Slides and Recording From My APISEC|Con 2024 Talk on API Sprawl

Bill Doerrfeld | May 22, 2024

What Is API Sprawl, And What Can You Do About It?


You may think your API portfolio looks well-maintained, like a pristine city. Well, think again — welcome to the desert of the real... a land full of zombie APIs and shadow endpoints...


Today, I presented at APIsec University's online conference, API|SEC CON 2024, which had over 1,700 people join to talk all things API security. In my session, What Is API Sprawl, And What Can You Do About It?, I went through some statistics about the state of API adoption and spotlighted some indications that API sprawl conditions are emerging. I ended with some ideas on how to avoid API sprawl. All with references to The Matrix, of course.


Thank you for inviting me to speak, it was a pleasure to be a part of the event!


Here are some of the resources I mentioned in my talk:


- APIFutures: API Sprawl to Be a Pressing Concern in 2024

- API Futures project

- Continuous API Sprawl: Challenges and Opportunities in an API-Driven Economy, F5 report, 2021.

- Why CIOs back API governance to avoid tech sprawl

- The 2022 API Security Trends Report, S&P Global Market Intelligence, 2022.

- The Nordic APIs blog and digest

- OWASP API Security Top 10 2023


Follow me on LinkedIn or X for updates about my articles and upcoming research into API governance!


Download the slides here:




Download Slides

Other Blog Posts

How AI Agents Change API Interaction opening slide doerrfeld bill 2026 nordic apis
By Bill Doerrfeld • October 18, 2026
Here are my slides from my opening keynote at Nordic APIs Summit 2026, exploring how AI agents are changing API interaction patterns.
By Bill Doerrfeld • October 17, 2026
My latest research for AI Security University looks at AI tools and resources for pen-testers, red teamers, and bug bounty hunters.
By Bill Doerrfeld • October 16, 2026
My commissioned feature for Arthur D. Little's PRISM publication analyzes the big shifts underway now that generating code is becoming trivial.
By Bill Doerrfeld • October 11, 2026
Was happy to participate as a speaker and moderator at SecureMaine on October 8th, 2026.
By Bill Doerrfeld • October 5, 2026
My latest for LeadDev interviews a Meta engineer who built an agentic system to optimize their capacity planning, leading to real power use savings.
By Bill Doerrfeld • September 30, 2026
I set out expecting to write an article about how every enterprise was jumping on trendy alternative or "neo" clouds. That ended up not being the case.
By Bill Doerrfeld • September 28, 2026
Join the virtual AI Pen-Testing Conference to explore how AI is changing penetration testing, red teaming, and the security testing of AI systems.
By Bill Doerrfeld • September 28, 2026
Counting down to Nordic APIs Summit 2026 in Stockholm, featuring 60+ speakers exploring agentic AI, APIs, MCP, and security.
By Bill Doerrfeld • September 28, 2026
I covered a Yale and GitHub report on LeadDev that explores developer attitudes on climate change and curbing IT waste.
By Bill Doerrfeld • September 15, 2026
Does your agent really need access to every tool call under the sun?