Siemba automates IDOR tests and leaves chained attacks to humans

Why it matters

Authorization flaws persist because exhaustive cross-user testing is tedious. Siemba is making continuous coverage the baseline while preserving human time for chained attacks and privilege boundaries.

Siemba said its platform can now test production APIs automatically for insecure direct object reference, an authorization flaw that can let one user view or modify another user's data.

For Prashanth, Siemba's co-founder and chief security officer, the launch turns a plain observation into product strategy. Prashanth said: "Most API vulnerabilities aren't exotic." The failure can be as simple as an API accepting a changed account, order or document identifier without checking whether the requester owns it. Finding that mistake across hundreds of endpoints requires the repetitive work Prashanth wants software to absorb.

Public profiles identify Prashanth as Siemba's co-founder and chief security officer and Udayarajan as its founder and CEO. Siemba says it was founded in 2018 around a broader attempt to replace isolated security assessments with repeatable testing programs.

That thesis has stayed consistent as Siemba expanded. Siemba joined the Fuel AI/ML accelerator in 2023, when Udayarajan described the goal as building security testing programs that evolve with a customer's systems. Automated IDOR testing applies that idea to a vulnerability that is well understood, dangerous and laborious to check endpoint by endpoint.

Automating the exhaustive part

A customer supplies Siemba with an OpenAPI or Swagger definition, a Postman collection or a collection URL, plus identifiers representing objects the test accounts should and should not be able to access. Siemba says it manages the authenticated sessions and generates tests for every endpoint containing an ID-like parameter.

For REST APIs, those parameters can appear in a path, query, header or request body. Siemba also analyzes GraphQL schemas and parses WSDL files for SOAP services. The coverage extends beyond IDOR to tests for GraphQL query abuse, XML external entity injection, signature wrapping and other protocol-specific weaknesses.

The important technical choice is how Siemba judges a result. Siemba reads the returned content instead of treating an HTTP status code as the verdict. A 200 OK response can contain another user's data, an empty object or a generic error page, so the response itself determines whether the authorization check failed. Confirmed findings arrive with reproduction steps for developers.

That matches the testing model described by OWASP, which recommends using different accounts, manipulating object identifiers and checking whether one account can read, change or delete resources belonging to another. OWASP ranks broken object level authorization first in its API Security Top 10 and warns that successful exploitation can expose, alter or destroy data.

IDOR and broken object level authorization, or BOLA, are often used interchangeably. BOLA is the broader failure: an API does not verify that the caller has permission to act on a specific object. A predictable or exposed identifier is one route to that failure.

Siemba says it can test a collection containing 200 endpoints in under an hour, compared with days or weeks for manual endpoint-by-endpoint work. That figure is Siemba's own benchmark. The announcement does not specify the endpoint complexity, number of user identities, authentication flows or volume of test data behind the comparison, all of which can change the time required.

Production is the bet

Siemba is designed to run the checks against deployed APIs without access to source code. That puts the test against the authorization logic and data behavior customers actually expose, rather than a staging environment that may differ from production.

Running offensive tests in production also requires restraint. Siemba provides four throttle presets, ranging from a business-hours stealth setting to a faster mode for dedicated testing windows. Customers can set request rates, concurrency and timeouts, then schedule freeze windows of up to 30 days around releases or heavy trading periods.

The production focus is one part of Siemba's pitch, rather than a claim that automated BOLA testing is new. APIsec markets runtime exploit validation with replayable evidence, while StackHawk uses multiple authentication profiles to test cross-user access and privilege boundaries. Siemba is competing on how those automated checks fit beside its in-house penetration testers and the rest of its continuous testing platform.

The human boundary is part of the product

Siemba says automation maps confirmed findings to nine of the 10 categories in the OWASP API Security Top 10. Siemba assigns broken function level authorization, chained attack paths and nuanced privilege testing to certified pentesters working through the same platform.

That division matters because an endpoint-by-endpoint scanner can establish broad coverage without understanding every business rule. A human tester can follow a sequence across services, examine differences between administrative and ordinary accounts, and decide whether several individually minor behaviors form a viable attack path.

Siemba's commercial model reflects that split. Its autonomous pentesting subscription starts at $500 per month with 25 test runs. Expert engagements start at $3,000 per application, while custom programs combine automated testing and human work. Siemba also says its wider platform runs more than 30,000 automated test cases and integrates findings with Jira, ServiceNow, Slack and GitHub.

The IDOR launch gives Prashanth and Udayarajan a sharper version of the hybrid model they have been building since 2018. Software handles the authorization checks that should run after every meaningful API change. Pentesters spend their time on the places where context, sequencing and judgment still determine whether a system is secure.