into their API testing landscape.
VMblog: Why does API security require its own dedicated tooling?
Scott Gerlach: The power of APIs has effectively turned every company into a software company. Whether it’s managing supply chains or enabling mobile ordering, APIs drive efficiency and deliver customer value across industries. Because APIs play such a critical role, it’s important to have tooling that understands their nuances, their value, and how to secure them effectively. The right tooling not only helps security teams but also ensures that businesses can deliver value quickly and safely. This makes APIs attractive targets for attackers, so having a dedicated Application and API security program is a practical necessity.
VMblog: StackHawk seems committed to helping companies shift API security left. Why is that important and what does that involve?
Gerlach: StackHawk was founded on the belief that developers are the ones who can ultimately fix API security problems, yet they’re often the last to find out about them. By empowering developers with the tools and insights to understand the API security issues that may exist, we can significantly reduce the time it takes to address these vulnerabilities. With the ratio of developers to security professionals often being around 100:1, it’s crucial to provide security teams with visibility into their attack surface and the status of their API security. Our approach enables security teams to partner effectively with development teams to identify and fix security bugs. This collaboration is at the core of how we build our product and deliver value to our customers.
VMblog: What are the key components of a strong API security program?
Gerlach: There are three key components to a proactive API security program
- Knowledge of APIs: Developers may know where APIs are, but this doesn’t scale well without continuous automation to discover all APIs that need securing. We view source code as the source of truth for this, as it documents APIs-whether they’re running through an API gateway, a CDN, or on someone’s laptop. This discovery process also helps you understand the full scope of APIs you need to defend, whether internal or external, and which teams are responsible for them.
- API Testing: The ability to test different types of APIs, and understand the nuances of how to test them, is central to API security. Testing should be integrated throughout development-during initial builds, before release, and during rework. This makes releasing high-quality, secure APIs an achievable goal, while giving development teams actionable feedback to address issues promptly.
- API Security Oversight: Visibility into your API security landscape is key to managing limited resources effectively. By understanding what’s being built, who’s building it, and how in sync your testing efforts are with development, security teams can prioritize what to work on next and identify the right teams to collaborate with. This level of oversight ensures security efforts are aligned with business objectives and efficiently distributed.
VMblog: You recently launched a new product called “Oversight” which gives teams a birds-eye view of their API security program. What will security teams uncover with this new view that wasn’t possible before?
Gerlach: With StackHawk Oversight, security teams gain an unprecedented view into how their API testing program is functioning. While traditional metrics like the number and criticality of vulnerabilities are still important, Oversight goes beyond that by providing insight into the creation and iteration of APIs by development teams, and the speed at which this occurs. We’ve observed teams adding around 3-5 repositories per week to their codebase, with 1-2 of those typically turning into APIs that need testing. This level of insight into the pace of API development has never been available to security teams before.
Now, security teams can not only see who they should collaborate with, but also identify where to focus their efforts. Whether it’s implementing testing for new APIs, helping a development team resolve a critical issue on a sensitive API, or knowing when to take a well-earned break because everything is running smoothly, Oversight enables security teams to make informed decisions and optimize their time.
VMblog: Does StackHawk have any intention of eventually shifting right and helping with API security in production?
Gerlach: StackHawk remains focused on helping security teams scale and enabling developers to perform security testing in a way that aligns with business needs. While our primary emphasis is on empowering teams to secure APIs earlier in the development process, we are also committed to supporting production operations. Our partnerships, like the one with Microsoft and Defender for APIs, are key to this.
However, achieving true efficiency isn’t just about monitoring traffic and generating tickets. It’s essential to connect security and development teams so they can collaborate on the most critical issues rather than merely playing hot potato with tickets. By combining StackHawk’s best-in-class testing with real-world threat intelligence, we can help both security and development teams strengthen the overall security of their APIs, whether in pre-production or live environments.
##
