A recent report from Salt Security published a truly alarming statistic. According to the report, 95% of API attacks come from authenticated sources. This should raise alarms for anyone who knows anything about cybersecurity, as it means API attacks are seemingly real transactions. These attacks won’t even be noticed by average cybersecurity systems, as, for all intents and purposes, it’s legitimate traffic.

Luckily, all hope is not lost. Even when API traffic is authenticated, much of its behavior isn’t. Malicious actors with verified credentials often leave traces of themselves when you know what to look for. With that in mind, we’ve put together a list of five signs that an authenticated user might not be what they appear to be.

1. Unusual Resource Requests

One of the most surefire giveaways that authenticated API traffic is malicious is requesting sequentially-enumerated resources. Requesting resources in order, like /objectID/12345, objectID/12346, objectID/12347 is one of the most common patterns associated with Broken Object Level Authorization (BOLA). Configuring your cybersecurity system to alert you anytime anyone attempts to access enumerated resources is a good way to protect your system against API enumeration attacks. Avoiding enumerated naming conventions altogether is another tactic, and is generally recommended as a best practice for API naming for this reason.

Users attempting to access unusual resources is another sign that attackers are trying to breach your system. A company with an eCommerce account attempting to access a full list of employees and customers might be one example of unusual resource requests that might set off some warning bells. Invoking large amounts of user IDs, account numbers, document IDs, or customer records is another sign that malicious actors are trying to breach your system. Attempting to access unusual resources is also a sign that an authenticated user may be an AI. Setting up an identity-oriented profile for your users, keeping track of their usual behavior, will allow your cybersecurity system to detect anomalous behavior when it occurs.

2. Unusual Access Patterns

Anomalous login data is another sign that authenticated API traffic may be malicious. If one of your users usually logs in from Brooklyn, NY, an IP address from Dubai is a sure sign that something‘s going on. At the very least, it’s worth triggering an additional authentication flow like 2FA, as it’s better safe than sorry. Like anomalous behavior detection, an identity-oriented profile keeping track of users’ usual login location is an easy way to catch unusual login locations. You can also set an alert for attempts to access unusual resources, like a regular user attempting to retrieve admin materials, as that’s a sign that an attacker may be attempting to escalate privilege.

3. Unusual Volume of Requests

A user making an unusually large volume of requests is another dead giveaway that authenticated traffic might actually be malicious. A user that typically requests one or two employee records unexpectedly attempting to transfer their entire team’s data is a sign that something is up. Bulk data transfers are common behavior for AI-driven systems, as well. Like unusual access patterns, usual access behavior can be stored as part of a user’s identity profile. This unusual behavior is worth an additional authentication flow at the very least, again like the unusual access patterns.

Unusual volume with no respite is a sign that an AI-driven system is attempting to use your APIs inappropriately. Unlike human users, AI-enabled cyberattackers don’t need to rest. An authenticated user making requests across the entire 24-hour cycle is a sign that authenticated traffic may be compromised.

4. Unexpected Bulk Actions

Related to an unusual volume of requests, an authenticated user performing any number of bulk actions should set off warning bells — especially if it’s unusual for the account. For instance, a user attempting to transfer the entire company payroll from an endpoint in a single call just isn’t that common. That’s true for most bulk actions, which can be anything from transferring an organization’s entire customer base or sales history. Both are at least worth a glance. While this behavior can be monitored with identity-based user profiles, it’s an even better idea to set an alert for any bulk activities.

5. Unusual Error Rates

While it might not be unusual for an authenticated user to generate one or two actual errors, anything more than that is a sign that the user isn’t supposed to be there. Keeping an eye out for an unusual amount of 400-, 403-, or 404-level HTTP responses is an easy way to detect that traffic that seems to be legitimate might actually be malicious. It might also be a sign an attacker’s performing some reconnaissance. This makes setting an alert for three or more error codes a good idea, but identity control might be a good idea as well. This can help avoid setting off false flags, but it also lets you make a note of users who might not be that tech savvy.

Authenticated API Traffic Can Actually Be Malicious

Authenticated API traffic that turns out to be malicious can be the most dangerous type of data breach. Not only can it not be detected by typical API security systems, but it has full permission to do nearly anything it wants inside of your system if no additional protections are in place. The existence of AI and agents makes things even more complicated, as it allows unethical attackers to make high volumes of attempts 24/7. It also makes protecting against malicious traffic that’s masquerading as authenticated users more important than ever.

The good news is that it’s a good idea to have identity-based protections in place that implement fine-grained authorization and limit role-based permissions to a least-privilege model. This will help to foundationally protect against malicious traffic masquerading as authenticated users as well as all manner of other attacks, so it’s a good practice to get into anyway.