API Security · Product Launch · June 2026
Stopping the API Attack You Cannot See: Introducing UQASF
A new approach to API security, built to catch what hides in plain sight, and to explain every alert in plain words.
Physivitis Management · London · June 2026
Every modern application runs on APIs. They are the doors through which software requests and exchanges data, quietly and constantly, thousands of times a second. They power your bank, your hospital, your favourite app and the systems your business depends on. And in 2026 they have become the single most exploited weakness in enterprise technology.
The reason is unsettling. The most damaging API attacks are not loud break-ins. The attacker does not smash a lock or guess a password. They log in normally, with a perfectly valid account, and then quietly reach for data that belongs to other people. Every single request looks completely legitimate. Nothing is malformed. Nothing trips an obvious alarm. By the time anyone notices, the data is long gone.
The number one risk, hiding in plain sight
This pattern has a name. It is called Broken Object Level Authorisation, and it has sat at the very top of the industry's official list of API risks, the OWASP API Security Top 10, for years. It stays there because it is so hard to detect. The attack lives not in any single request, which looks normal, but in the pattern of behaviour across a whole session: one user reaching, again and again, for things that were never theirs to see.
Most security tools were not built to read that pattern. They inspect requests one at a time, or they rely on raw traffic volume, and a careful attacker slips straight past both. Worse, the tools that do try often take weeks to set up, demanding large amounts of data and a long learning period before they protect anything. And when they finally raise an alert, they frequently cannot explain it. They hand you a score from a model nobody can interrogate, which is of little comfort when an auditor, a regulator or your own board asks you to justify what happened.
The attack looks normal. The tools are slow to deploy and cannot explain themselves. We thought that deserved a sharper answer.
A different approach
At Physivitis, we build by turning rigorous physics and mathematics into practical solutions. We applied that same discipline to API security, and the result is UQASF, our Unified API Security framework, delivered as a product we call Sotevis.
We will not describe the inner workings here, and deliberately so. What matters to you is what it does. Sotevis watches the pattern of activity across a whole session rather than judging each request in isolation. It produces one clear number, an Integrity Score, that stays high when everything is healthy and drops the moment someone begins reaching for data they should not have. And when it drops, it does not leave you guessing. It tells you, in plain language, exactly which session, which endpoint, and why.
Three things that make it different
It explains itself.
Every alert names its cause and the exact door involved. Nothing is a black box. When you have to defend a security decision to a regulator or an auditor, you have a real, readable answer, not a model's say-so. For teams working under DORA, NIS2 and the SEC cyber rules, that is not a luxury; it is the job.
It is running in about a minute.
There is no long training period and no labelled attack data to gather. Sotevis learns what normal looks like from roughly sixty seconds of ordinary traffic, and then it watches. You are protected the day you switch it on, not the quarter after, and it runs alongside whatever you already use, with nothing to rip out and replace.
It gives you one clear score, not a thousand alerts.
Your team's attention is your most valuable resource, and most tools spend it on false alarms. Sotevis replaces the noise with a single signal and a plain reason when it matters. Less triage, more clarity.
Who it is for
Sotevis is not only for teams with no protection. It is built especially for those who already take API security seriously and are tired of slow rollouts and unexplained alerts; for regulated industries in finance, healthcare and critical infrastructure that must be able to defend every decision; and for stretched security teams who want clarity instead of volume. If you have already invested and still cannot get a fast, clear, defensible answer, this is the upgrade.
Where it stands today
UQASF is the subject of a filed UK patent application. The framework has been validated in controlled testing across the most common categories of API attack, where it caught patterns that conventional volume-based monitoring missed entirely. We are honest about what that means: this is a new approach, and our next step is proving it on real production traffic alongside early partners. We would rather tell you that plainly than overstate it.
The number one API risk has not changed in years. What we believe should change is how quickly you can stand up a defence against it, and whether you can explain what you find. That is the problem UQASF was built to solve.
Sotevis is a product of Physivitis Ltd. This article is for information only. Proprietary technical detail is withheld. © 2026 Physivitis Ltd.