Peakhour.IO - API Security

An Operating Model for API and Account Protection

AC — Fri, 19 Jun 2026 00:00:00 +1000

API and account protection works best as an operating model: map routes, classify signals, choose proportionate actions, preserve evidence, and tune controls from monitor to enforce.

API Bot Abuse Does Not Stay in One Endpoint

AC — Fri, 19 Jun 2026 00:00:00 +1000

API bot abuse moves across login, checkout, and account journeys. Defenders need route-aware bot, rate, and account controls that follow the campaign rather than treating each endpoint as a separate incident.

API Protection and Account Protection Are One Request-Path Problem

AC — Fri, 19 Jun 2026 00:00:00 +1000

Account protection does not stop at the login form. The same request path carries API, bot, rate, token, and account-risk evidence, and that is where the decision needs to happen.

The Real Cost of Breached Credentials

AC — Fri, 19 Jun 2026 00:00:00 +1000

Breached credentials keep creating cost after the original breach. They feed credential stuffing, account takeover, fraud, support, and reputation costs across login, recovery, checkout, and API flows.

Credential Stuffing Does Not Stop at the Login Form

AC — Fri, 19 Jun 2026 00:00:00 +1000

Credential stuffing risk continues after a password works. Account protection needs to watch password reset, email change, stored payment, gift card, and checkout flows.

Fingerprints Are Evidence, Not Identity

AC — Fri, 19 Jun 2026 00:00:00 +1000

Browser and network fingerprints are useful security evidence, but they should not be treated as proof of a person's identity.

Account Security Without Tracking People

AC — Fri, 19 Jun 2026 00:00:00 +1000

Safer logins do not require treating people as products. Account defence should use minimised, purpose-bound risk signals and proportionate decisions.

How Residential Proxies Changed API and Account Abuse

AC — Fri, 19 Jun 2026 00:00:00 +1000

Residential proxies have changed account abuse from obvious bursts into distributed, low-noise workflows across login, account, and API routes. Treat proxy use as a risk signal, not a blunt block rule.

Shadow APIs Are Account-Abuse Paths

AC — Fri, 19 Jun 2026 00:00:00 +1000

Shadow APIs matter because attackers do not care whether a route is documented. Mobile, partner, browser-backed, and legacy APIs can all become account-abuse paths when they remain outside normal controls.

Price Transparency Is Now a Data Access Problem

AC — Mon, 18 May 2026 00:00:00 +1000

Price comparison increasingly depends on current web and API data. Retailers need bot and API controls that can distinguish intended automated access from uncontrolled extraction.

Agentic AI vs. Your API

AC — Mon, 01 Sep 2025 00:00:00 +1000

Understand the shift from scripted bots to reasoning AI agents and how to adapt your security strategy for this new reality.

Beyond the IP Address

AC — Mon, 01 Sep 2025 00:00:00 +1000

Discover why traditional IP-based rate limiting is obsolete and how advanced techniques provide robust protection against modern distributed attacks.

Key Considerations for Effective Bot Management

AC — Mon, 01 Sep 2025 00:00:00 +1000

With nearly half of all internet traffic being automated, a robust bot management strategy is essential. This article explores the key considerations for effective bot detection, classification, and response in the face of evolving threats.

The Bot Spectrum

AC — Mon, 01 Sep 2025 00:00:00 +1000

Learn to classify bots into good, bad, and grey categories and apply the right management strategy for each.

How to Use Bot Management for IAM Use Cases

AC — Wed, 20 Aug 2025 00:00:00 +1000

Bots are part of account takeover, fraud, scraping, and other abuse. Identity and access management leaders need a clear business case for bot management, or their organisations face avoidable account takeover losses and will be less prepared for the risks introduced when customers use AI agents.

How AI Agents Are Writing Custom Exploits

AC — Mon, 17 Feb 2025 14:00:00 +1100

AI agents with reasoning capabilities like DeepSeek are revolutionizing exploit development, marking the end of traditional security approaches based on static rules and patterns.

When Bots Are Your Primary Users

AC — Wed, 12 Feb 2025 14:00:00 +1100

An exploration of how AI agents are reshaping API design principles and why we must evolve our approach to serve both machine and human consumers.

Data-Driven Risk Management

AC — Fri, 07 Feb 2025 00:00:00 +1100

How Peakhour's contextual security aligns with Visa's data-driven risk management approach in the 2025-2028 Security Roadmap.

Did Residential Proxies enable a $600 Billion loss?

AC — Fri, 31 Jan 2025 00:00:00 +1100

How residential proxy networks may have enabled DeepSeek to bypass AI platform protections, leading to Nvidia's historic market value loss

Preventing Enumeration Attacks

AC — Fri, 24 Jan 2025 00:00:00 +1100

An analysis of how Peakhour's solutions help prevent enumeration attacks, aligning with Visa's Security Roadmap 2025-2028 priorities.

Managing Bots For Application Security

AC — Sun, 15 Sep 2024 00:00:00 +1000

Comprehensive guide to enterprise bot management for modern application security platforms. Learn how to protect applications and APIs from sophisticated bot threats including anti-detect browsers, credential stuffing, and automated attacks targeting DevOps environments.

The Challenge of Proxy Detection

AC — Fri, 19 Jul 2024 10:00:00 +1000

Examine why current security solutions fail to detect and mitigate threats from residential proxies, and the need for comprehensive protection strategies.

Account Protection and User Experience in Web Applications

AC — Wed, 17 Jul 2024 10:00:00 +1000

Explore strategies to enhance web application security without compromising user experience, focusing on contextual security and adaptive authentication measures.

2024 Survey Insights

AC — Tue, 16 Jul 2024 10:00:00 +1000

Our 2024 survey of Australian CISOs and CTOs looks at how businesses are approaching account protection, particularly credential stuffing and residential proxies.

2024 Survey Insights

AC — Tue, 16 Jul 2024 10:00:00 +1000

Survey data from Australian CISOs and CTOs shows broad MFA adoption, lower bot protection uptake, and early attention on residential proxy detection for credential stuffing and account takeover risk.

Application Security Beyond MFA

AC — Mon, 15 Jul 2024 10:00:00 +1000

MFA helps, but it does not stop social engineering, residential proxy abuse, credential stuffing, or session risk on its own.

Addressing Key Cloud Security Categories

AC — Wed, 01 May 2024 10:00:00 +1000

An analysis of Peakhour's role in addressing key cloud security categories identified in recent industry analysis, demonstrating its comprehensive approach to modern cloud security challenges.

Managing Breached Credential Usage

AC — Fri, 15 Mar 2024 00:00:00 +1100

How breached credential checks and risk signals help detect credential stuffing without adding unnecessary login friction.

Rate Limiting for API Security

AC — Wed, 24 Jan 2024 13:00:00 +1100

How advanced rate limiting protects modern applications and APIs from sophisticated threats including proxy networks, distributed attacks, and automated abuse in enterprise security environments.

HTTP Security Headers

AC — Tue, 28 Nov 2023 14:00:00 +1100

Comprehensive guide to HTTP security headers for protecting web applications from client-side attacks. Learn essential browser security configurations for modern application security platforms and DevSecOps workflows.

Google Chrome's "IP Protection" vs Apple Private Relay

AC — Wed, 25 Oct 2023 13:00:00 +1100

An exploration of Google Chrome's new "IP Protection" feature and a comparison with Apple's iCloud Private Relay.

Google Chrome's "IP Protection" and Online Privacy

AC — Tue, 24 Oct 2023 13:00:00 +1100

An exploration of Google Chrome's new "IP Protection" feature, its promise of enhanced privacy.

ModSecurity’s End-of-Life

AC — Mon, 16 Oct 2023 13:00:00 +1100

ModSecurity's end-of-life marks a pivotal moment in application security evolution. Discover how modern Application Security Platforms are advancing beyond traditional WAF approaches to provide comprehensive protection for web applications and APIs at the edge.

Understanding the HTTP/2 Rapid Reset Attack

AC — Wed, 11 Oct 2023 00:00:00 +1100

A comprehensive breakdown of the HTTP/2 Rapid Reset flaw and guidance on bolstering defences against potential DDoS attacks.

Headless Commerce Security

Dan — Wed, 28 Jun 2023 00:00:00 +1000

Comprehensive analysis of security challenges in headless commerce and Single Page Applications. Learn how to protect modern e-commerce APIs and microservices architectures from scraping, fraud, and automated attacks.

Enterprise DDoS Protection

AC — Mon, 19 Jun 2023 00:00:00 +1000

Analysis of the Microsoft 365 DDoS attack by Storm-1359 reveals critical lessons for enterprise application security platforms. Learn advanced Layer 7 DDoS protection strategies and rate limiting techniques for modern applications.

Chrome's TLS Extension Randomisation Experiment

AC — Thu, 02 Feb 2023 13:00:00 +1100

Does TLS extension randomisation assist in hiding Chrome?

IP Threat Intelligence

AC — Fri, 15 Jul 2022 13:00:00 +1000

Comprehensive guide to IP threat intelligence for modern application security platforms. Learn how managed IP reputation lists and threat intelligence feeds protect applications from known malicious sources and emerging threats.

CVE-2022-26134

AC — Thu, 02 Jun 2022 00:00:00 +1000

Peakhour clients are protected against CVF-2022-26134 Atlassian Confluence RCE

Intelligent Rate Limiting

AC — Mon, 16 May 2022 13:00:00 +1000

Comprehensive guide to intelligent rate limiting for modern application security platforms. Learn how sophisticated rate limiting protects APIs and web applications from abuse, DDoS attacks, and automated threats whilst maintaining optimal user experience.

Rate limiting

AC — Mon, 16 May 2022 13:00:00 +1000

How can rate limiting protect your web application and the key items to consider when enabling.

Why Manage Bots?

AC — Mon, 30 Nov 2020 13:00:00 +1100

Comprehensive guide to enterprise bot management and advanced countermeasures for protecting applications against sophisticated malicious bot threats. Learn proven strategies for bot detection, mitigation, and automated defence systems.

Malicious Bot Threats

AC — Wed, 12 Aug 2020 13:00:00 +1000

Comprehensive analysis of malicious bot threats targeting modern applications and APIs. Learn how enterprise bot management protects against automated attacks, credential stuffing, price scraping, and sophisticated bot-driven financial damage.