CISOs shift from perimeter security to API security

Bill Doerrfeld | March 30, 2026

My first-ever contribution to CSO Online looks at the shifting landscape, from perimeter-based security to API security, and how CISOs are responding.

API attacks are on the rise. But traditional security approaches like endpoint detection and response (EDR) can miss this vector entirely.


Excited to share my first-ever contribution to CSO Online today, which looks at the shifting landscape, from endpoint security to API security, and how CISOs are responding. You can read it here.


In a nutshell, malicious traffic may look like normal traffic, but legacy perimeter-based defenses miss business logic gaps and systemic authentication and authorization issues.


To respond, CISOs are using a combination of API governance frameworks, inventory management, API gateways, strong identity and authorization, and other techniques.


I'd love to write more for this publication, but it takes connecting with the right sources. If you're a CISO or work with one and have an interesting perspective to share, feel free to get in touch.

Read: APIs are the new perimeter: Here’s how CISOs are securing them

Other Blog Posts

KubeCon + CloudNativeCon North America 2026 keynote stage with the
By Bill Doerrfeld • November 10, 2026
At KubeCon NA 2026, the opening keynotes made it clear: AI inference is the new cloud native production workload. Here's what that means for Kubernetes.
Agentics Day: MCP + Agents North America title slide on the screen at KubeCon NA 2026
By Bill Doerrfeld • November 10, 2026
Agents are getting production tested. I explore some of the top lessons learned at KubeCon NA 2026's co-located event, Agentics Day: MCP + Agents.
KubeCon + CloudNativeCon North America 2026 graphic: November 9-12, Salt Lake City, Utah
By Bill Doerrfeld • November 6, 2026
I'll be at KubeCon + CloudNativeCon NA 2026 in Salt Lake City, Nov 9–12, scouting stories on agentic AI, cloud native and APIs. Reach out if you'd like to connect!
AI Pen-Testing Conference graphic from AI Security University
By Bill Doerrfeld • November 4, 2026
Another virtual conference is in the bag, and the community really showed up to talk AI penetration testing.
By Bill Doerrfeld • October 30, 2026
My eight-part Road to KubeCon column with The New Stack is done. Here are some of the key takeaways.
How AI Agents Change API Interaction opening slide doerrfeld bill 2026 nordic apis
By Bill Doerrfeld • October 18, 2026
Here are my slides from my opening keynote at Nordic APIs Summit 2026, exploring how AI agents are changing API interaction patterns.
By Bill Doerrfeld • October 17, 2026
My latest research for AI Security University looks at AI tools and resources for pen-testers, red teamers, and bug bounty hunters.
By Bill Doerrfeld • October 16, 2026
My commissioned feature for Arthur D. Little's PRISM publication analyzes the big shifts underway now that generating code is becoming trivial.
By Bill Doerrfeld • October 11, 2026
Was happy to participate as a speaker and moderator at SecureMaine on October 8th, 2026.
By Bill Doerrfeld • October 5, 2026
My latest for LeadDev interviews a Meta engineer who built an agentic system to optimize their capacity planning, leading to real power use savings.