Application Security Community

Hi Community,

We're excited to announce an upcoming live Ask Me Anything (AMA) session on Wednesday, 9 September, from 16:00 to 17:00 BST (15:00 UTC) right here on the Imperva Cyber Community! This Thread will open just ahead of this time to allow our global members to submit questions. 

Join our expert panel, Luke Babarinde, Aaron Seibert, Amrit Talapatra, and Jared Tan, as they answer your questions on API Security in this dedicated discussion thread.

Here's how to participate:

• The AMA thread will open in advance to allow our global audience to post questions early.
• Our experts will start responding live on Wednesday, 9 September, at 15:00 UTC and will be available for one hour only.
• Be sure to follow or like this thread to receive updates and reminders.

Make the most of this rare opportunity by submitting your questions ahead of time to ensure our experts can address as many queries as possible!

Also, don't miss the recordings of our recent API Security events linked below. Feel free to watch, learn, and add any new questions to this thread. And please, share this announcement with your colleagues!

API Authentication Under Attack Insights from the Imperva's Token Authentication Risk Report Webinar Recording

How Imperva/Thales Customers Can Operationalize API Security: A 5-Level Operations Model Webinar Recording

We are looking forward to your participation!

#APISecurity

------------------------------
Sarah LAMONT
Digital Community Manager
------------------------------

Hi all, 

I'm getting excited for our API Ask me anything, so just thought I'd drop my own question here ahead of the team joining:

Can you share your top resources that customers should refer to when using API Security?

Thanks!

------------------------------
Sarah LAMONT
Digital Community Manager
------------------------------

Hey Sarah,

I'd say these 4 links are a great place to start!

API Security Solution Brief: Imperva---API-Security-Solution-Brief-Jan-2026-v01

API Security Privacy Guide: Imperva-API-Security-Priv-2-page-Info-Nov-2025-v02

API Security Buyer's Guide: Imperva-2025-API-Security-Buyer's-Guide

API Security Threat Report: Imperva-API-Threat-Report-2025

API Security Token Risk & Authentication Report: Imperva-Token_Auth_Risk_Report-July-2026-Final--1-

...As well as the Community sessions that the team run, of course! 😁

------------------------------
Rohit Kumar
------------------------------

Original Message:
Sent: 09-09-2026 09:38
From: Sarah LAMONT
Subject: Got API Security Questions? Ask Our Experts Live on 9 Sept!

Hi all, 

I'm getting excited for our API Ask me anything, so just thought I'd drop my own question here ahead of the team joining:

Can you share your top resources that customers should refer to when using API Security?

Thanks!

------------------------------
Sarah LAMONT
Digital Community Manager
------------------------------

Hi, and thanks for hosting this AMA.

Recently there was a webinar on risks in JWT tokens. Can you elaborate on what kind of risks you discover and how you can find them?

Looking forward to hearing back from you!

------------------------------
Percy Smith
Program Manager, Customer Success
Imperva
------------------------------

------------------------------
Amrit TALAPATRA
------------------------------

Original Message:
Sent: 09-09-2026 09:47
From: Percy Smith
Subject: Got API Security Questions? Ask Our Experts Live on 9 Sept!

Hi, and thanks for hosting this AMA.

Recently there was a webinar on risks in JWT tokens. Can you elaborate on what kind of risks you discover and how you can find them?

Looking forward to hearing back from you!

------------------------------
Percy Smith
Program Manager, Customer Success
Imperva
------------------------------

📢The team are live!📢

Let us know your burning questions around API Security...

------------------------------
Sarah LAMONT
Digital Community Manager
------------------------------

Hi, thank you for hosting the space.

I have some questions regarding Imperva discovery process and api authentication 

1.How does discovery treat CSRF/anti-forgery tokens? Are they ever counted as authentication material?

2.After adding an auth location what is the expected time / traffic volume before an endpoint's auth state re-evaluates? Is there a way to observe relearn progress?

3. For endpoints confirmed as intentionally public / not requiring auth - what's the recommended way to record that so the finding clears from the Unauthenticated inventory? 

Thanks!

------------------------------
Jean Moreno
------------------------------

Hi Jean! I will take your third question, and Amrit will take 1 and 2. 

The recommended approach would be to create a tag and apply it to the endpoint. The tag should reflect that the Unauthenticated finding was accepted - `UnauthAccepted` for an example, which can then be filtered in the UI. 

The important concept here is that you don't want to remove visibility of that endpoint being unauthenticated - if any co-risk is discovered in the future (sensitive data, excessive data exposure, etc.) then understanding that the endpoint is also (intentionally) unauthenticated changes the overall risk exposure, and may result in different actions needing to be taken to mitigate other co-risks.

------------------------------
Aaron SEIBERT
------------------------------

Original Message:
Sent: 09-09-2026 11:26
From: Jean Moreno
Subject: Got API Security Questions? Ask Our Experts Live on 9 Sept!

Hi, thank you for hosting the space.

I have some questions regarding Imperva discovery process and api authentication 

1.How does discovery treat CSRF/anti-forgery tokens? Are they ever counted as authentication material?

2.After adding an auth location what is the expected time / traffic volume before an endpoint's auth state re-evaluates? Is there a way to observe relearn progress?

3. For endpoints confirmed as intentionally public / not requiring auth - what's the recommended way to record that so the finding clears from the Unauthenticated inventory? 

Thanks!

Jean Moreno

------------------------------
Jean Moreno
Technical User
Experian Services Corp.
Costa Mesa CA
------------------------------

Hi Jean,

Thanks for the question:

1. CSRF / anti-forgery tokens: These are not generally treated as authentication material. Our discovery/authentication logic looks for tokens that represent the user/session authentication context. CSRF tokens are typically request-level security tokens and, by themselves, would not be considered an authentication location. But that being said, if by chance you would like to consider it as an auth location, you need to add a custom authentication location into the system, post which the system will start evaluating the auth location traffic.
2. Re-evaluation after adding an auth location: Once an authentication location is added, the system needs to observe traffic containing that authentication token before it can reassess the authentication state of endpoints. The exact time/volume can vary depending on traffic patterns but if I were to provide an estimate, it would be something like 200 requests containing the specific auth location OR 8 days of traffic, whichever comes first. There isn't currently a customer-facing indicator that shows a specific "relearning" progress percentage but we have it planned in our roadmap with some other enhancements. The best way to validate the change is to monitor the affected endpoints and their authentication state as new traffic is processed.

------------------------------
Amrit TALAPATRA
------------------------------

Original Message:
Sent: 09-09-2026 11:26
From: Jean Moreno
Subject: Got API Security Questions? Ask Our Experts Live on 9 Sept!

Hi, thank you for hosting the space.

I have some questions regarding Imperva discovery process and api authentication 

1.How does discovery treat CSRF/anti-forgery tokens? Are they ever counted as authentication material?

2.After adding an auth location what is the expected time / traffic volume before an endpoint's auth state re-evaluates? Is there a way to observe relearn progress?

3. For endpoints confirmed as intentionally public / not requiring auth - what's the recommended way to record that so the finding clears from the Unauthenticated inventory? 

Thanks!

Jean Moreno

------------------------------
Jean Moreno
Technical User
Experian Services Corp.
Costa Mesa CA
------------------------------

Hi, thanks for hosting the AMA.

I have a customer with a large number of APIs, how can they effectively manage these in API Security?

Thanks,

Ash

------------------------------
Asher ANDERSON
------------------------------

Hi Ash!

Our product team has put together a great high-level overview of the operational process for API Security - this is great for customers with a mature risk/vulnerability management program/team that wishes to integrate the API Sec risk data.

The key place to start is prioritizing based on risk factor combinations - for example, endpoints marked as unauthenticated that return sensitive data in the response are typically going to be the endpoints to focus on first, by either adding the authentication location if the endpoint does expect authentication, or implementing code changes that remove the sensitive data from the response or require authentication if not already required.

Once the risks have been properly assessed, then mitigating the risks (via platform policies/rules as well as long-term development efforts) and then monitoring the endpoint for additional risks close out the cycle.

Risk data can also be integrated with customer systems through our APIs - A common example asked for is creation of ServiceNow tickets when new risks are identified in customer APIs, creating work items for development teams automatically. 

Service offerings are also available for customers, providing periodic guided risk assessments, SME-led tuning of detection models, and even addressing custom integration needs (like the ServiceNow example). 

------------------------------
Aaron Seibert
Tech Lead - Application Security
------------------------------

Original Message:
Sent: 09-09-2026 11:52
From: Asher ANDERSON
Subject: Got API Security Questions? Ask Our Experts Live on 9 Sept!

Hi, thanks for hosting the AMA.

I have a customer with a large number of APIs, how can they effectively manage these in API Security?

Thanks,

Ash

------------------------------
Asher ANDERSON
------------------------------

Thanks for hosting this AMA!

What shifts do you see in the API threat landscape in the coming years and how are you staying ahead of the threats - especially as attackers find new targets e.g. unmonitored East-West traffic?

------------------------------
Kyle BINGHAM
------------------------------

Hi Kyle,

Thanks for the question:

Here's how we see the API threat landscape evolving:

1. Attackers are moving beyond the traditional North-South attack surface and increasingly targeting East-West API traffic between internal services, microservices and APIs. These APIs are often less monitored and may have weaker authentication and authorization controls, because application developers think these are for internal services only so why bother putting in a lot of effort to secure them making them an attractive target. Just as an FYI, Imperva API Security does have sensors that can tap into east-west traffic too.
2. We expect attacks to become increasingly identity- and business-logic-driven. Rather than simply exploiting technical vulnerabilities, attackers are looking to abuse legitimate API access. For example, exploiting broken object-level authorization, manipulating sensitive business flows, or using valid credentials/tokens to access data they shouldn't. So, API schema based validations or policies will become obsolete eventually as the attacks become more intelligently driven. In the era of AI that is not too far away.
3. Finally, the rapid adoption of AI and API-driven architectures is expanding the number of APIs, increasing their complexity and making it harder for security teams to maintain an accurate inventory and understand what is actually exposed.

Cheers,

------------------------------
Amrit TALAPATRA
------------------------------

Original Message:
Sent: 09-09-2026 11:53
From: Kyle BINGHAM
Subject: Got API Security Questions? Ask Our Experts Live on 9 Sept!

Thanks for hosting this AMA!

What shifts do you see in the API threat landscape in the coming years and how are you staying ahead of the threats - especially as attackers find new targets e.g. unmonitored East-West traffic?

------------------------------
Kyle BINGHAM
------------------------------

Hi folks,

That's a wrap for our live session. Thank you all so much for your API Sec questions. I have no doubt that our members will find this thread useful when investigating API Security.

I will leave the thread open for a while so that our members in different regions can add queries at a time that suits them. Fellow members and our wider App Sec team will no doubt be happy to assist as and when they are online.

Thanks again. 🙌

------------------------------
Sarah LAMONT
Digital Community Manager
------------------------------