#HITB2022SIN #COMMSEC API Security Through External Attack Surface Management

Overview: Philip Wiley presents at HITB Singapore on API security through external attack surface management, drawing from his role as hacker-in-residence at Psycognito.

Key Topics: Continuous attack surface monitoring versus annual penetration tests; discovering vulnerabilities between assessment cycles; threat actor perspective on external-facing assets; and retest validation workflows.

Technical Details: Wiley describes finding high-severity API vulnerabilities during continuous monitoring that would have persisted until the next annual pen test. He emphasizes detecting assets the same way threat actors discover them.

Takeaways: Annual penetration tests leave year-long gaps in attack surface visibility. Organizations should implement continuous external attack surface management with threat actor perspective.