- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
Every digital transformation initiative — from UPI payment integrations to cloud-native banking portals and SaaS-linked ERPs — rests on APIs. And APIs have quietly become the number-one attack surface for Indian enterprises. According to Gartner, API attacks have surpassed web application attacks as the leading vector for data breaches. For CISOs in Indian manufacturing, BFSI, healthcare, and logistics, that is not a distant statistic: it is the threat that arrived in their inboxes this quarter.
This post walks through why API security demands board-level attention in India right now, what an attacker actually does when they target your APIs, and the defence-in-depth architecture PJ Networks deploys for enterprise clients — including our operational use of PrahiX Ora, a unified SecOps platform.
The Indian digital economy runs on APIs. The RBI’s open banking directives, ONDC’s open commerce network, GSTN tax integrations, and hundreds of SaaS stacks stitched together with Zapier-style connectors have created an explosion of API endpoints — most of them poorly inventoried, many of them unauthenticated or under-authenticated, and almost none of them monitored in real time at the NOC/SOC level.
Three forces make this especially dangerous right now:
Add the DPDP Act 2023 and CERT-In’s 6-hour incident reporting directive, and the stakes for a silently breached API are no longer just reputational: they are regulatory and criminal.
Understanding the threat landscape starts with what attackers have already weaponised in the wild. The OWASP API Security Top 10 gives a practical taxonomy:
An attacker who can access /api/v1/orders/10045 simply increments the ID: /api/v1/orders/10046, /orders/10047, and so on. If the API does not validate that the requesting user owns that object, the attacker harvests thousands of records. This was behind several high-profile Indian fintech incidents in 2024–25 where customer KYC documents were accessible by substituting user IDs in mobile API calls.
Weak token implementations — short-lived tokens stored in localStorage, JWT libraries with algorithm confusion bugs, or APIs that accept both Bearer tokens and legacy session cookies — give attackers a wide authentication attack surface. Many Indian enterprises inherited these patterns from rapid pandemic-era digitisation.
APIs that return the full database object (name, email, Aadhaar-linked mobile, PAN) when the frontend only needs the display name. The client filters the data; the wire does not. A simple packet capture from a man-in-the-middle position — or a compromised device on a shared Wi-Fi — exposes the full payload.
Unthrottled APIs allow credential stuffing, OTP brute-forcing, and scraping at machine speed. Several Indian telecom and utility portal APIs were scraped for subscriber data in 2024 because no rate limits existed on the lookup endpoint.
Staging APIs promoted to production with debug endpoints live, CORS set to *, verbose error messages exposing stack traces and internal hostnames — these are endemic in environments where DevOps velocity outpaces security review.
The remaining five — Broken Function Level Authorisation, Mass Assignment, Injection, Improper Assets Management, and Insufficient Logging & Monitoring — are equally critical, and the last item is the one most directly relevant to the CERT-In compliance posture of Indian enterprises.
PJ Networks deploys Fortinet FortiGate Next-Generation Firewalls as the primary enforcement layer for API traffic. FortiGate’s application-aware inspection, combined with Fortinet’s FortiGuard AI-powered threat intelligence, provides:
FortiGate alone, however, is a perimeter control. It does not provide the observability layer needed to detect BOLA attacks, credential stuffing at low velocity, or data exfiltration that stays within the parameters of “normal” traffic. That is where SecOps platform integration becomes critical.
API attacks are often slow, low-volume, and indistinguishable from legitimate traffic at the packet level. Detecting them requires correlating events across the authentication system, the API gateway, the network layer, and the application logs simultaneously — and doing so in real time against CERT-In’s 6-hour reporting window.
PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner; when we tell clients “we operate Ora for you,” we mean our NOC/SOC analysts run the platform and respond to its alerts around the clock. Here is how each capability pillar maps to API security operations:
Ora’s SIEM ingests logs from FortiGate, FortiWeb, API gateways (Kong, AWS API Gateway, Azure APIM), identity providers (Azure AD, Okta), and application servers into a single normalised event stream. Correlation rules are mapped to the MITRE ATT&CK for Enterprise framework — specifically the Initial Access and Credential Access tactics where API abuse most commonly begins. When BOLA activity is detected (anomalous object enumeration by a single authenticated user), Ora reconstructs the full attack storyline as a graph: which endpoint was targeted, which records were accessed, when the pattern began, and whether the same session token appeared in other contexts.
For CERT-In compliance, Ora’s tiered retention — hot, cold, and archive tiers — supports the government’s direction on 180-day in-country log retention. All event data stays within Indian data centres; nothing is routed offshore by default.
API abuse does not always look like an attack on the network graph — it looks like normal HTTPS traffic to port 443. But the volume and pattern of that traffic tells a different story. Ora’s NMS component provides ML-based anomaly detection on traffic flows between microservices, between the DMZ and internal subnets, and between the enterprise perimeter and third-party SaaS endpoints. An account that normally generates 50 API calls per minute and suddenly generates 50,000 is flagged — even if every individual call is technically authorised. For multi-vendor estates where NOC visibility is fragmented across separate management consoles for firewalls, switches, access points, and SD-WAN links, Ora provides a single unified topology view via LLDP/CDP discovery, which is essential for tracing which network path an API exfiltration traversed.
For manufacturing, retail, and multi-site enterprise clients, Ora’s video surveillance (VMS) capability — supporting ONVIF, Hikvision, and Dahua cameras with video analytics — brings physical security events into the same operational picture as network and application security events. An after-hours physical access event correlated with an anomalous API call from the same site creates a much stronger incident signal than either event alone. This convergence of physical and cyber security under one operations view is increasingly valuable as insider threat and supply chain attack patterns become more sophisticated.
CERT-In’s 2022 directive requires organisations to report cyber security incidents within 6 hours of detection. For an API breach detected at 2 AM, a manual response cycle — alert, escalation, triage, containment, report — cannot reliably meet that window without automation. Ora’s SOAR capability provides pre-built playbooks with connectors to FortiGate (push block policies), Active Directory (disable compromised accounts), and ticketing systems (generate and populate the incident report). When Ora detects a credential stuffing campaign against the payment API, the playbook fires automatically: the offending IP ranges are pushed to FortiGate’s blocklist within seconds, the affected user accounts are locked, and a pre-formatted CERT-In incident report is generated with the required fields populated. The analyst reviews and approves; they do not type. That is what makes a 6-hour window achievable at 2 AM with a lean SOC team.
If your organisation is starting its API security journey, here is a prioritised 90-day roadmap PJ Networks typically recommends:
India’s Digital Personal Data Protection Act 2023 establishes obligations for Data Fiduciaries — any organisation that determines the purpose and means of processing personal data. Most enterprise APIs that handle customer records, transaction histories, or user profiles qualify. Key implications:
PJ Networks helps clients assess their API estate against DPDP obligations and supports compliance with the technical security safeguards the Act requires, though no tool or service by itself confers DPDP compliance — that requires governance, policy, and legal alignment as well.
Indian enterprises have invested heavily in network perimeter security — firewalls, IDS/IPS, DLP. But the perimeter has moved. It is now every API endpoint your partners, customers, and mobile apps call. Protecting that perimeter requires a combination of enforcement (FortiGate, FortiWeb), discovery and inventory, authentication hardening, and continuous SecOps visibility that can detect low-and-slow API attacks and respond within the CERT-In reporting window.
PJ Networks’ 24/7 NOC/SOC team, backed by the PrahiX Ora platform we deploy and operate for clients, delivers that continuous visibility. If your organisation is ready to assess its API attack surface or wants to understand how Ora’s SIEM, NMS, and SOAR capabilities would integrate with your existing Fortinet estate, reach out to PJ Networks for a discovery conversation.
PJ Networks is an Indian managed-security provider specialising in FortiGate/Fortinet deployments, 24/7 NOC/SOC operations, ZTNA, SD-WAN, and FortiMail. We serve enterprise clients across BFSI, manufacturing, healthcare, and logistics with India-based operations and a security-first delivery model.