01 · The challenge
APIs change too fast for scanners
Headless endpoints, distributed teams and a constant rate of change left traditional pentesting and automated checks behind.
Case Study How Sabre Builds Human-Led API Security Testing into Its Development Cycle
As Sabre’s APIs evolved, its application security team needed to find exploitable vulnerabilities that automated checks could miss. The Synack Red Team delivered 366 hours of API testing, including headless endpoints. Its reports helped developers fix and retest vulnerabilities and bring risk-based testing earlier into development.
366 hours Of expert API testing
Headless APIs Tested by the Synack Red Team
Evidence-based reports Reports with evidence developers could act on
New connections, new vulnerabilities
APIs are the virtual keys to a company’s information vaults, and a growing target for malicious actors.
02 · The approach
Human-led API testing
The Synack Red Team provided an adversarial perspective across Sabre’s APIs, simulating real-world API abuses.
03 · The outcome
Security earlier in development
Clear reports helped developers remediate, retest and pass, building risk-based testing into the development cycle.
Why APIs need a dynamic testing strategy
Sabre helps B2B travel industry customers operate more efficiently, drive revenue and offer personalized traveler experiences. Like many organizations, it was building more APIs to connect microservices and share data efficiently and accurately.
The fast proliferation of headless APIs, increasingly distributed development teams and the dynamic rate of change of APIs create an environment where traditional pentesting is simply not up to the task. The 2023 case study cited Gartner’s finding that 90% of web applications had a larger attack surface exposed via APIs than through the user interface. Each new API can introduce vulnerabilities that slip past scanners.
Cris Rodriguez, Manager of Application Security, credits Sabre CIO Joe DiFonzo for driving the conversation around API security, and relied on Synack’s API Security Testing for continuous coverage across API endpoints.
The nature of APIs, the fact that they are dynamic and constantly evolving with new features and functionality, means that automated security checks often fail. We wanted human-based offensive security testing to identify vulnerabilities that automated solutions often miss.
Baked-in security
Sabre’s AppSec team works to inject security from the start, from its “Zero to Hero” training sessions to engaging Synack to stay ahead of API threats.
Synack Red Team on APIs
Researchers identified exploitable vulnerabilities, such as selected vulnerabilities from the OWASP API Top 10, and simulated up-to-the-minute API abuses.
Continuous coverage
Synack checked for security misconfigurations, access control issues and more across APIs, including headless APIs.
Proof-of-work reporting
Well-defined, easy-to-read reports showed proof of work and assured that each endpoint was tested by an expert.
Shifting left
Early API testing fed Sabre’s CI/CD pipelines, catching issues before user acceptance or production.
“There is no substitute for a human adversary. Having the SRT examine your APIs delivers unparalleled benefits.”
Why API security is a priority
At Sabre, API security is a business conversation that starts at the top.
APIs give our customers flexibility to ingest and manipulate data to fit their needs.
Recent breaches at even high-security investing companies such as Twitter, Dropbox, Uber, T-Mobile, Facebook and Peloton have demonstrated the need for a robust, proactive API security posture.
Synack’s human-led testing delivers clear, top-notch reports. They identify API vulnerabilities that enable our dev teams to efficiently remediate, retest and pass the security test. That enables us to build risk-based security testing into the application development cycle.
Cris Rodriguez
Manager of Application Security, Sabre
What Sabre achieved
Reports developers could act on
Clear reports helped development teams efficiently remediate, retest and pass the security test.
API security earlier in development
Testing moved into CI/CD pipelines, catching issues before user acceptance or production.
A risk-based security culture
Risk-based security testing became part of the application development cycle.
366 hours of expert API testing
The Synack Red Team tested Sabre’s API attack surface for 366 hours, including headless APIs.
Questions about the Sabre case study
Who is Sabre?
Sabre is a travel technology company that helps B2B travel industry customers operate more efficiently, drive revenue and offer personalized traveler experiences.
Which Synack solution did Sabre use?
Synack API Security Testing, with the Synack Red Team providing continuous, human-led testing across Sabre’s API endpoints.
Why did Sabre choose human-led API testing?
APIs are dynamic and constantly evolving, so automated checks often fail. Sabre wanted human-led testing to find vulnerabilities automated solutions miss.
What did Synack test in Sabre’s APIs?
Security misconfigurations, access controls and other exploitable vulnerabilities, including selected vulnerabilities from the OWASP API Top 10, across web applications and headless APIs.
How did Synack help Sabre shift left?
Clear reports and early testing helped Sabre drive API security into CI/CD pipelines, catching issues before user acceptance or production.
Get the Sabre case study
Read the full two-page story of how Sabre brought expert API testing, including headless APIs, earlier into development.
Case Study · IT services and training How FDM Group Turned Pentest Findings Into Fixes Read the FDM Group story → 
Case Study · Oil and gas How NOV Found Exploitable Vulnerabilities It Could Act On Read the NOV story → 
Case Study · Financial services How Varo Bank Used Continuous Pentesting to Demonstrate Security Readiness Read the Varo Bank story →