Siemba Adds Automated IDOR Testing to API Security Testing

September 2026 · Siemba News

On September 20, 2026, Siemba announced automated IDOR testing within its API Security Testing capability. The feature targets one of the vulnerability classes most likely to expose customer data. It runs continuously against APIs as they are deployed, and it doesn't need access to source code.

Siemba now automatically tests APIs for insecure direct object reference (IDOR), also called broken object level authorization (BOLA).

The capability is part of Siemba API Security Testing. It checks every endpoint with an ID-like parameter across REST, GraphQL and SOAP APIs, and confirms each finding by reading the actual API response.

Every confirmed result includes reproduction steps. A 200-endpoint collection can be tested in under an hour. The capability is available today on the Siemba platform.

What is an IDOR vulnerability?

An IDOR vulnerability is an authorization flaw. The API doesn't verify that the object a user requests actually belongs to that user. In a vulnerable API, changing one identifier in a request, such as an account or order number, can be enough to read or change another person's data. OWASP calls this broken object level authorization (BOLA) and ranks it first in the OWASP API Security Top 10.

Why is IDOR so often missed?

IDOR is simple to understand but tedious to test thoroughly. Finding it doesn't take a clever exploit. It takes checking every endpoint and every parameter, one by one. Manual testers working under time pressure usually sample endpoints instead of covering all of them, so flaws slip through. That is also why IDOR keeps showing up in API breach disclosures.

"Most API vulnerabilities aren't exotic," said Sandhya Prashanth, Co-founder and Chief Security Officer at Siemba. "That is exactly the kind of work automation should be doing continuously, so security teams can spend their attention on what automation cannot reason about: chained flows and privilege boundaries."

How does Siemba's automated IDOR testing work?

Siemba builds its tests from the API definition your team already maintains:

1. You provide the API definition as an OpenAPI/Swagger file, a Postman collection, or a collection URL.
2. You supply a set of identifiers. The platform handles authenticated sessions.
3. Siemba writes and runs the test cases against every endpoint that has an ID-like parameter.
4. Each result is checked against the actual response content, not just a status code or a signature. For example, a 200 response that returns an empty result or a generic error page is not counted as a pass.
5. Confirmed findings come with reproduction steps, so developers can start fixing right away without waiting for a separate report.

Which API types are supported?

Siemba tests REST, GraphQL and SOAP APIs, and each protocol is tested according to its own specification:

• REST: Each endpoint is tested individually across path, query, header and body parameters.
• GraphQL: Siemba resolves the schema through introspection analysis. It then tests for schema exposure, query depth and batching abuse, alias overloading, and field-level authorization.
• SOAP: Siemba parses operations from the WSDL. It then tests for XML external entity (XXE) injection, signature wrapping, SOAPAction manipulation, and WS-Security misconfiguration.

How much of the OWASP API Security Top 10 is covered?

Automated findings map to nine of the ten OWASP API Security Top 10 categories. The tenth category, broken function level authorization, is covered by Siemba's certified penetration testers. The same is true for chained attack paths and nuanced privilege-boundary testing. The testers work on the same platform, so a human-led engagement begins from an automated baseline instead of starting reconnaissance from scratch.

Is it safe to run IDOR testing against production?

Yes. Siemba includes controls designed for production testing:

• Four throttle presets, ranging from a stealth mode suited to business hours up to a turbo mode for dedicated testing windows.
• Independent controls for requests per second, concurrent test cases, and request timeout.
• Freeze windows of up to 30 days, which pause testing automatically during production freezes, peak trading periods, or critical releases. No manual ticket is needed.

Testing in production means authorization is checked against real data and real logic. Staging environments often drift from production, so they can miss what production would reveal.

How is this different from a traditional pentest?

The difference comes down to coverage and continuity. A point-in-time pentest only validates the API as it was on the day of testing, and endpoints shipped afterward stay untested until the next engagement. Siemba tests every endpoint continuously. A 200-endpoint collection takes under an hour, compared with the days or weeks a manual tester would typically need, plus the time to write the report.

Availability

Siemba API Security Testing, including automated IDOR testing, is available now. It sits alongside Siemba's External Attack Surface Management, Autonomous DAST, and Vulnerability Assessment products.

About Siemba

Siemba is a continuous offensive security provider headquartered in Alpharetta, Georgia. It combines attack surface mapping, autonomous dynamic testing, AI-driven vulnerability assessment, and expert-led penetration testing in one continuous program. Its coverage includes web, mobile, cloud, and AI systems, including large language models and AI agents. Siemba has been named a Sample Vendor in the Gartner® Hype Cycle™ for Application Security, Security Operations, and XaaS in 2024, 2025 and 2026.

Read the original announcement on PR Newswire.

Frequently asked questions

What is the difference between IDOR and BOLA?
They describe the same flaw. IDOR (insecure direct object reference) is the traditional name. BOLA (broken object level authorization) is the term OWASP uses in its API Security Top 10, where it ranks first.

Does Siemba need my source code to test for IDOR?
No. Siemba tests the deployed API using your OpenAPI/Swagger file, Postman collection, or collection URL.

How long does automated IDOR testing take?
A 200-endpoint API collection can be tested in under an hour.

How does Siemba avoid false positives?
It judges each result by reading the actual API response instead of relying on status codes or signatures. Empty results and generic error pages are not scored as passes.

Can I pause testing during a release?
Yes. Freeze windows of up to 30 days pause testing automatically.