Insufficient Logging & Monitoring is a security weakness in which an organization fails to adequately record security-relevant events and to actively watch those records for signs of malicious activity – leaving attacks undetected, sometimes for long periods. It appeared in both the OWASP Top 10 and the OWASP API Security Top 10 (as API10:2019). Unlike vulnerabilities that let an attacker in, this weakness concerns the inability to notice that something is wrong, which allows attackers to operate, persist, escalate, and move laterally without being caught.
Logging is the practice of recording events – logins, access attempts, errors, transactions, configuration changes, and other significant actions – into records that can later be reviewed. Monitoring is the active examination of those logs (and real-time telemetry) to detect anomalies, suspicious patterns, and indicators of attack, ideally triggering alerts and response. When logging is missing, incomplete, or not monitored, an organization is effectively blind: attacks such as credential stuffing, enumeration, injection attempts, and data exfiltration can proceed without raising any alarm.
The consequences are significant. Studies of breaches consistently show that attackers frequently dwell in compromised environments for extended periods before detection – often discovered only by external parties rather than the victim’s own monitoring. This extended dwell time gives attackers ample opportunity to accomplish their goals and deepen the compromise. Insufficient logging also hampers incident response and forensics: without adequate records, investigators cannot reconstruct what happened, determine the scope of a breach, or gather evidence.
For APIs, this risk is acute. API traffic can be voluminous and automated, and attacks like BOLA, business logic abuse, and credential stuffing hide within valid-looking requests. Without logging that captures relevant details (who accessed what, when, and how) and monitoring that can detect abnormal patterns – such as a single user accessing many different object IDs, or a spike in failed logins – these attacks go unnoticed.
Addressing insufficient logging and monitoring means logging security-relevant events comprehensively and consistently, protecting logs from tampering, retaining them appropriately, and – critically – actively monitoring them with alerting and integration into incident response. For APIs, effective monitoring often requires understanding normal behavior and detecting deviations, so that individually valid requests that collectively indicate abuse can be caught. Good logging and monitoring do not prevent the initial intrusion, but they are essential for detecting attacks quickly, limiting damage, and enabling effective response – turning a silent, prolonged compromise into a detected, contained incident.