My initial take on API Security was that we could provide API security with a WAF. After all, API traffic is predominantly HTTP, just like a web application. I thought that all we needed to do to provide API security is to block bad API requests. It also didn’t hurt that I worked at a WAF vendor at the time.However, the more I spoke with customers and CISOs, the more I realized that this approach didn’t work. Our WAF had no way to answer the most basic API security questions I was being asked by customers...