The default API programme in too many regulated platforms still looks like a factory floor. A hyperscaler-native or heavily proprietary gateway sits at the edge. Specialists spend their weeks composing XML proxy bundles, shared flows and proprietary transformation scripts. Security is declared “done” once a token is checked and a coarse product entitlement is applied. Behind that gate, service-to-service calls, agent tools and field-level data paths run with far weaker controls. The result is lock-in without resilience: you cannot move the control plane cleanly across clouds, you cannot staff the platform without a rare XML-and-certification caste and you cannot claim zero trust when authorisation stops at the front door.
That pattern is no longer merely untidy. Akamai’s 2026 API Security Impact Study reported that 87 per cent of organisations suffered an API security incident in the past year, up from 76 per cent in 2022, with top-quartile annual costs above US$1.8 million. Salt Security’s 1H 2026 research found that 32 per cent of organisations experienced an API security incident, 47 per cent delayed deployments because of API security concerns and nearly all attack attempts analysed originated from authenticated sources. Misconfiguration and broken authorisation dominate the OWASP API Security Top 10 attack surface. Perimeter theatre does not survive that evidence. Progressive enforcement does.
The cost of keeping the XML factory open
Apigee and MuleSoft are the clearest anti-patterns for operators who say they want multi-cloud freedom. Apigee’s policy model centres on proprietary XML proxy bundles, shared flows and Java or sandboxed JavaScript callouts that do not travel to another gateway. Apigee X keeps the control plane on Google Cloud even when a hybrid data plane is deployed elsewhere; Apigee Edge for Private Cloud’s end-of-life push toward Apigee X deepens that coupling for shops that once believed they had an exit. MuleSoft compounds the problem with DataWeave and a certified-developer labour market: transformations and connector logic become assets that only run inside one runtime. Neither platform is “bad software”. Both encode an operating model of specialised headcount, verbose configuration and migration costs that rise every quarter you keep investing.
The commercial cost of doing nothing is not a licence line alone. It is the opportunity cost of platform engineers who cannot move with the organisation’s cloud strategy, the audit finding that east-west traffic was never brought under the same policy graph as north-south and the product delay when every new API waits for a scarce Apigee or MuleSoft specialist rather than a declarative pipeline an agent can propose and a human can approve. Hyperscaler-native gateways add a second trap: they look cheap against committed cloud spend until a second region, a second cloud or a divestiture forces a rewrite. You did not buy portability. You rented convenience that evaporates under regulatory or commercial pressure.
Portable gateways and an agent-shaped security model
The escape hatch is already on the same marketplaces procurement teams already use. Kong Konnect is listed on AWS, Microsoft Azure and Google Cloud marketplaces, with Dedicated Cloud Gateways provisionable across those providers. Tyk is available on AWS Marketplace for cloud, hybrid and self-managed footprints, with Azure Marketplace images and documented self-managed paths on Google Cloud. Both run as open, standards-leaning platforms rather than XML factories. Configuration tends toward declarative APIs, plugins, OpenAPI-aligned design and policy that can live in Git. That is the substrate AI agents need: artefacts they can generate, diff, test and roll back without a cottage industry of hand-edited proxy XML.
This is not a brochure for either vendor. It is an argument about labour and leverage. The engineering paradigm has changed. You do not want thousands of low-skilled workers maintaining Apigee XML. You want a thin platform team that defines policy intent, plus AI agents that draft routes, plugins, mesh policies and regression tests against that intent. Humans review risk, approve high-impact changes and own the audit trail. Agents do the repetitive build, configure and test loop. Kong and Tyk fit that model because their surfaces are programmable and portable. Apigee and MuleSoft fit the opposite model: specialised syntax, proprietary runtimes and people scaled as the primary automation layer.
Security must be holistic or it is theatre. Kong Mesh, built on the CNCF Sandbox project Kuma, extends the same philosophy east-west: Envoy-based mesh across Kubernetes and VMs, multi-zone control and embedded Open Policy Agent support so Rego policies travel with the data plane rather than as yet another sidecar farm. On the gateway side, Ping Identity’s PingAuthorize integrates with Kong Gateway through the ping-auth plugin for attribute-based decisions and sideband enforcement. Open Policy Agent remains the open standard for many coarse and fine checks. The point is not which brand wins a bake-off. The point is progressive enforcement on portable machinery: authentication at the edge, coarse authorisation on products and roles, fine authorisation on objects and actions, then field-level policy and audit for sensitive attributes, applied again inside the mesh for service-to-service calls. Maximum utility for legitimate traffic. Zero trust for everything else.
Why the operating model must change now
Three pressures land at once. First, API estates are exploding under automation and agentic clients. Salt’s 1H 2026 survey reported that two-thirds of organisations saw API growth of more than 50 per cent in a year, while only a small minority claim advanced API security maturity. Second, attackers increasingly arrive with valid credentials. Authenticated abuse, broken object-level authorisation and misconfiguration are the working methods; a gateway that only checks whether a token exists is answering yesterday’s question. Third, multi-cloud and sovereignty programmes are no longer optional talking points for banks and insurers. A control plane that only truly lives on one hyperscaler is a strategy risk dressed as an integration project.
The talent market has moved with the tooling. XML-and-certification factories compete for a shrinking pool and train skills that do not transfer. Declarative gateways, Rego, OpenAPI and mesh policies train skills that transfer across clouds and vendors. AI coding and ops agents amplify the second stack and struggle with the first. Waiting for the next Apigee or MuleSoft major version before changing course simply extends the period in which your scarcest people are employed as human compilers for proprietary config. Competitors who treat policy as code and agents as builders will ship secure APIs faster while your change board still debates shared-flow ownership.
A pragmatic rollout that starts with one portable plane
Begin by separating gateway commodity from integration specialty. Inventory Experience-layer APIs that mostly route, authenticate, rate-limit and expose products. Those are candidates for Kong or Tyk on day one. Leave complex System and Process integrations that truly depend on MuleSoft connectors or DataWeave where they earn their keep until a deliberate rewrite is justified. Do not attempt a big-bang rip-and-replace. Run a portable gateway in parallel, migrate a thin vertical of high-value APIs and keep the legacy plane as fallback until latency, error budgets and policy coverage clear agreed gates.
Procure through the marketplace you already trust so committed cloud spend can fund a cloud-agnostic runtime rather than a native lock-in. Deploy the same gateway pattern on at least two providers or one provider plus on-premises early, even if traffic is tiny. The exercise is proving portability of config, identity integration and observability, not maximising requests in month one. Encode authentication against your existing identity provider, coarse product entitlements and a first Open Policy Agent or PingAuthorize decision path for one sensitive domain such as payments read, claims document access or customer PII fields.
Stand up agent-assisted delivery under human governance from the start. Define policy-as-code repositories, contract tests and a golden path for route and plugin changes. Allow agents to propose configurations and generate negative tests for broken object-level authorisation and field filters. Require human approval for production promotes and for any widening of entitlements. Success metrics should be board-readable: share of APIs on the portable plane, mean time to add a governed endpoint, proportion of policies under version control, shadow findings for over-privileged tokens and the number of clouds on which an identical policy graph can be restored from Git.
Scaling from gateway to mesh and field-level policy
Once north-south traffic for a domain is stable, extend the same trust model east-west. Introduce Kong Mesh or upstream Kuma for service-to-service mutual TLS, traffic permissions and MeshOPA policies so internal callers face the same authorisation philosophy as external ones. Push fine-grained checks closer to the data: object ownership, purpose limitation and field-level redaction or rejection when a token is valid yet the attribute is out of scope. Wire audit events from gateway and mesh into the same security information plane so investigators see progressive decisions rather than a single allow/deny at the edge.
Expand agent scope carefully. Let agents own regression packs for OWASP API Security Top 10 classes that matter to your estate, especially broken object authorisation and security misconfiguration. Keep humans on threat modelling, data-classification decisions and exception handling. Treat PingAuthorize or OPA as the system of record for authorisation logic where possible so gateway plugins remain thin adapters. That separation stops policy from rotting inside one vendor’s XML again. Scale domains only when the previous domain has continuous policy tests, documented fall-back and an operations runbook that does not depend on a single certified specialist.
Maximum utility, zero trust: the commercial payoff
Portable gateways bought through hyperscaler marketplaces convert cloud commit into strategic flexibility instead of deeper captivity. You keep the procurement convenience of AWS, Azure or Google Cloud without accepting their native API gateway as destiny. You shrink the XML factory’s headcount claim on the platform budget and redirect effort into policy design, data classification and agent-supervised automation. You give CISOs a coherent story: authentication, coarse authorisation, fine authorisation and field-level controls enforced at multiple layers, with mesh coverage for the calls customers never see.
For banks that means open-banking and internal domain APIs that can move with resilience and sovereignty programmes. For insurers it means claims and policy services that expose what partners need without leaking fields a token should never see. For any regulated operator it means audit evidence that authorisation was progressive and intentional, not a single gateway tick-box. Talent stays because the stack teaches transferable cloud-native skills. Exit options remain real because config is not trapped in Apigee proxy XML or DataWeave. Maximum utility for legitimate consumers and agents. Zero trust as the default posture rather than a slide.
Immediate next steps for technology leaders
Commission a hard inventory: which APIs are gateway commodity, which truly need MuleSoft-class integration and which security controls stop at the perimeter today. Select Kong or Tyk as the portable default for new Experience APIs and for a first migration tranche, procured via marketplace where it helps. Pair the gateway with Open Policy Agent and, where attribute-based depth is required, PingAuthorize. Plan Kong Mesh or Kuma for one east-west domain within the same programme, not as a separate science project.
Stand up a small platform cell with authority over policy-as-code, agent tooling and multi-cloud proof deployments. Ban new XML-factory expansion except where a written exception proves no portable alternative. Measure weekly: APIs migrated, policies under Git, agent-generated changes accepted versus rejected and identical restores onto a second cloud. Review in weeks, not fiscal years.
How not to do APIs is now well understood: lock the estate to one hyperscaler’s gateway, staff an XML and proprietary-transformation factory and declare victory when a token validates at the edge. How to do them is equally clear. Keep the gateway portable, let agents build and test security under human control and enforce trust progressively down to the field. Technology leaders who close the factory will own the operating standard. Those who keep it open will keep paying for lock-in and calling it governance.