A security team can lock down every endpoint on its gateway's route table and still get breached through an endpoint that isn't on that table at all. A backend engineer stands up a debug endpoint during an incident, forgets to remove it, and it sits reachable for two years. A marketing team's contractor wires a quick integration directly to the database-backed service, bypassing the gateway entirely because going through it was slower. A deprecated v1 endpoint keeps running because nobody was ever assigned to turn it off, and it still accepts the same weak authentication the rest of the platform retired three versions ago. None of these show up in the API catalog, none of them get the WAF rules the documented endpoints get, and none of them get patched when a shared library gets a security fix, because patching assumes someone knows the endpoint exists.
This lesson is about the gap between the API surface a team believes it operates and the API surface that is actually reachable from the internet or from inside the network. Every control covered earlier in this course — authentication, rate limiting, input validation, gateway policy — only protects the endpoints it knows to protect. An inventory gap is not a missing control; it is a missing target for every control to apply to, and it is consistently how attackers find the easiest way in, because an endpoint nobody is watching is an endpoint nobody is defending.
Analogy🏏Cricket
🏏 Think of it like cricket: A franchise's team management can drill its playing eleven relentlessly on fielding positions, bowling changes and fitness protocols, and still concede a match through a gate the ground staff forgot was ever built. A stadium redeveloped over a decade accumulates entrances added for one-off VIP events, a media gate cut into a wall during a broadcast upgrade and never sealed afterward, and a maintenance door that used to lead to a now-demolished practice net but still opens onto the outfield. Security briefings cover the main turnstiles in detail — bag checks, ticket scanners, the works — because those are the entrances everyone remembers exist. The forgotten maintenance door gets none of that, not because anyone decided it didn't need it, but because it dropped off the list of things anyone was tracking. Just as a stadium's actual security exposure is defined by every door that physically opens, not by the doors listed on the official access plan, an organization's actual API attack surface is defined by every endpoint that actually responds, not by the ones listed in the API catalog. Just as a ground staff walk-through that physically checks every door finds the forgotten one that a plan review never would, an inventory built from live traffic and real network scans finds the endpoint a documentation review never would. The insight is that a security posture is only as complete as the map it is drawn from, and a map drawn from what people remember building is reliably smaller than what was actually built.
🏏 Showing the Cricket analogy — a Cricket version isn’t available for this concept yet.