42Crunch provides an application programming interface (API) ‘micro firewall’. APIs are a serious and growing threat vector. In 2019, Gartner stated, “By 2022, API abuses will move from an infrequent to the most-frequent attack vector, resulting in data breaches for enterprise web applications.” Its proposed solution was, “Use a Combination of API Management and Web Application Firewalls to Protect APIs, in Conjunction with Identity Infrastructure.”

This advice is clearly not getting through. On April 28, 2021, Brian Krebs explained an API weakness with an Experian partner website. The flaw had been discovered by researcher Bill Demirkapi while looking for student loan vendors online. The website offered to check his loan eligibility by checking his Experian score. It did this by combining his name, address and date of birth, and an Experian API. But the API was flawed.