Practical Implementation & Automation of APISBOMs
summary
Introduces an API-SBOM that combines gateway scans, runtime ingestion and CI/CD hooks to build a live API inventory; a bank case shows three counts — 375, 200, 120 — exposing huge discovery gaps. Describes a delivered product family (Rapifi / API fuzzer) used by a Singapore government client, checksum and dependency graphs, and version drift detection. Claims 60–70% automated coverage of business-logic flaws today, targets 80–85%, and ties inventories into incident response and ticketing for faster remediation.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 2:13Why APISBOMs matter
- 5:23Zombie APIs dangers
- 8:12APISBOMs as docs
- 11:23Vulnerabilities vs weaknesses
- 13:49Compliance risks in APIs
- 15:54Gateways lack visibility
- 18:45Standards need APISBOMs
- 21:10Dependency graphs & runtime
- 23:56API security standardization challenges
- 26:47Q&A: APISBOMs in products
- 28:16Q&A: Business logic vulnerabilities in APIs
- 30:20Q&A: APISBOM future
related talks
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
22mBuilding a Robust SBOM Solution with Backstage.io
43mA radiography of a SBOM vulnerability scanner
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
34mSBOMs: zero to hero in 25 mins!
25mAI-Driven Supply Chain Security: Using AI-BOM to Detect Hidden Vulnerabilities
30mGetting Real with the Supply Chain: From SBOM Data to Action
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop