API Security - Airlock

APIs have become the dominant access layer of the digital enterprise, exposing business logic, brokering access to sensitive data, connecting partners, and increasingly acting as the integration fabric for AI-enabled applications and autonomous agents. The central security problem is less “API sprawl” than fragmented and inconsistent enforcement across heterogeneous environments (different gateways, Kubernetes, service meshes, legacy web infrastructure, mobile clients, and AI-driven consumers), which erodes visibility, obscures ownership, and enables inconsistent access decisions. Traditional perimeter defenses are ineffective against misuse of legitimate interfaces and business-logic abuse, especially as AI adoption shifts risk toward “valid actions in the wrong context.” Agentic systems compound this by chaining calls asynchronously under delegated authority, requiring strong authentication, fine-grained and continuous authorization, and step-up controls or human approval for sensitive operations. Enterprises therefore need unified, Zero Trust-aligned solutions that provide consistent policy enforcement, deep visibility, and compliance across the full API lifecycle and across cloud, on-premises, hybrid, and edge deployments.

Key challenge areas include the explosion of API volume and protocol diversity (REST, GraphQL, gRPC, event streaming, and AI-oriented interfaces such as MCP), which outpaces governance and leads to shadow APIs (bypassing review) and zombie APIs (exposed after deprecation), especially in hybrid/multi-cloud fragmentation. AI-driven risk expansion introduces continuous, event-driven authorization needs because static tokens and long-lived sessions do not fit autonomous workflows; however, API security has limits at the semantic level, and issues like prompt injection largely require mitigation inside the AI application architecture, with API controls mainly reducing exposure via access control, rate limiting, and logging. Attackers increasingly exploit business logic weaknesses highlighted by OWASP API Top 10 categories (e.g., BOLA, BFLA, excessive data exposure, resource consumption), necessitating runtime visibility, behavioral baselining, and context-aware enforcement rather than signature/perimeter approaches. Governance at scale requires policy-as-code, CI/CD integration, and automation (policy learning, rule suggestions, declarative enforcement) to avoid an unsustainable operational burden. Compliance pressure is rising as regulations and standards (GDPR, HIPAA, PCI DSS, ISO 42001, EU AI Act) increasingly treat APIs as auditable control points, pushing organizations toward continuous compliance monitoring and automated evidence generation.

Modern API security platforms are positioned as unifying governance and enforcement layers where identity, policy, and application behavior converge. Common capabilities include continuous API discovery/inventory (via traffic analysis, gateway/mesh integration, Kubernetes inspection, repository scanning), posture management with risk scoring and pipeline integration, runtime threat prevention with adaptive responses, identity-centric access control for human and non-human identities (including AI agents), analytics-driven security intelligence with ML-supported detection, embedded compliance/audit readiness, and developer/ecosystem enablement through portals, catalogs, onboarding, and controlled external consumption. Representative use cases span AI-driven API security for LLM/agentic workflows, continuous posture management for shadow/zombie APIs, full lifecycle security from design to deprecation, unified API fabric across hybrid/multi-cloud/edge, secure API monetization, and compliance-driven governance. Selection criteria emphasize lifecycle coverage, deployment/integration breadth, developer tooling, strong identity standards support (OAuth2, OIDC, SAML, Verifiable Credentials) and the deprecation of static API keys as a primary control, vulnerability management, analytics integrations (SIEM/XDR), robust integrity/threat protection, and scalability/performance.

The vendor spotlight describes Ergon Informatik AG (founded 1984, headquartered in Zürich) and its Airlock Secure Access Hub, which unifies IAM with web application and API protection and serves customers in 30+ countries with strength in the DACH region. Airlock’s approach prioritizes runtime enforcement against declared API contracts with deep identity context and behavioral enforcement, rather than broad discovery and posture management; it supports many API standards (REST, SOAP, GraphQL, gRPC, XML-RPC). Components include Airlock Gateway (virtual appliance WAF/API security), Airlock Microgateway (sidecar and Kubernetes Gateway API modes), and Airlock IAM (on-prem or SaaS). It enforces request/response validation, JSON schema whitelisting, and protocol filtering; integrates with Kibana/Grafana; and uses an ML-based Anomaly Shield (session profiling, retraining, transfer learning). For AI/agentic scenarios, it focuses on access-layer controls (rate limiting, strong authn/authz), supports On-Behalf-Of dual-identity tokens via RFC 8693 token exchange, and applies a Proof of Continuity model for step-up authority. Strengths highlighted include deployment flexibility, hybrid trust/token exchange for identity propagation across zones, and deep IAM/API integration; noted gaps include smaller partner ecosystem, limited proactive vulnerability analysis, and no generative-AI security functions. The closing guidance stresses starting with visibility, embedding controls across the lifecycle, treating AI security as immediate but focusing API security on governing access and permitted actions, prioritizing identity-centric and continuous authorization, supporting distributed enforcement with centralized governance, and making compliance a core evaluation driver.

• Enterprises commonly run “hundreds or even thousands of APIs,” spanning REST, GraphQL, gRPC, event streaming, and AI-oriented interfaces like the Model Context Protocol (MCP).
• Shadow APIs are described as bypassing security review and approval processes, while zombie APIs remain exposed after their intended use has ended.
• OWASP API Top 10 risks explicitly cited include Broken Object Level Authorization (BOLA), Broken Function Level Authorization (BFLA), Excessive Data Exposure, and Unrestricted Resource Consumption.
• Modern discovery approaches listed include passive traffic analysis, integration with gateways and service meshes, Kubernetes inspection, and code repository scanning.
• Compliance frameworks named as increasingly relevant to APIs include GDPR, HIPAA, PCI DSS, ISO 42001, and the EU AI Act.
• Ergon Informatik AG is stated as founded in 1984 and headquartered in Zürich, Switzerland.
• The Airlock Secure Access Hub is described as combining identity and access management with web application and API protection into a unified platform.
• Airlock’s components are specified as Airlock Gateway, Airlock Microgateway, and Airlock IAM (with IAM available both on-premises and as SaaS).
• Airlock explicitly does not include broad API discovery and inventory as part of its current scope, focusing instead on runtime security against declared contracts.
• Airlock supports agentic On-Behalf-Of flows using dual-identity tokens based on RFC 8693 Token Exchange.

• “API security is no longer a narrow technical discipline but an architectural concern that sits at the intersection of application security, identity, and access control across cloud, on-premises, and hybrid environments.”
• “The main challenge here is not just API sprawl, but fragmented enforcement.”
• “The primary risk is no longer an obviously malicious request, but a valid action executed in the wrong context.”
• “They simply evolve faster than governance models can keep up.”
• “Traditional security controls focused on signature-based detection or perimeter defenses are largely ineffective against logic abuse, parameter tampering, mass assignment, or sequence manipulation.”
• “Effective defense requires deep runtime visibility, behavioral baselining, and context-aware enforcement that understands how APIs are supposed to be used, not just how they are structured.”
• “Security controls must be expressed as policy as code, integrated directly into development pipelines, and applied consistently across all environments.”
• “API security and management cannot be separated: platforms that unify both capabilities across the full API lifecycle will deliver the most consistent protection and governance.”
• “Enterprises should move away from static, session-based access decisions toward continuous authentication and authorization.”
• “This is the key question that determines the entirety of your future API strategy.”