Attackers have learned to defeat traditional ‘moat around the castle’ perimeter defenses. Modern application security tools offer the answer: distributed tracing and AI that understands the app they protect.

WAFs are designed to protect your web applications from web application attacks. But they leave you vulnerable to API attacks. This blog discusses the 11 things that WAFs don't do that are needed to properly protect APIs.

Explore the key insights from Forrester's State of Application Security report 2023 in our latest blog post. We delve into the complexities of application security, the rise of Software Composition Analysis (SCA), and the importance of API security in today's digital landscape. Learn about the Shift-Everywhere movement and how it's shaping the future of application security. This comprehensive analysis is a must-read for anyone looking to understand the current trends and challenges in application security.

In the last few weeks, the security community has been shaken by a series of exploits targeting MOVEit, a popular file transfer software. These incidents have exposed critical vulnerabilities, allowing threat actors to compromise sensitive data and exploit organizations ranging from the BBS to several arms of the US Government.

Explore the major findings from the 2023 Verizon Data Breach Investigations Report in our latest blog post. We delve into the rise of social engineering attacks, the human element in breaches, the most affected sectors, and the significance of web application attacks in today's cybersecurity landscape.

Spring4shell vulnerability (CVE-2022-22965) enables Remote Code Execution when using the Spring Framework

Spring4shell vulnerability (CVE-2022-22965) enables Remote Code Execution when using the Spring Framework

A look at the challenges teams face with mitigating Log4j vulnerabilities (i.e. Log4Shell) and how Traceable AI closes those gaps.

The new Log4j vulnerability (Log4Shell) has gotten the Internet up in arms. There are active exploits and scanning for the vulnerability is rampant. The vulnerability is widespread and will take time to resolve everywhere. Here's how can Traceable AI help.

A popular fairy tale told in IT circles is that the internet is built on a perfectly orchestrated 7-layer stack. A popular extension of this notion is that enterprises can secure their infrastructure using a layered approach to security. Like most fairy tales, there is some truth in these stories.

December has finally come and Traceable AI has released a whole new suite of software features for our customers, with the continued aim of ensuring the best API Security solution on the market.

We are pleased to announce that Traceable AI has added a new agentless deployment option of traffic mirroring for customers who wish to deploy an API security solution to protect their API-driven applications.

Bold security threats are giving rise to a new industry of API-specific security capabilities much more powerful than current management tools.

In 2019, I hacked 30 bank mobile apps and APIs in coordination with domestic and international financial services and FinTech companies. In 2020-2021, I hacked 30 mobile health (mHealth) apps and FHIR APIs in coordination with healthcare providers, giving me access to thousands of patient records via their APIs due to broken authentication and authorization vulnerabilities. This year, in coordination with federal and state law enforcement agencies, I was able to take remote control of law enforcement vehicles through the automaker’s APIs.

Common internal and external threats and the Zero Trust practices to address them.

How do you know your apps are protected?

A Practitioner's View

The president of the United States signed an Executive Order on improving the Nation’s Cybersecurity. It covers many things, one of which is zero trust architecture. What does this mean?

The majority of organizations rely heavily on third-party web applications connected through APIs to generate revenue and serve customers. In many cases, these web applications contain security vulnerabilities.

Attackers are listening to your API chatter, finding vulnerabilities that reveal valuable (and personal) data. Here’s what developers should consider to protect against excessive data exposure.

What if we could reduce the time to detect a cyber attack all the way down to zero?

Six factors to get right when planning Kubernetes architecture.

When a security expert tested several dozen mobile health applications, all had API vulnerabilities that could leak personal information. This should be a warning call.

Everything You Need to Know About Authentication and Authorization in Web APIs - Part 2

SecOps keeps production environments safe. Now, “shifting left” approaches are needed to secure production applications and APIs.

As part of DevSecOps best practices, modern application developers and security teams should borrow techniques from crime scene forensics to investigate and protect against attacks.

New tech transform dev - but with risk

Part I: What are Modern Applications

PartII: API Security in Modern Applications

API Security and the SolarWinds Breach: a wake up call