The practice of shifting left, or integrating security earlier in the application development process, is steadily gaining momentum. Yet there remains considerable friction amongst developer and security teams when it comes to API security — something Cisco’s VP of Emerging Technologies and Incubation Vijoy Pandey blames on a lack of visibility. That’s where the vendor's open source APIClarity project comes in.

The project, which was created with startups like 42Crunch, promises to address this challenge and help prevent attacks on public-facing APIs by simplifying the onboarding of API observability tools geared toward security.

The tool uses a service mesh framework to analyze API traffic and identify potential security risks. It’s compatible with APIs built in both cloud native and legacy environments regardless of whether they're running on premises, or in public or private cloud environments, Pandey explained.

“We actually provide ways of surfacing [potential attacks] and then provide ways of guarding against those,” Pandey said, adding that “no code changes are needed to deploy APIClarity in your environment.”

While a step in the right direction, API visibility remains an ongoing issue, and one that Cisco’s APIClarity must confront before it can address broader security challenges, Pandey admits.

“We are actually running blind when it comes to security in the modern application space,” he said. “The reason for that is lack of observability at the API layer. It does not exist."

Making things more complicated, every modern application crosses the internet because APIs can be pulled from anywhere and in this “weird environment" visibility becomes extremely important, Pandey said.

In this context, he suggests rethinking the definition of perimeter security and the perimeter itself — which has shrunk to an API. “You need to secure API-to-API calls, and you need to secure API-to-data object interactions,” he added.

APIClarity's observability functionality, Pandey argues, is a step in that direction and helps teams manage data flows and scaling, address latency issues, and access statistics all from within the API layer.

The significance of this project’s open source designation can't be understated, Pandey said, boasting that APIClarity is the first of its kind to provide API observability with a security mindset, even across the paid tooling domain. “It's something that has been missing really badly in the community.”