Kong’s engineering blog has published API security best practices for 2026, a guide that runs from inventory through TLS, authentication, authorization, input validation, rate limiting and monitoring. It opens with the numbers: 32% of organizations had an API security incident in the past year and 66% saw their API count grow by more than 50%, both from Salt’s survey, plus a 2026 global average breach cost of $4.99 million, up 12%. The line that frames everything after it is about consistency, not controls: “If 40 teams each build authentication policies their own way, you end up with 40 versions of authentication.”
The statistics are third-party survey figures cited by a gateway vendor, and the gateway is the conclusion the post reaches. Discount the framing accordingly. What survives without it is good, specific advice. Start with an inventory, because shadow and zombie APIs are where attackers look first. Use mTLS for service-to-service calls. Cap JWT lifetimes, pin signing algorithms, and check issuer and audience. Put an ownership check on every endpoint that takes an object ID, because Broken Object Level Authorization tops the OWASP API Security Top 10. And alert when one consumer collects 403s across 20 or more object IDs in 10 minutes, which is a BOLA probe in progress.
The catalog shows how much of that advice Kong exposes as API surface. Kong on apis.io carries 139 API pages, which makes Kong’s own estate a fair test of its first practice. The controls in the post map to pages: the Kong Plugins API that attaches the JWT, Request Validator and Rate Limiting plugins it names; the Kong JW Ts API, Kong API-keys API and Kong ACLs API for authentication and authorization; the Kong MTLS-auth credentials API and Kong Certificates API for the mTLS practice; and the Kong Consumers API, which is the key a per-consumer rate limit hangs on. The Kong Gateway page ties them together.
Kong scores 71.8 on the Kin Score, exemplar, led by access clarity at 84.2 and contract quality at 67.6. Contract governance is 45.5, Kong’s second-weakest facet and well above most of the catalog, but it is the facet that measures exactly the drift the post warns about. Agent Readiness is 46.9, with auth clarity, delegated identity, protected resource metadata and error semantics lit. The unlit list is the interesting part: MCP server, well-known catalog and idempotency. The post closes by saying the same approach covers AI and MCP, and Kong sells a Kong MCP Registry. An agent arriving at Kong’s own estate still finds no MCP server and no machine-readable catalog of those 139 APIs.