Phantom APIs Are Eating Your Attack Surface, and Most Security Teams Are Still Looking the Other Way

I’ve spent the better part of fifteen years staring at API traffic logs for a living, and I can tell you the job has changed twice. The first shift came with microservices, when a handful of monolithic endpoints became thousands of small, chatty interfaces, and nobody could agree on who owned the inventory. The second shift is happening right now, and it’s worse because this time the endpoints aren’t even being written by people who can explain why they exist.