The Industry’s Only Global API Security Report
Traceable is the only API security company conducting annual, global research on the state of API security. This year’s comprehensive survey gathered insights from 1,548 respondents across 100+ countries, including key regions such as the United States, UK, and EMEA, and covers six major industries. In collaboration with the Ponemon Institute, this research report provides the most in-depth and authoritative look at emerging API security trends and vulnerabilities.
1,548
Respondents
100
+
Countries
6
+
Industries
API Attack Detection Remains a Blind Spot
Despite the widespread nature of these breaches, the ability to detect and prevent attacks remains dangerously low. Only 21% of organizations report a high ability to detect attacks at the API layer. Furthermore, only 13% can prevent more than 50% of API attacks, highlighting significant gaps in current security capabilities.
DDoS and Fraud Remain the Primary Breach Methods; Brute Force Enters the Top 3
DDoS and fraud continue to be the most frequent methods used to breach APIs, representing a large percentage of reported incidents. This year, brute force attacks have also moved into the top three, indicating a shift in attack patterns. Organizations need to recognize these evolving threats and take proactive steps to reinforce their API security measures.
37
%
DDoS attacks
31
%
Fraud, abuse, and misuse
27
%
brute force attacks
API Attack Detection Remains a Blind Spot
Despite the widespread nature of these breaches, the ability to detect and prevent attacks remains dangerously low. Only 21% of organizations report a high ability to detect attacks at the API layer. Furthermore, only 13% can prevent more than 50% of API attacks, highlighting significant gaps in current security capabilities.
Fraud and Bots Are Exploiting APIs — Is Your Defense Strong Enough?
Fraud and bot attacks pose a major threat to API security, with 69% of organizations considering API-related fraud serious. Yet, only 21% can effectively mitigate bot traffic, while 53% have already experienced bot-related attacks. Traditional security solutions like WAF and WAAP are proving insufficient, with 53% stating these solutions are not effective at detecting fraud at the API layer.
Generative AI: The Emerging Threat Expanding Your API Attack Surface
With the rapid rise of generative AI applications, new API security risks are emerging. 65% of respondents believe generative AI poses a serious to extreme risk to API security. Key concerns include an increased attack surface, data leakage from API calls, and unauthorized access to sensitive data. The pace of AI development (67%) and lack of in-house API security expertise (66%) further compound the problem
60
%
are concerned about data leakage through generative AI APIs
50
%
challenged with monitoring traffic to and from Gen AI APIs