A customer checks an invoice, changes an account setting or requests a text message. Behind that ordinary action, an application programming interface (API) may pass data between the business’s website, software, payment provider and other services. The danger is not that an API exists or is reachable; it is that its access rules, configuration or limits do not match what the business intends.
What is an API, and why might a business owner not see it?
An API is a defined way for software systems to communicate. A website might use one to retrieve an order, a mobile app to update an account, or a business system to send messages through an outside provider. APIs can be customer-facing, partner-facing or internal. They may sit behind familiar screens, so the customer sees a button or form while the API handles the request.
As an Amazon Associate I earn from qualifying purchases.
That connection can expose application logic and sensitive information, including personally identifiable information, if its protections are inadequate. The OWASP API Security Project describes this as a reason APIs have become targets for attackers. A public-facing API is not automatically unsafe; what matters is whether it verifies who is making a request, what that caller is allowed to do, and how much activity is reasonable.
How can an API flaw expose customer data or business functions?
OWASP’s 2023 API Security Top 10 identifies several risk categories. The examples below are illustrative, not reports of particular incidents. A valid login alone does not establish permission to access every record or perform every action.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Access to the wrong customer’s record
Broken Object Level Authorization occurs when an API accepts an object identifier—such as an invoice or account number—without checking that the caller is entitled to that specific record. For example, if a customer can change an invoice ID in a request and see another customer’s invoice, the missing protection is the record-level authorization check. OWASP places this category first in its 2023 list.
Access to staff-only actions or fields
Broken Function Level Authorization can allow a user to invoke an operation intended for staff, such as changing an account status. Broken Object Property Level Authorization can expose fields that the user should not see or allow changes to properties they should not control. A sound check must cover the requested action and the specific data—not just whether the caller signed in.
Compromised or mishandled credentials
Broken Authentication can let an attacker compromise or misuse tokens, or act as another user. Authentication establishes identity; authorization determines what that identity may access. Businesses need both layers.
Automated requests that run up costs or disrupt service
Unrestricted Resource Consumption matters when requests consume computing capacity or trigger metered services. For example, repeated automated requests to an endpoint that sends paid SMS messages could consume credits; excessive traffic can also contribute to denial of service. OWASP identifies both resource pressure and per-request costs, such as email or SMS charges, as relevant risks.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Old endpoints, weak settings and over-trusted integrations
Security Misconfiguration and Improper Inventory Management can leave debug endpoints, insecure defaults or deprecated API versions available after a product changes. For example, a former API version might still respond even though the business has replaced its website. OWASP also warns that developers may trust data from other APIs more than ordinary user input; an integration can return unexpected data that should still be validated.
Legitimate features used excessively
Some sensitive business flows can be harmed through excessive automation even when there is no conventional coding bug. A workflow intended for a person to request a service, claim an offer or perform a business action may create harm when automated at scale. The appropriate protections depend on what the workflow does and what abuse would cost.
How can a small business find out what APIs it uses?
Start with an inventory rather than assuming that the website is the whole system. Include services built into websites and apps, cloud software, payment and messaging providers, partner connections, and any systems a developer or provider manages. CISA’s Internet Exposure Reduction Guidance, published June 4, 2025, recommends identifying internet-exposed assets, deciding which need to remain reachable, restricting unnecessary exposure, and mitigating risks on what remains exposed.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Ask your website developer, software vendors and integration providers for a current list of APIs, hosts, versions and responsible owners.
- For each one, establish what business purpose it serves, what data it handles, who can call it and whether it must be reachable from the internet.
- Identify old versions, test or debug endpoints, and connections that no longer have an active business purpose.
- Record who is responsible for updates and for responding to unusual activity or failures.
An inventory is only useful if it changes when the business changes. New software, providers, integrations and workflows can add endpoints or alter the data they handle.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
What practical API security steps should a small business take?
NIST’s SP 800-228, Guidelines for API Protection for Cloud-Native Systems, describes protections before runtime and during runtime, with an incremental, risk-based approach. Its guidance page lists updates as of March 13, 2026, including appendices on API risks by category and recommended controls by lifecycle stage. The checklist below translates the NIST lifecycle approach and OWASP risks into questions to take to the people who manage your systems; it is not a complete audit standard or a guarantee of security.
- Confirm access rules for records and actions. Ask whether each endpoint checks the caller’s permission for the particular record and requested operation. A login check alone is not enough.
- Limit data exposure and changes. Review which fields an API returns and which client-submitted properties it accepts. Restrict both to what the relevant workflow needs.
- Set limits around costly or sensitive workflows. Ask how requests are limited, monitored or challenged when they can trigger paid messages, consume substantial resources or perform consequential business actions.
- Reduce unnecessary exposure. Retire deprecated versions and debug endpoints, remove unsafe defaults, and restrict internet access where it is not required. For endpoints that must remain exposed, identify and mitigate their risks.
- Validate integration data and monitor operation. Treat third-party API responses as untrusted input. Review errors and unusual request patterns so that failures or abuse do not go unnoticed.
- Revisit protections after changes. Recheck the inventory, access rules and limits when a provider, application, integration or business workflow changes.
Should you use in-house controls, a managed gateway or an outside assessment?
There is no single option that fits every organization. NIST discusses multiple implementation options and their advantages and disadvantages, supporting a choice based on the business’s systems and risks rather than a universal product recommendation. A gateway may help manage and observe API traffic, but it does not by itself prove that each user is entitled to each record or action. An outside assessment can help when the business depends on developers or providers but lacks the expertise to verify its protections.
Compare options using practical questions:
- Does the approach cover the full API inventory, including third-party and older endpoints?
- Does it test authorization at both the record and function level?
- Can it work with the organization’s software framework and hosting model?
- Does it provide useful runtime visibility and a way to respond to suspicious activity?
- Who will implement changes, bear recurring costs and update protections as systems evolve?
For a small organization without in-house API expertise, an application security consultant or API assessment may be appropriate if its scope explicitly covers inventory, authorization, configuration and runtime controls. Clarify which systems will be examined, what testing is included and who is responsible for fixing and retesting findings.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Do small businesses have a known API breach rate?
The official sources cited here describe API risk categories and protective practices; they do not establish a measured API exposure or breach rate for small businesses. OWASP’s Top 10 is a taxonomy of risks, not a ranking by the share of incidents each category causes. It would therefore be misleading to use those categories to claim that a particular fraction of small businesses has suffered an API breach.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
