R38 — API Abuse / Broken Object-Level Authorization
OWASP API Top 10 attack surface: BOLA, mass assignment, unbounded resource consumption, abuse of business-logic endpoints. Distinct from R04 because the control set is API gateways, schema enforcement, per-object authorization checks and behavioral API security, not WAF rules. Residual exists because authorization bugs are application-logic flaws no scanner reliably catches.
What is API Abuse / Broken Object-Level Authorization?
OWASP API Top 10 attack surface: BOLA, mass assignment, unbounded resource consumption, abuse of business-logic endpoints. Distinct from R04 because the control set is API gateways, schema enforcement, per-object authorization checks and behavioral API security, not WAF rules. Residual exists because authorization bugs are application-logic flaws no scanner reliably catches. CISO Game tracks this as R38 in the live risk register, severity 8 (Major), category External.
How does CISO Game model API Abuse / Broken Object-Level Authorization?
Exposure for R38 runs from 0 to 100, recomputed live as you buy, cancel, or reassign products. How the exposure model works →
Real-world parallel
API abuse / Broken Object-Level Authorization is OWASP API Top 10 #1 — insufficient authorization checks at the object level allow attackers to manipulate IDs in API requests to access other users' data. Modern AppSec programs treat APIs as first-class attack surface; runtime API security (Salt, Noname, Traceable-class) supplements pre-prod testing.
How do security teams mitigate API Abuse / Broken Object-Level Authorization?
The dominant subscore levers for this risk are:
- Prevention subscore — weight 50%
- Detection subscore — weight 20%
- Response subscore — weight 10%
- Identity subscore — weight 10%
Residual offset: +5 exposure points are structural — no product fully removes them. Real-world parallels: zero-day windows, vendor monoculture, regulator unpredictability.
Which investments mitigate API Abuse / Broken Object-Level Authorization?
Products in CISO Game that reduce exposure to R38:
- WAF + DDoS ProtectionNetwork
- Premium CNAPP (multi-cloud)Cloud Sec
- SAST (static code analysis)AppSec
- DAST (dynamic app testing)AppSec
- SCA (dependency scanning)AppSec
- Annual penetration testServices
- Bug Bounty ProgramServices
- Hire Security EngineerHeadcount
Which related risks should you also watch?
Risks with similar dominant subscores or shared category — addressing one often helps the others:
- R04 Web Application AttackExternal · severity 8
- R34 DDoS-Extortion / Layer-7 AbuseExternal · severity 7
- R05 DDoSExternal · severity 5
- R13 Data ExfiltrationData · severity 9
Why does API Abuse / Broken Object-Level Authorization matter to a CISO?
External adversarial risks like api abuse / broken object-level authorization are the risks boards expect their CISO to talk about. They drive the strongest demand for detection + response capability and the strongest emotional response in the boardroom.
How can you test your mitigation strategy?
Click Play CISO Game free to see R38 appear live in your risk register and watch each purchase move the exposure number in real time. No signup required.
Stress-test API Abuse / Broken Object-Level Authorization in the Standard run scenario →