SHARED INTEL Q&A: Inside the mind of a hacker — shadowing adversaries across API pathways – Source: www.lastwatchdog.com

By Byron V. Acohido

In today’s digital economy, business starts with the application. Increasingly, the critical activity lives in the APIs that support it.

Related: The hidden cost of API security laspses

For Jamison Utter, Field CISO at A10 Networks, this moment marks a profound shift. Traditional defenses — WAFs, DDoS scrubbing, bot management — have long operated in silos. Each tool generates its own logs; each vendor manages its own functionality. That patchwork held together for decades. But attackers have adapted. They’ve learned to probe the seams between these disparate controls, looking for gaps in business logic where normal activity can be bent toward malicious ends.

Recent data underscores the shift. According to the OWASP Foundation, attackers are increasingly abusing business logic itself, hijacking legitimate workflows. A report by application security provider Indusface found 271 million API attacks in Q3 2024 alone, including a 3,000% increase in distributed denial-of-service attacks targeting APIs versus traditional web assets.

This trend reflects a deeper strategic shift — one that Jamison Utter describes as getting into the “mind of a hacker.” It’s not just about volume or velocity; it’s about stealth and intent. Attackers aren’t always trying to break through walls. Instead, they study the routines of digital business — how supply chains sync, how mobile apps handle data, how updates propagate between systems — and mimic them, subtly warping logic flows for competitive gain, disruption, or data exfiltration.

To counter this, A10 is advancing a strategy of converged security: unifying web, API, and application delivery within a unified intelligence layer. By analyzing context in real time — what a given entity is doing, how its behavior shifts, and how it maps to broader traffic patterns — defenders gain a chance to catch malicious activity in reconnaissance mode, before an incident escalates.

This shift, Utter argues, is essential as enterprises grapple with API sprawl, encrypted traffic, and hybrid infrastructure. The question is no longer simply “is this request good or bad?” but tree“how does this behavior fit into the bigger picture?” That, he says, is what it means to defend with the mind of a hacker.

LW: You’ve described APIs as “the front door” of business today. Why are they such an attractive target for attackers?

Utter

Utter: APIs carry the business logic — everything from supplier coordination to shipping logistics. That makes them high-value and high-risk. Attackers know that if they can manipulate an API workflow, they can disrupt operations without ever breaching the perimeter.

LW: You also talk about competitive disruption at the API level. What do you mean by that?

Utter: It’s already happening. Imagine disrupting a competitor’s supply chain so their trucks don’t arrive on time. That’s not espionage in the classic sense — it’s using APIs as weapons to create real-world impacts on availability and revenue.

LW: What is converged security, and how does it address this?

Utter: Instead of isolated products, convergence unifies them around a shared data store. That way, context follows the same entity across APIs, web apps, and mobile. It closes the gaps attackers exploit between tools by allowing defenders to track behavior holistically — not in fragments.

LW: You’ve said defenders need to adopt the “mind of a hacker.” How does that differ from traditional defense?

Utter: Traditional defenders tend to see the world in black and white: a request is good or bad. But attackers operate in the gray, where most traffic looks perfectly normal — and activities like reconnaissance or probing are indistinguishable from routine user behavior. The shift is to track how risk accumulates over time. When a previously “perfect” transaction starts doing something different, that change in context is the tell.

To see that, context must follow the same entity across surfaces — web, API, mobile — instead of being trapped in siloed tools. Convergence enables signals to unify, letting risk “stick” to the actor as behavior evolves. That’s what “hacker mind” really means: treat the gray zone as the norm and reason about intent over time — not just one request at a time.

LW: How does machine learning fit into this approach?

Utter: It’s about clustering and correlating patterns in real time. These interactions are structured and repetitive enough that machine learning can group behaviors, compare them, and flag when something routine starts to drift.

The key is a unified data store — a “one mind” in the center — so the model sees the same entity across WAF, DDoS, bot mitigation, and API protection, instead of four partial stories. Not every anomaly is malicious. But ML helps separate benign oddities from the gray-area signals attackers rely on, replacing the old good/bad binary with a more nuanced notion of risk. It’s not perfect — but in this narrow, well-defined domain, it’s far better than static allow/deny logic, because it flags the moment normal behavior becomes suspicious.

LW: Looking forward, what does this mean for enterprise defenders?

Utter: Treat the application experience — browser and increasingly mobile — as the true front door. That’s where APIs live, and where business logic actually executes.

The practical move is to replace siloed controls with a converged platform, so telemetry and risk follow users wherever they interact. That lets teams catch activity during reconnaissance, before disruptions to supply chains or other processes become visible impact.

The priority shifts from protecting pages to understanding intent: Are entities operating like everyone else — or are they deviating, probing, and manipulating workflows? Winners will combine adversarial thinking with shared context so decisions can be made before a “normal” sequence of calls turns into business-logic abuse.

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

September 4th, 2025 | Q & A | Top Stories