devopsy.kinsta.cloud

Tag: API

Sideko Launches Platform to Automate API Ecosystem Management

In the rapidly evolving world of digital transformation, APIs have become the unsung heroes, powering everything from mobile banking to smart home devices. Brooklyn-based Sideko is tackling one of the most challenging aspects of this API revolution with the launch of its comprehensive API ecosystem platform, designed to automate the entire suite of tools that developers need.

The platform’s launch is critical when APIs have evolved from simple technical integration points to become the primary delivery mechanism for enterprise products and services. While APIs continue to proliferate, the surrounding ecosystem of documentation, SDKs, mock servers and command-line interfaces has traditionally required extensive engineering resources to create and maintain.

“The role of APIs has fundamentally shifted from being a technical integration point to becoming the primary way enterprises deliver products,” said Patrick Kelly, CEO and co-founder of Sideko. “Our platform ensures that this new front door to companies’ services is welcoming and efficient for developers.”

According to Mitch Ashley, VP and Practice Lead, DevOps and Application Development, The Futurum Group, “APIs are fundamental to software built using API-first and API-as-a-product principles. The challenge with the number of APIs and their widespread use is that each API has its own lifecycle. APIs change over time, with multiple versions, redesigns, specific contracts that are promised when using an API, and their sunset. Along with using APIs comes documentation, SDKs, and sample code for each version supported. AI automation of the API lifecycle takes that repetitive burden from the developers and removes opportunities for errors.”

Solving the API Maintenance Challenge

Maintaining API documentation and related tools has long been a tedious task for engineering teams, diverting resources from core product development. When an API changes, all these companion resources need updates, often manually, creating opportunities for inconsistencies and outdated information that frustrate developers.

Sideko’s platform addresses this challenge by automatically generating and synchronizing the entire suite of API tools. The most significant advantage is that when an API is modified, all associated documentation, code samples, SDKs and testing environments update automatically, ensuring everything stays in sync without human intervention.

This synchronization prevents one of the most common developer experience pitfalls – outdated or inconsistent documentation – while freeing engineering teams from maintenance tasks that consume thousands of hours annually.

Enterprises Adopting the Platform

The solution has already gained traction among businesses looking to scale their API offerings without increasing their maintenance burden proportionally. Prudential Financial, Inc. has selected Sideko to create and maintain API documentation and other developer tools, supporting its strategy to expand its API usage rapidly.

For enterprises like Prudential, the platform offers a way to maintain consistent API experiences across teams and products – a crucial factor as APIs become central to product strategy rather than mere technical integrations.

Creating an AI-Ready Action Layer

Perhaps most intriguing is the platform’s potential role in enterprise AI adoption. As companies deploy AI agents to automate workflows, these systems require precise, programmatic access to enterprise systems – precisely what well-maintained APIs provide.

Sideko’s automatically generated SDKs and agent toolkits create what Kelly describes as a robust “action layer” that enables AI agents to interact accurately with the millions of APIs that unlock enterprise workflows and data.

“As APIs become the primary distribution channel for enterprise products, maintaining a modern developer experience is crucial but increasingly complex,” added Kelly. “We’re focused on automating away this complexity so companies can focus on their core products rather than coding developer tools by hand.”

Under the Hood

At the core of Sideko’s offering is what the company describes as a breakthrough code generation engine that uses syntax tree analysis to produce human-quality code. This approach allows the platform to generate clean, idiomatic code that follows best practices – code that’s reportedly indistinguishable from what senior engineers would write.

For engineering leaders who must balance limited resources with growing API programs, the platform presents an opportunity to eliminate repetitive maintenance work while improving the quality of developer-facing resources.

As enterprises expand their API footprints and AI integration becomes increasingly central to business strategy, solutions like Sideko’s may represent a convenient and competitive necessity for companies looking to make their services programmable in the modern digital ecosystem.

March 19, 2025
Developers’ Enthusiasm for Generative AI is Growing: Survey

Developers are increasingly positive about generative AI’s effects on their jobs and their companies in general, a change in a community that in the past seemed to have feared it, according to a report released this week by cloud API developer Kong.

In addition, they say APIs will play an increasingly large role in the ongoing development of AI, with the integration with AI being the most critical aspect of API management over the next one to two years.

“For businesses, integrating AI into API management is crucial for automating and optimizing operations, enhancing security, and offering more personalized user experiences,” wrote the authors of Kong’s “API Impact Report 2024.” “It can allow for real-time anomaly detection, dynamic resource adjustment for optimal performance, and innovative service development.”

In a survey of 747 IT professionals and business leaders, 92% of respondents said that AI is a priority for their businesses and 83% said that AI investments in their organizations have opened up opportunities for new products or services over the past year.

That said, a trend toward users bypassing their organizations’ policies around AI use is putting pressure on companies to put in place tools like AI gateways and data loss prevention (DLP) solutions to ensure data governance and regulatory compliance, particularly as governments are increasingly putting new laws in place to make the use and innovation of generative AI safer, according to Kong.

AI Use Guidelines are Important

The report’s authors noted that organizations and individuals are adopting AI at a much faster pace than they did with previous technological breakthroughs, “which means organizations need to move faster than ever to keep on top of the wave of AI innovation.” About 80% of developers surveyed said their organizations have AI usage guidelines or restrictions, with about 20% having none in place. About 2% said their organizations ban generative AI tools outright.

About 60% of respondents said they find ways of getting around restrictions to access the AI tools they need. However, data privacy, security, and governance also top the list – at almost 60% – of challenges faced in integrating AI services with existing microservice infrastructures.

“We’ve reached the moment where AI adoption is imperative; however, doing so strategically will be the ultimate marker of long-term success,” said Marco Palladino, Kong’s co-founder and CTO. “Our report highlights the need for infrastructure underneath AI applications that provides strong governance while enhancing AI performance.”

Warming Up to Generative AI

The company’s report echoes what other vendors have found when it comes to developers and AI. A survey late last year by Kobiton found that most mobile app developers and testers are using generative AI tools for a range of tasks and to help address challenges in developer and QA operations. In addition, they’re using the technology when they have limited financial resources or not enough skilled programmers.

In April, Docker said in a report that software engineers are increasingly relying on AI to build their applications, with use cases ranging from coding and documentation to research, troubleshooting and debugging.

Similarly, Kong’s survey found developers are warming up to generative AI, with 60% saying they are passionate about working with the fast-emerging technology and 57% saying it will make their jobs easier.

However, others are still worried about it, with 35% saying that AI adoption is moving too fast. There also is the ongoing worry about the future, with 18% believing the use of AI tools will lead to layoffs at their companies. Almost one in 10 said they don’t want to work with AI, with some believing that AI will undervalue their work or increase their workloads.

“Zooming out from personal outlook to their view on business impact, half of those surveyed say AI will enhance productivity and innovation,” the authors wrote. “26% say AI will create new positions or opportunities in their organizations.”

APIs to Take a Central Role

APIs will become increasingly important in the development and use of AI, according to Kong. The company noted that APIs in general are widely used, with 85% of Fortune 100s using them as a core part of their IT operations and almost half of developers and managers saying their companies need to be more aware of the business value APIs deliver.

They’ll also play a central role in AI, with the report’s authors writing that “APIs enable communication between humans and AI systems — as well as AI systems and other digital tools. APIs serve as the hands, eyes and ears of AI. And as AI usage increases, so will the number of APIs that enable them.”

They pointed to a Gartner prediction that by 2026, more than 30% of the increase in demand for APIs will come from AI and tools using large language models (LLMs). Beyond that, Kong predicts the value of APIs to enable AI will grow 170% by 2030.

In that same timeframe, Kong’s research says that the economic impact of APIs in the United States will reach $3.4 trillion, with the global impact hitting $17.3 trillion. Leaning on data from the International Monetary Fund on projected worldwide GDP growth and the global digital economy, the economic impact of APIs should increase from 12.7% of global GDP this year to 14% in 2030.

“[A] simple back-of-the-napkin math paints a picture of why an API strategy is so essential for organizations today: In a short time, the consumers of our websites or digital products are more likely to be AI than human,” the authors wrote. “Whether we’re using AI, training AI or having AI interact with APIs to perform operations, an API is involved. That’s why controlling the usage of AI at the interface level is an API problem.”

August 30, 2024
Helping Developers Build Secure APIs From the Start

Modern businesses manage tens of thousands of APIs. While this interconnectedness fosters innovation and agility, it also creates a costly, sprawling attack surface. In 2022 alone, U.S. companies were estimated to have lost up to $23 billion from compromises linked to APIs, and 59% of organizations were forced to slow the rollout of new applications to production owing to API security concerns.

Although developers are largely responsible for creating and managing APIs within an organization, they rarely have access or control over the networking tools needed to secure them. To minimize API risk, developers must have the power to build them securely from the start. Here are the security measures and tools required to achieve the best results.

API Security Best Practices

APIs are designed to help applications talk to one another — meaning they often have access to company and customer data, including financial information and transaction records. This is no secret, and is why hackers often target APIs, especially those exposed to network requests. To mitigate this risk, developers must implement security best practices across every API they build, including adding authentication and authorization, access controls and encryption for all API requests and responses.

Authentication and Authorization

Effective API security relies on authentication (who users are) and authorization (what users can do) to control access to resources. Client-side applications must include a token within the API call, allowing the service to validate the client’s identity through authentication using a standard like OAuth 2.0, OpenID Connect or JSON Web Tokens. Then, authorization should determine what actions are allowed for the authenticated client. This ensures that users or devices have only the minimum permissions required to perform specific tasks, following the principle of least privilege.

Access Controls

Any API that grants third-party access to internal systems and data should include robust access controls and monitoring. Developers can implement these controls through middleware to verify user identity, determine permitted actions and define when those actions are allowed to take place and for how long. Middleware can also rate limit and enforce security policies such as geo-fencing, I/O content validation and data sanitization. For advanced protection, developers must place APIs behind an API gateway, firewall or web application firewall using HTTPS to encrypt communication and filter out malicious traffic.

Encryption

Encrypting API requests and responses can help protect against eavesdropping and data breaches. Developers must use HTTPS as the communication protocol to encrypt all traffic and safeguard sensitive information such as credentials and data exchanged between the API and its clients. They can enable HTTP Strict Transport Security (HSTS) instead of redirecting to ensure API clients always use HTTPS, preventing accidental information leaks due to insecure connections. By building encryption into the core of the API, developers can ensure sensitive data remains protected during communication.

Improving API Security With Developer Access to Networking Tools

These best practices can greatly reduce the risk of API security breaches, but many developers don’t have direct access to the tools required to implement them. API gateways, which are used to manage API traffic, introduce risk because developers don’t have control over them. This increases the likelihood of a broken contract between the API services and traffic management, which can result in downtime and weakened security due to misconfigurations.

Developer-defined API gateways can eliminate this friction and streamline the deployment process. They allow developers to establish secure connectivity to their APIs by integrating ingress directly into them. Declaring ingress, which encompasses capabilities such as high performance, resilience, security and observability, directly in the application can simplify the development process and reduce security and performance incidents. Developers can ensure that API requests contain the exact parameters expected by the API to eliminate the risk of a broken contract, unauthorized access and more.

Giving developers access to robust traffic management tools like API gateways allows them to build secure APIs from the start. Combining that functionality with authentication and authorization, access controls and encryption can greatly reduce the instances of API-related compromises, all while improving time-to-market and performance. Developers are already tasked with creating and managing APIs; they must also be empowered to secure them easily.

July 9, 2024
The Three Pillars of Modern API Management

API sprawl is a real problem for modern organizations. Enterprises are managing tens of thousands of APIs across their applications and services. Layered on top are several API gateways such as Amazon API Gateway or Google Apigee, as well as event brokers such as Solace, which are limited in their ability to see across other gateways. There needs to be a central place where all APIs are secured, discoverable and governable, regardless of where they are, or which API gateway is being used. We have seen trends around creating a “single pane of glass” in other areas of modern development — observability being a category that comes to mind — but API management is still a siloed, complex mess. This has significant implications for API governance.

This is where federated API management comes into play.

Unlike the more traditional approach — where most API management functionality was inextricably tied to the specific API gateway being used — federated API management abstracts much of the management and governance of your APIs away from the API gateway. To be clear, the API gateway is still a crucial component of infrastructure, but teams should be empowered to use whatever API gateway best fits their use case while being able to achieve proper governance.

This federated approach enables central platform teams to govern every API without having to context switch between different tools. It is one management layer that sits on top of the underlying gateways as a governance “wrapper.” Platform teams should be able to do everything from API discovery and inventory, measure spec compliance, design subscription flows and publish APIs to a developer portal for consumer-side self-service discovery and consumption — all with a single platform.

And this can’t just stop at synchronous APIs. API management must begin to treat event streams and event APIs as first-class citizens on par with synchronous APIs, as more and more organizations introduce and/or reinvigorate event streaming initiatives. This will enable teams to get more ROI from their initial investment in streaming. And of course, any modern API management system you are considering should be AI-forward to keep up with industry standards.

To be concise, here are the three pillars any API management solution must cover.

The Three Pillars

Multi-Gateway and Multi-Broker: API management, as a practice, must support the ability of API publishers to manage, secure and govern APIs and services from multiple different API gateways and event brokers.

Event-Native: API management must treat event streams and event APIs as first-class citizens on par with synchronous APIs, as more and more organizations introduce event streaming. This will enable teams to get more ROI out of their initial investment in streaming.

AI-Forward: API management vendors must find ways to both improve their API management offerings through AI and better enable organizations to leverage AI as a force multiplier.

If your company’s API management solution is multi-gateway, event-native and AI-forward, then you will be ahead of the competition in productivity and security. In today’s era, where thousands of APIs are being leveraged throughout an organization, it is a no-brainer to have a single source of truth where these APIs are discoverable and adequately managed. By having more transparency and visibility, developers can move faster while the platform and security teams can feel more confident about their security posture. It’s a win-win.

July 4, 2024
SmartBear Applies Generative AI Across API Tool Portfolio

SmartBear has added generative artificial intelligence (AI) capabilities to its portfolio of tools for building, testing and monitoring application programming interfaces (APIs).

Dan Faulkner, chief product and technology officer for SmartBear, said SmartBear HaloAI is initially based on large language models (LLMs) from Open AI. However, the company expects to employ multiple LLMs from different providers as use cases continue to evolve.

SmartBear, rather than building LLMs, is focusing its efforts on using the data it collects to leverage capabilities of multiple generative AI platforms that would cost millions of dollars to replicate, he added.

GenAI Capabilities build on Previous AI Investments

Available in beta, SmartBear HaloAI builds on previous AI investments the company has made, including the recent acquisition of Reflect, a provider of a generative AI tool for automating the management of testing. Generative AI has already been used to automate test cases without having to write and debug the scripts previously required. A quality assurance (QA) team that needed to create 500 manual tests averaging five minutes per test, was able to automatically run those tests in five seconds, saving 20 hours of testing per regression cycle.

The overall goal is to make it simpler for existing DevOps teams to create and test APIs at a time when there is still a shortage of IT professionals with those specific skills, noted Faulkner.

In general, SmartBear is moving toward aggregating the tools and platforms it provided into a series of solution hubs that will make it easier to build, test, release and monitor software, noted Faulkner. SmartBear HaloAI will then make it simpler to automate processes across all the elements that make up a solution, he added.

Finding a way to automate the testing of code will be especially critical because as more developers rely on general-purpose AI tools such as ChatGPT to write code the quality of the code being written is likely to decline, noted Faulkner. Generative AI platforms have been trained using code of varying quality from across the internet, so the quality of the output provided can vary widely, he noted.

The only way to mitigate that issue will be to continuously test code using platforms that generate tests using examples that have been vetted by the provider of a test automation platform, said Faulkner. In effect, SmartBear is providing the “special sauce” needed to achieve that goal at scale, he added.

It’s still early days so far as the adoption of generative AI is concerned. However, it won’t be long before these tools are pervasively employed to not only generate code but also automate DevOps workflows. The next major challenge will be orchestrating all the AI assistants optimized to perform specific tasks, such as testing APIs, that will soon be embedded into those workflows.

In the meantime, DevOps teams will need to determine to what degree they can extend their existing workflows in ways that incorporate AI assistants versus having to replace their existing platforms. After all, the debate has now moved beyond determining what the benefits of AI are going to be, to address the actual cost of making that transition.

May 31, 2024
StarTree Makes Observability Case for Apache Pinot Database

StarTree broadly enhances its real-time database platform by adding query support for metrics, logs and traces.

StarTree today made a case for becoming the foundation upon which observability is gained in IT environments by adding support for metrics, logs and traces to its real-time database platform delivered as a cloud service.

In addition, the company is also making generally available a StarTree ThirdEye service for detecting anomalies and identifying the root cause of application issues. It has also made a free serverless computing tier available on its cloud service.

Viable Alternative to the Legacy Database

Announced at the Real-Time Analytics Summit conference, StarTree Cloud is based on Apache Pinot, an open source columnar database optimized for real-time analytics, originally developed by LinkedIn. StarTree, via a private preview, is signaling that it views Apace Pinot as a viable alternative to the legacy database, upon which observability platforms DevOps teams use to troubleshoot IT environments.

StarTree, to further advance Apache Pinot, is also now adding a vector indexing capability to Apache Pinot along with support for a write application programming interface (API) to facilitate real-time synchronization with extract, transform and load (ELT) pipelines and additional integrations to Grafana and Tableau to improve visualizations.

Chinmay Soman, head of product for StarTree, said the issue with existing databases is they are not designed to scale to the level of performance that modern application environments will require.

Early Days for Achieving Observability

It’s still early days for achieving observability in application environments but many DevOps teams are now moving well past simply monitoring a set of pre-determined metrics. Observability platforms enable DevOps teams to launch queries that make it easier to troubleshoot applications. Not every DevOps team knows what queries to investigate. With the rise of artificial intelligence (AI), it’s becoming more feasible to rely on machine learning algorithms to analyze application environments using metrics, logs and traces stored in an observability platform.

Few DevOps teams will build an observability platform themselves but the capabilities of the underlying databases on they are based are critical, said Soman. DevOps teams should make certain the databases used in these platforms today will be able to scale to meet real-time processing requirements that will only steadily increase as more complex applications are deployed across distributed computing environments, he added.

In the meantime, StarTree is moving toward providing more observability capabilities via the managed database service it provides via the cloud.

It’s only a matter of time before DevOps teams need deeper levels of visibility to manage modern application environments in real time. As organizations become more dependent on software than ever, even the most minor glitch can now have a major financial impact. The challenge DevOps teams face, of course, is finding the funding needed to acquire these capabilities.

In the meantime, DevOps teams should at the very least start assessing which of the many monitoring tools being employed today might one day be rationalized by an observability platform, that in time might lower total costs by streamlining DevOps workflows that today are often more disjointed than anyone cares to admit.

May 8, 2024
Modern Application Management Requires Deeper Internet Visibility

Most IT teams regularly employ a range of tools to monitor application performance. But in an era where applications are running everywhere from the cloud to the network edge, the visibility being provided is limited. The metrics and analysis being surfaced are roughly akin to only being able to see a few yards ahead when driving a vehicle on a rainy night. Managing modern applications instead requires platforms that provide the equivalent of radar and sonar capabilities, so that IT teams have better visibility into application environments that today remain far too shrouded to effectively manage.

Achieving that goal requires a deeper insight into how various Internet services impact application performance. Just about every application depends on the quality of one or more of those services. The more application services that depend on the Internet, the more probable it becomes that someone will encounter issues intermittently impacting performance in ways that are difficult to understand, much less predict.

Unfortunately, most IT teams today have limited ability to discern how the performance of Internet services is impacting their applications. There are, of course, Internet performance monitoring (IPM) tools capable of surfacing network performance metrics. The challenge and opportunity now is to surface those metrics in context with all the other telemetry data that DevOps teams collect from the various application performance management (APM) and observability platforms they rely on to monitor and troubleshoot application environments.

Why Applications Are Becoming More Distributed

First, with the rise of cloud computing followed by the proliferation of software-as-a-service (SaaS) applications and now the rise of edge computing, applications are becoming more distributed with each passing day. The challenge is that each application is invoked across a network that adds latency, and existing APM and observability platforms cannot effectively analyze it.

The pace at which applications are becoming more distributed is only going to increase. More data is being processed and analyzed at the network edge as organizations deploy near real-time applications. Instead of transferring raw data to the cloud, these applications process and analyze data at the point where it is created and consumed. It’s only then that an application either streams or passes the aggregated results to a cloud service or to an on-premises IT environment for further analysis.

Most DevOps teams, however, lack visibility into how Internet services impact more highly distributed applications, beyond the cloud service or on-premises IT environment where they historically deployed their applications.

Internet Blind Spots

Broadly, there are three major classes of blind spots that impact distributed application performance. The first and arguably most opaque are the services provided by third-party vendors. Ranging from content delivery networks (CDNs) to software-as-a-service (SaaS) application, each of these services is controlled by an external service provider that typically doesn’t allows a DevOps team to collect telemetry data by deploying agent software in their IT environments. At best, they may expose an application programming interface (API) to enable an agentless approach to collecting data, but that method doesn’t typically provide the level of control required to optimize application performance.

The second major blind spot is at the device level. Configuration errors in browsers can have a significant impact on loading times that adversely impacts application performance, for example.

Finally, various platforms and protocols ranging Domain Name Servers (DNS) to publish-and-subscribe services can impact applications in way that an APM or observability platform isn’t going to detect.

The only way to provide the level of visibility required is to leverage an IPM platform that collect telemetry data from a global network, made up of thousands of points-of-presence (PoPs) to determine precisely what level of Internet service is delivered to any given end point.

Context and Control

Integrating the telemetry data collected via an IPM provided DevOps teams with a context to better troubleshoot distributed applications. Instead of wondering if a certain piece of code is to blame, a DevOps team can immediately determine whether Internet traffic moving through a specific location is either creating additional latency or blocking access altogether.

Armed with those insights, the team can contact then Internet services provider to address the issue or, if necessary, reroute via another service to ensure application availability.

Regardless of approach, the days when DevOps teams found themselves subject to the vagaries of network services, over which they had little to no influence, are coming to an end.

DevOps Meets Netops

The integration of IPM and APM or observability platforms creates a foundation upon which best practices for managing network operations (NetOps) and DevOps can finally be melded. Instead of having to convene “war rooms” to uncover the root cause of an issue, both teams will instantly be able to visualize to what degree networking services might be adversely impacting networking services. All that time spent guessing what the cause of a problem might be can now be allocated to remediating the issue.

In an era where applications have never been more dependent on networking services, the need to converge the management of NetOps and DevOps workflows has never been more critical.

Conclusion

Most DevOps teams know all too well there are often major discrepancies between what DevOps teams relying on APM and observability platforms believe and what is actually occurring in a distributed computing environment. The challenge is that they typically lacked the visibility required to determine what best course of action to address the issue. As IPMs become more integrated with APM and observability platforms, network blind spots that previously made discovering the root cause of an issue will soon be all but eliminated.

Of course, each DevOps team needs to determine to what degree gaining those insights is a priority. However, given the number of issues DevOps teams are trying to resolve that can be traced back to an Internet service, it’s clear the overall level of stress and toil DevOps teams regularly encounter could be greatly reduced by simply providing more networking visibility into those services.

April 5, 2024
Hasura Adds “Supergraph” to Platform for Managing APIs

Hasura, whose product helps compose GraphQL APIs backed by databases and services, today made available in beta an update to its platform. The company is adding a graph modeling framework that makes it simpler to manage application programming interfaces (APIs) at scale.

The goal is to make it easier for IT teams to declaratively create APIs and then manage them at scale, said Hasura CEO Tanmai Gopal. As application environments made up of multiple backend services and databases become the enterprise norm, there is a pressing need to simplify the management of what has become thousands of APIs in an enterprise IT environment using query compilers and routing capabilities built into the platform, he added.

In version 3.0 of the Hasura Data Delivery Network (DDN), the “supergraph” execution engine is based on a serverless runtime engine that, the company says, will replace its previous graph technologies to manage both GraphQL and REST APIs.

In addition, all connectors provided by Hasura have been rebuilt using an open specification and are now available as open source software on the Hasura Connector Hub. Hasura is also making available a software development kit (SDK) to enable IT teams to build custom connectors.

Written in the Rust programming language, the supergraph framework eliminates the need to create and manage GraphQL servers or services to deploy a graph. Additional data domains as a result can be added or replaced without breaking the graph used to manage other APIs.

The update to the Hasura DDN also adds new build system to provide instant API previews and support for rollbacks, a redesigned console featuring a graphical supergraph viewer, API analytics, observability, and auto-generated API documentation capabilities. Every iteration of the Hasura supergraph is instantly available as an immutable build that can be tested in preview. Every change to the supergraph is also validated before build, letting users identify potential bugs, stylistic issues, syntax, and type errors.

In addition, Hasusa has added a sub-millisecond cold start capability to enable rapid autoscaling and plane to shortly add caching to improve API performance in edge computing environments.

Longer term, the company plans to add additional a range of artificial intelligence (AI) capabilities to enable IT teams to identify issues requiring troubleshooting earlier and generate reports, Gopal added.

While REST APIs are still more commonly used than GraphQL, more IT teams are employing the latter. That’s because GraphQL provides more control over how data is accessed and consumed. Most organizations will soon be using a mix of REST and GrapgQL APIs, but it might be years before REST is supplanted as the dominant format simply because those APIs are more familiar to developers and easier to create.

Regardless of the type of API used, however, their numbers continue to steadily increase with each microservice added to an IT environment. It’s not always clear which teams within an IT organization are managing those APIs but increasingly best DevOps practices are being used to deploy, manage, secure and update them alongside every other type of software artifact. The challenge, of course, is making it simple to manage those API workflows in a way that doesn’t require yet another specialist to be added to the DevOps team.

April 2, 2024
Cycode Acquires Bearer to Extend ASPM Platform

Cycode today announced it had acquired Bearer, a provider of a set of tools for static application security testing (SAST), discovering application programming interfaces (APIs) and identifying sensitive data.

The provider of an application security posture management platform (ASPM) plans to integrate the Bearer tools into its core platform to enable DevSecOps teams to further consolidate tooling.

Cycode CEO Lior Levy said the acquisition of Bearer gives Cycode access to a set of tools that take advantage of generative artificial intelligence (AI) to surface suggestions that enable DevSecOps teams to more easily secure modern applications based on, for example, a microservices-based architecture.

Bearer achieves that goal by continuously scanning for application security issues as developers are writing code, he added. Overall, Bearer claims its approach to scanning is 31% faster than rival tools while simultaneously leveraging tools such as Bearer Assist, currently in beta, to provide more context concerning the level of risk to the business any issue discovered actually represents.

Those capabilities will be infused into the Risk Intelligence Graph (RIG) that Cycode developed for its ASPM platform.

Cycode earlier this year added generative AI capabilities to its platform to make it simpler for DevSecOps teams to identify the root cause of vulnerabilities in complex distributed computing environments. The company uses the generative AI platform created by OpenAI to provide a natural language interface for RIG. As part of that effort, Cycode is making available an executive dashboard that, based on all the dependencies uncovered, provides summaries of risks that make it easier to discern what is occurring across an application environment.

The company is at the forefront of developing ASPM platforms that continuously ingest data to identify and assess application security risks. Those platforms also provide a foundation for consolidating many of the tools that DevSecOps teams currently rely on to secure applications before they are deployed in production environments.

It’s not clear how quickly organizations are embracing DevSecOps best practices, but given the number of vulnerabilities that continue to be discovered, there is still much work to be done. The challenge is that legacy tools that lack AI capabilities were not designed to enable organizations to practically shift more responsibility left toward application development teams that typically don’t have a lot of cybersecurity expertise, noted Levy. AI makes it possible to now provide those teams with the context required to address application security issues as they write code versus just before applications are deployed, he added.

In theory at least, the applications deployed today should be significantly more secure than previous generations of applications. In effect, IT environments are steadily becoming more secure. Less apparent, however, is the rate at which modern applications are being deployed to replace legacy applications that are, all too often, rife with known vulnerabilities that cybercriminals can easily exploit. Given the rate at which vulnerabilities can be discovered and patched in those legacy applications, it may take the better part of the rest of this decade to address those issues once and for all.

March 5, 2024
ngrok Previews API Gateway Service to Streamline App Networking

Under an early access program, ngrok today made available an application programming interface (API) gateway that can be consumed as a service.

Rather than having to deploy, maintain, and secure API gateways themselves, application development teams, via a single command or function call, can now invoke a service through which they can route API traffic, authenticate and authorize access, and apply rate-limiting policies using an ngrok policy engine.

ngrok CEO Alan Shreve said this approach also makes it simpler for IT teams to unify ingress management at a time when application networking is becoming more challenging to manage. That approach also reduces friction because instead of being dependent on an IT operations team, it gives developers more direct control over APIs, he added. Today, most access to APIs is granted after developer first create a ticket request in an IT services management (ITSM) platform, noted Shreve.

In addition, the ngrok gateway also streamlines access to APIs spanning multiple clouds and on-premises IT environments in a way that enables organizations to implement a multi-cloud computing strategy, he added. Today, many organizations are locked into a single platform because they are dependent on the API gateway services provided by their cloud service provider, noted Shreve.

Finally, organizations will only need to pay for the API gateway service based on actual usage versus incurring the cost of acquiring a gateway upfront, said Shreve.

Previously, ngrok has been making available software development kits (SDKs) to provide programmable access to its API gateway. The as-a-service option being offered now is the next logical extension of that effort, noted Shreve.

In general, more infrastructure than ever is being consumed as a service, so making available an API gateway service is only the latest example of that larger trend, he added.

Each organization, based on total cost, will naturally need to decide when it makes the most economic sense to consume IT infrastructure as a service; however, as application networking continues to become more challenging to manage at a time when the number of IT professionals with that expertise remains limited. Relying on a service provides a viable alternative for managing what are often hundreds of APIs spanning a distributed computing environment.

It’s not clear yet precisely which teams within an IT organization are assuming responsibility for application networking, but as layer 4 through layer 7 of the networking stack become more programmable, more responsibility for networking can be assumed by DevOps and platform engineering teams. Existing networking teams, meanwhile, continue to manage the physical networking underlays used to route network traffic. Regardless of how application networking evolves, the rigidity that has characterized the delivery of network services is starting to fade away in a way that makes it possible to dynamically invoke networking services as needed.

IT teams must decide how best to approach application networking across legacy monolithic applications, microservices and event-driven applications. The goal, however, should be to eliminate as much friction as possible at a time when applications have become more dependent on networking services than ever.

February 15, 2024