Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The biggest risk to API security isn’t attackers—it’s how companies misunderstand APIs. They see them as engineering tools rather than business-critical contracts that connect systems, partners, and customers. Data leaks, fraud, and service disruptions aren’t just caused by bad code; they stem from APIs being built, deployed, and monetized without security as a priority. Worse, most companies don’t even know how many APIs they have, let alone what they expose.

APIs are business-critical assets, yet organizations overlook proper API security, relying on outdated tools built for web applications instead of modern API-driven ecosystems. The problem isn’t just bad coding practices but also API visibility, authentication gaps, and unchecked business logic flaws. API security requires dedicated and specific testing that understands how APIs are attacked; traditional scanners fail to keep up with that.

Authors: Or Yair, Security Research Team Lead Last August, I shared a blog on my most recent research project with Shmuel Cohen called QuickShell: Sharing Is Caring about an RCE Attack Chain on Quick Share, which we initially presented at DEF CON 32 (2024). In it, we explained how we discovered 10 unique vulnerabilities in Google’s Quick Share data transfer utility, some of which we were able to assemble into an innovative remote code execution (RCE) attack chain against the Windows version.

According to the Open Web Application Security Project (OWASP), CSRF vulnerabilities are among the top 10 most critical web application security risks. This blog will explain everything about CSRF attacks and the prevention methods to help you secure your website. Let’s start by understanding what Cross-Site Request Forgery is.

In the past few years, the risk of cyberattacks has grown enormously. In fact, more than 800,000 people experience data security breaches every year, which is quite concerning. Looking at these numbers, the safekeeping of web applications has become vital. Now, one significant threat to any web application is server-side request forgery or SSRF. This cyberattack helps the hacker trick the server to reveal sensitive information or access internal systems.

Gartner predicted that by early this year, over 60% of organizations would be using zero trust as their starting point for security. And no wonder. Cloud migration, hybrid work, and persistent threats have turned security into a minefield, exposing the cracks in old castle and moat, perimeter-based security architectures. Zero Trust aligns with how and where we work today, shifting the perimeter to individual users, devices, and applications—wherever they are.

As of 2024, 75 active ransomware groups targeted healthcare industries, businesses, and individuals with the aim of threatening these individuals with data loss or leaks in return for large payouts to decrypt this data. Many security organizations and cybersecurity experts are fighting to prevent ransomware from becoming common. One question on the minds of many people related to this topic is: Does cloud backup protect against ransomware?

Read also: Denmark gives out first unconditional prison sentences for digital piracy, one of world’s largest CSAM platforms Kidflix dismantled, and more.

NIS 2 is a new EU directive that establishes a unified cybersecurity framework for specific organizations within Member States. Compared to the original NIS directive, the scope has been expanded, and compliance is mandatory for in-scope organizations. ‍ The broader scope means that while NIS 2 is EU-specific, some organizations outside the Union may also be subject to its requirements.