Strengthening API and MCP Security Through Token Risk Detection with Thales Imperva API Security

Home>Blog>Strengthening API and MCP Security Through Token Risk Detection with Thales Imperva API Security

AmritTalapatra

,RohitKumar

Oct 29, 20263 min read

Security teams can now investigate six token risks directly at the endpoint level, making it easier to prioritize findings and take action across their API estate.

APIs depend on tokens to authenticate requests and control access. But weak signing algorithms, excessive token lifetimes, exposed credentials, and inadequate expiry enforcement can undermine that protection.

Identifying these weaknesses is only the first step. Security teams also need to know which endpoints are affected, understand the associated risks, and give application owners clear guidance on remediation.

Thales’s Imperva API Securitynow surfaces token risk detections directly in API Inventory. Previously available in the account-level Token Risk Report, these findings are now tied to individual endpoints, bringing investigation and remediation closer together.

Thales’s 2026 Token & Authentication Risk Reporthighlights the scale of the challenge. The report found that sensitive data exposure in JWTs increased from46.0% to 49.8%of token-risk detections year over year. It also found that the share of endpoints accepting expired tokens increased from5.0% to 8.5%.

Nearly40%of endpoints with token risks had two or more authentication risks, showing why teams need to understand how weaknesses can overlap.

Previously, security teams had to cross-reference the account-level report with API Inventory to locate affected endpoints. With the new enhancement, they can investigate these findings directly where they already manage API risks.

Token risks now appear as named values in the existing API Risks column, with three practical improvements.

The result is a more direct workflow: identify affected endpoints, investigate the issue, and coordinate remediation without translating account-level findings into a separate endpoint list.

Thales’s Imperva API Security now surfaces six token and authentication risks directly in API Inventory.

Together, these detections help teams investigate weaknesses in token integrity, lifetime, data confidentiality, credential handling, and expiry enforcement.

The enhancement turns token risk findings into a more actionable endpoint-level workflow.

By bringing these steps closer together, Imperva helps security teams move from identifying an authentication weakness to coordinating a response, while making it easier to investigate multiple risks affecting the same endpoint.

As AI agents increasingly interact with business applications, internal services, and third-party systems, APIs remain a critical part of the security foundation. The Model Context Protocol (MCP) provides a standardized way for AI applications to connect with tools and external data sources, making secure authentication and credential handling important considerations for agentic workflows.

This is where endpoint-level token risk detection becomes particularly relevant.

Thales’s Imperva API Security’s six token risk detections align with authentication and credential-handling concerns relevant to MCP01:

By surfacing these risks at the endpoint level, Imperva helps security teams investigate authentication weaknesses in APIs that support agentic workflows, where those endpoints are discovered and monitored by the platform.

This is a focused contribution to MCP security, not a claim of comprehensive MCP protection. Token risk detection alone does not discover every MCP server, prevent prompt injection, enforce least-privilege permissions, or determine whether an agent’s actions are legitimate. It provides actionable insight into an important part of the security foundation on which these systems depend.

As organizations adopt MCP and more autonomous workflows, understanding and remediating authentication weaknesses across their API estate becomes increasingly important.

Security teams need more than a list of potential problems. They need to connect findings with the affected endpoints, the teams responsible, and the steps required to address them.

With six token risks now surfaced directly in Thales’s Imperva API Security’s API Inventory, teams can filter findings, investigate endpoint-specific details, and access remediation guidance in one place.

The goal is simple: make token risks easier to find, easier to understand, and easier to act on – one endpoint at a time.

Learn more:ReadImperva’s 2026 Token & Authentication Risk Reportto explore the authentication risks affecting APIs today.

Protect your business for 30 days on Imperva.

Protect your business for 30 days on Imperva.

MichaelWright

,NatalieTzukrel

Oct 5, 20264 min read

MichaelWright

,RoyAmir

Oct 5, 20264 min read

MichaelWright

Sep 23, 20267 min read

MichaelWright

,ZivRika

Aug 24, 20264 min read

MichaelWright

Aug 15, 20264 min read

RohitKumar

,AmritTalapatra

Aug 13, 20261 min read

Cookie PreferencesTrust CenterModern Slavery StatementPrivacyLegal

Cookie PreferencesTrust CenterModern Slavery StatementPrivacyLegal

Copyright © 2026 Imperva. All rights reserved