Your customer-facing API responded to 12,000 requests in the last hour. Two of those requests came from a legitimate third party. At least one—the one that slid past rate limiting and your WAF—came from an attacker who now has administrative access to your user database. You won't discover this for 197 days, which is the IBM Cost of a Data Breach Report 2024 average time to identify and contain a breach. We have walked into three incident response engagements this year where the root cause was an unsecured API. Not a phishing email. Not an insider threat. An API endpoint that someone in engineering exposed without authentication, thinking it was only for internal testing.
For SaaS companies running on cloud infrastructure, your APIs are your widest attack surface. OWASP, the Open Web Application Security Project, tracks this in their API Security Top Ten—a living document that every CISO should have laminated on their wall. Let us cut through the noise. You do not need "AI-powered API security platforms" with seven-figure price tags. You need five controls, implemented correctly, by Q2 2026. Here they are.
1. Authenticate Everything, Including the Requests You Think Are Internal
We still see SaaS platforms where internal microservice-to-microservice communication runs on a flat network with no API keys. The OWASP API top ten lists Broken Object Level Authorization and Broken Authentication as positions one and two for a reason. Our team audited a UK fintech last quarter where a mobile app endpoint returned user transaction data for any account ID passed in the URL, provided the caller had a valid session token. That is not authentication—that is a random number generator wearing a badge.
What to do by Q2 2026:
- Every API endpoint, including internal ones, must validate a token. No exceptions for "development" or "testing" endpoints. If it responds on port 443, it authenticates.
- Use OAuth 2.0 with short-lived access tokens (15 minutes maximum). Rotate refresh tokens weekly. This is not theoretical—the NCSC's guidance on OAuth 2.0 implementation is clear on token lifetimes.
- Implement an API gateway as a single authentication enforcement point. Our CloudAuditX scans can detect endpoints bypassing your gateway. We see this in 40% of the cloud environments we review.
2. Rate Limit Every Endpoint, But Do It Intelligently
Rate limiting is not "block the user after 100 requests per minute." That stops a teenager with a script. It does not stop a determined attacker who rotates through 50,000 residential proxies. The real control is resource-based rate limiting. If your report generation endpoint takes 5 seconds of CPU time per request, cap it at 12 requests per hour per tenant, regardless of how many IPs the caller uses. This is API security best practice that the OWASP API top ten covers under Unrestricted Resource Consumption.
Common mistake: Engineering teams set rate limits per API key, not per user or per tenant. An attacker who compromises one valid API key from a third-party integration can exhaust your entire database with that single key. Rate limit by user ID in the JWT claims, not by the key.
Implementation step: Use a sliding window log algorithm on your API gateway, not a fixed window. Fixed windows allow bursts at the boundary—an attacker can send 100 requests at 11:59 and 100 more at 12:00, effectively doubling the limit. Sliding windows prevent this. Set your gateway to reject requests that exceed 200% of the sustained rate with a 429 status. Log every 429 to your SIEM.
3. Validate Input at the Gateway, Not Just the Application
Your application might validate that a user ID is a UUID. But what about the 30 JSON fields in a booking request that your application never expected? Injection attacks in APIs are on the rise. The OWASP API top ten includes Injection at position eight, but our incident data shows it is the third most common root cause in API breaches we investigate.
The control: Deploy a JSON schema validator at your API gateway. Every request must match a strict schema that defines not just types (string, number) but also maximum lengths, enum values, and required fields. Reject anything that does not match before it reaches your application server. This stops SQL injection, NoSQL injection, and server-side request forgery (SSRF) at the perimeter.
Practical example: We advise clients to build a schema registry in their CI/CD pipeline. Every microservice publishes an OpenAPI 3.1 specification. The gateway loads these specifications at deployment time and validates incoming requests against them. If a field is not in the spec, the request is dropped. No exceptions for "backward compatibility." This is the same approach that Stripe and Twilio use for their public APIs, and it works.
4. Log Everything, Monitor for Anomalies, and Retain for 12 Months
The IBM breach report we cited earlier stated that breaches taking longer than 200 days to identify cost an average of 30% more than those identified within 30 days. The difference between a 30-day detection and a 200-day one is logging. Not fancy AI anomaly detection—just complete, structured logging that your SOC can query.
What to log for every API request:
- Timestamp, source IP, user agent, and geolocation.
- Endpoint, HTTP method, and response status code.
- Authentication token (hashed, not raw) and user ID.
- Request body size and response body size.
- Response time in milliseconds.
Retain this data for 12 months minimum. The UK GDPR does not specify a retention period for security logs, but the ICO's guidance on security breaches recommends keeping logs long enough to investigate incidents. Practical experience shows 12 months covers the breach detection window for most organisations. Store logs in a SIEM or a cloud object store with immutability enabled—Amazon S3 Object Lock or Azure Blob Storage immutability policies. If an attacker gets administrative access, they should not be able to delete the logs.
The common mistake: Logging only 4XX and 5XX responses. Attackers probe with 200 OK responses that hit unintended endpoints. Log every request, every response. The storage cost is negligible compared to the cost of a breach. Our fractional vCISO engagements always start with a logging audit. If you cannot tell us what every API endpoint did in the last 24 hours, you are flying blind.
5. Run a Security Review of Every Third-Party Integration
The API that breaks you is rarely your own. It is the third-party CRM integration that your sales team connected to your customer database without telling you. Or the payments processor that sends webhook payloads to your endpoint with no signature verification. We see this in every cloud audit we perform with CloudAuditX—third-party integrations that have access to production data with no rate limiting, no authentication, and no logging.
The control: For every third-party integration, enforce three conditions:
- Signed webhooks: The provider must sign every webhook payload with a secret key your team controls. Verify the signature before processing. If the provider does not support signed webhooks (e.g., HMAC-SHA256), do not integrate.
- Least privilege API keys: Scoped to read-only or write-only, never both. Use separate keys for different functions. If the marketing platform needs to read user emails, it does not need write access to your product catalogue.
- Quarterly revalidation: Every March, June, September, and December, review third-party access. Remove integrations no longer in use. Rotate keys for active ones. We recommend building this into your ISO 27001 ISMS, as the standard requires periodic review of supplier relationships.
How Pyralink Helps You Lock Down These Controls
Pyralink Innovation Ltd is a UK cybersecurity firm that works hands-on with SaaS companies to implement these controls in production, not theory. Our team, led by Michael Adedeji (CISM, CISA, CC, MSc Data Science), has built, audited, and secured APIs for organisations handling everything from UK healthcare data to financial transactions. We hold £5 million in professional indemnity insurance—because our advice needs to be defensible when the board asks questions after an incident.
We start with a CloudAuditX scan that maps your entire API surface, identifies endpoints without authentication, checks rate limiting configurations against OWASP API top ten standards, and logs findings in a board-ready report with remediation steps prioritised by risk. The free scan covers your cloud environment's API gateways, load balancers, and serverless functions.
For organisations that need ongoing guidance, our fractional vCISO service (from £497 per month) provides a dedicated security leader who builds your API security programme, reviews third-party integrations quarterly, and ensures compliance with UK GDPR, PECR, and FCA operational resilience requirements. We do not produce slide decks. We produce enforceable policies, gateway configuration templates, and SIEM alert rules you can deploy in 48 hours.
Take action today. The controls we described here are achievable in one quarter. Do not wait for the breach report to justify the budget.
Run a free CloudAuditX scan →
Book a free security review →
No pressure. Just answers.