Atlanta – September 20, 2026 -- Siemba has launched automated testing for insecure direct object reference (IDOR) flaws, cutting the time to scan a 200-endpoint API collection to under an hour, a task the company says has typically taken human testers days or weeks.
IDOR ranks first among OWASP's API Security Top 10 risks
IDOR, classified by OWASP as broken object level authorization, occurs when an endpoint fails to verify that a caller-supplied identifier belongs to them, allowing a single changed number in a request to expose another user's data. Siemba's Chief Security Officer Sandhya Prashanth said the flaw "drives a huge share of real-world breaches" and requires little more than systematic testing across every endpoint to detect.
Testing runs against live API deployments with no source code needed
The tool ingests a customer's existing API definition -- an OpenAPI or Swagger file, a Postman collection, or a collection URL -- and generates test cases across every endpoint carrying an ID-like parameter, using customer-supplied identifiers and platform-managed authenticated sessions.
Each finding is confirmed by reading the actual API response
Siemba scores results by inspecting response content rather than matching status codes, so a 200 response returning an empty result or generic error page is not counted as a pass. Confirmed findings are delivered with reproduction steps rather than queued for a separate reporting phase.
Protocol-specific coverage spans REST, GraphQL and SOAP
REST endpoints are tested across path, query, header and body parameters. GraphQL schemas undergo introspection analysis covering schema exposure, query depth, batching abuse, alias overloading and field-level authorization. SOAP operations parsed from WSDL are tested for XML external entity injection, signature wrapping, SOAPAction manipulation and WS-Security misconfiguration.
Automation maps to nine of ten OWASP API risk categories
The remaining category, broken function level authorization, along with chained attack paths and privilege-boundary testing, is handled by Siemba's certified penetration testers working from the same platform, allowing expert engagements to start from an established baseline.
Production-safe controls include throttle presets and 30-day freeze windows
Customers set testing pace via four throttle presets, ranging from a stealth mode for business hours to a turbo mode for dedicated testing windows, with independent control over requests per second, concurrent test cases, and request timeout. Freeze windows of up to 30 days allow automatic pausing around production freezes, peak trading periods, or critical releases.
IDOR testing joins Siemba's existing platform product line
Siemba API Security Testing, including automated IDOR testing, is available now alongside the company's External Attack Surface Management, Autonomous DAST, and Vulnerability Assessment products.