API9:2023 — Improper Inventory Management

Slide 2 · Definition

Improper Inventory Management — when you don’t know everything you’re running.

Forgotten versions, exposed environments, and undocumented endpoints — the attack surface you can’t defend because you can’t see it.

One-sentence definition

Improper Inventory Management occurs when an organization lacks complete visibility and control over its deployed API versions, environments, and endpoints — allowing attackers to find and exploit older, less-secure versions or unintended surfaces that the security team doesn’t know exist.

What the team thinks is running

api.company.com/v2/ — current, documented, secured

Authentication required on all endpoints

Rate limiting enforced

One production environment

What is actually running

api.company.com/v1/ — deprecated, forgotten, not secured

api.company.com/v2/internal/ — undocumented, no auth

staging-api.company.com — accessible from internet, test data

api-old.company.com — from the 2019 migration, never decommissioned

You can only secure what you know about

Every security control — authentication, rate limiting, input validation, logging — is applied to known, documented endpoints. An endpoint the team doesn’t know about gets none of those controls. API9 is the risk that the documented API surface is not the actual API surface.

← Back Three types of inventory failure →