Moving Target Defense (MTD) and Zero-Trust Architectures for Securing Cloud-Native Open Banking APIs Against Automated Vulnerability Exploitation

• Billy Elly

  Lautech

  Author

The proliferation of open banking ecosystems and cloud-native API architecture has fundamentally expanded the cyber attack surface of financial institutions, with Datos Insights reporting that 57% of financial services firms experienced API-related breaches within the last two years . Traditional perimeter-based security models, including static Web Application Firewalls (WAFs) and VPN-based network segmentation, are increasingly inadequate against automated, AI-driven vulnerability exploitation that targets identity systems, API business logic flaws, and misconfigured cloud-native components . This research addresses the critical gap in frameworks that integrate Moving Target Defense (MTD) with Zero-Trust Architecture (ZTA) specifically for cloud-native banking API environments. The study proposes a hybrid security framework combining Software Defined Perimeter (SDP) authentication and authorization with dynamic Network Address Shuffling (NAS) as an MTD technique, validated through a lab-scale testbed simulating open banking API attack scenarios. Experimental results demonstrate that the integrated MTD-ZTA framework achieves 89.4% effectiveness in preventing automated reconnaissance and exploitation attempts, significantly outperforming traditional VPN-based approaches which showed only 62.3% efficacy under identical attack conditions. The framework reduces mean time to mitigation from 4.2 hours to under 15 minutes and increases attacker cost of enumeration by an order of magnitude. These findings provide a replicable blueprint for financial institutions transitioning to zero-trust, API-first architectures while maintaining regulatory compliance and operational resilience.

• PDF

Copyright (c) 2026 Billy Elly (Author)

This work is licensed under a Creative Commons Attribution 4.0 International License.