With API management capabilities in their traditional sense becoming commoditized, the vendors continue to add sophisticated security capabilities to their products to remain competitive with pure play API security solutions – and their number is growing rapidly as well. API management and API security should no longer be considered as standalone, isolated components of IT infrastructures. On the contrary, choosing the right components of an “API fabric” should cover such aspects as application development and operations, data and infrastructure security, and regulatory compliance, among others.

API discovery and security monitoring solutions continue to be the most popular class of products offered on the API security market, but solutions addressing other phases of the API lifecycle are growing in popularity as well. Most notably, the concept of data-centric security is gaining traction, where the focus is shifting from infrastructure towards protecting the sensitive data exposed by APIs.

Increasingly, vendors incorporate AI and machine learning (ML) into their solutions to enable sophisticated security analytics and real-time detection of malicious or suspicious anomalies in the behavior profiles of APIs, their consumers, and even the endpoint devices. With the growing adoption of generative AI, we can expect that intelligent automation and decision support will play an increasingly important role in API security solutions as well – for forensic analysis, decision support, policy generation and other applications.

On the other end of the API lifecycle, solutions are focusing on “shifting left,” bringing security to the earliest phases of software development and design, providing capabilities like API testing and API specification analysis. Testing early and often makes application code more resilient to attacks and is generally considered a best practice and an essential part of the “secure by design” methodology.

And yet, shifting left alone cannot be considered a panacea for all API security challenges. Consistent and reliable protection of business-critical APIs must not just extend to every other phase of the API lifecycle, but also ensure that this coverage is provided as a holistic, integrated experience.

In the end, we are no longer treating API management and security as independent or even mutually exclusive subjects. On the contrary, the ultimate goal is helping organizations identify and deploy solutions that address their business requirements, security risks, and compliance challenges when publishing their own and consuming third-party APIs.

And finally, it’s even more important for companies developing their API strategies to be aware of current security developments and stay agile and flexible to be able to respond quickly to constantly emerging new risks, as well as to incorporate new technologies into their security architectures.