All Day All Night API Security Endpoint Analytics

The talk opens with a retailer whose inventory API was being hammered by people checking stock levels so they could strike once shelves were restocked. Jason Kent explains why APIs matter, since they carry the data attackers want. He shows how outsiders find them: reading endpoints from mobile app packages, checking public API docs, probing for exposed GraphQL playgrounds, and spotting old WordPress interfaces.

The core argument is that simply counting requests reveals attacks. Useful measures include requests per endpoint, usernames seen from many IP addresses, user agent versions, origin networks such as residential proxies, and session token age. Baselining normal traffic makes spikes obvious, as when a restaurant chain's peak jumped from about 300,000 to 1.1 million requests per second. Recommended tactics include anomaly detection with machine learning, canary endpoints, and progressive blocking rules rather than permanent IP bans.

The takeaway is that you cannot secure APIs you have not found, so build an inventory and log decrypted traffic in a form you can count. Avoid publishing API specifications, remove dead endpoints, and expect privacy proxies to weaken IP reputation. The Q&A covered retention, with about two weeks of mostly metadata kept, and tuning rules when legitimate traffic gets blocked.