Businesses are being plagued by API security risks - with nearly 99% affected

API
(Image credit: Shutterstock)

  • Report warns vulnerabilities, data exposure, and API authentication weaknesses, are key issues
  • Many firms were forced to slow down app rollouts due to API issues
  • Businesses can mitigate API risks before they can be exploited, researchers are saying

Virtually all (99%) of organizations have experienced some API security issues over the last 12 months, and more than half (55%) were forced to slow down the rollout of new applications due to various API security concerns, new research has claimed.

A new research paper from Salt Security found businesses are essentially being plagued by API security risks.

Vulnerabilities that expose APIs to various exploits (for example, injection attacks and Broken Object-Level Authorization (BOLA)), accounted for more than a third of issues (37%), similar to sensitive data exposure (34%). API authentication weaknesses took the third spot with 29%.

Outdated practices

Salt added Generative Artificial Intelligence has “advanced” API security challenges, since almost half (47%) of the respondents expressed concerns about securing AI-generated code. Furthermore, for two in five (40%) potential risks introduced by AI-generated code is a top concern. Only 11% of respondents do not see the use of GenAI applications as a growing security.

The researchers also determined that traditional API security methods, in which authentication is the primary defense mechanism, can no longer suffice. Almost all (95%) of API attacks over the past 12 months came from authenticated sources, and what’s more, 98% of attack attempts targeted external-facing APIs.

To protect against “rampant” API attacks, Salt says businesses should make API posture governance strategies “essential”, and warned that the majority is far removed from that notion. It claims only 10% of organizations currently have an API posture governance strategy set up, similar to the previous year - but the good news is that 43% plan on implementing such a strategy soon.

Since threat actors are actively abusing security weaknesses, businesses need to implement a “robust, proactive API security strategy,” says Roey Eliyahu, co-founder and CEO, Salt Security.

“A strategy that should not only encompass timely threat detection and incident responses but also API governance. By implementing frameworks that ensure security policies are clearly defined, continuously enforced, and regularly assessed, organizations can mitigate API risks before they can be exploited.”

You might also like

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Red padlock open on electric circuits network dark red background
AI-powered cyber threats are becoming the biggest worry for businesses everywhere
Best email services: image of email with one unread message alert
Over 400 million unwanted and malicious emails were received by businesses in 2024
Representational image of a hacker
The 10 worst software disasters of 2024: cyberattacks, malicious AI, and silent threats
Holographic representation of cloud computing over open businessman's hand
Businesses are struggling to address vulnerabilities hidden in phantom dependencies
Hacker Typing
Racing against time on a menacing caldera: survey finds majority of organizations take days to tackle critical vulnerabilities, each of them a potential open goal for cybercriminals
Cartoon Phishing
Hackers use GenAI to attack more frequently and effectively
Latest in Security
Isometric demonstrating multi-factor authentication using a mobile device.
NCSC gets influencers to sing the praises of 2FA
Sam Altman and OpenAI
OpenAI is upping its bug bounty rewards as security worries rise
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Dangerous new CoffeeLoader malware executes on your GPU to get past security tools
China
Notorious Chinese hackers FamousSparrow allegedly target US financial firms
A digital representation of a lock
NYU website defaced as hacker leaks info on a million students
NHS
NHS IT supplier hit with major fine following ransomware attack
Latest in News
Nintendo Switch 2 Joy-Con up-close from app store
Nintendo's new app gave us another look at the Switch 2, and there's something different with the Joy-Con
cheap Nintendo Switch game deals sales
Nintendo didn't anticipate that Mario Kart 8 Deluxe was 'going to be the juggernaut' for the Nintendo Switch when it was ported to the console, according to former employees
Three angles of the Apple MacBook Air 15-inch M4 laptop above a desk
Apple MacBook Air 15-inch (M4) review roundup – should you buy Apple's new lightweight laptop?
Witchbrook
Witchbrook, the life-sim I've been waiting years for, finally has a release window and it's sooner than you think
Amazon Echo Smart Speaker
Amazon is experimenting with renaming Echo speakers to Alexa speakers, and it's about time
Shigeru Miyamoto presents Nintendo Today app
Nintendo Today smartphone app is out now on iOS and Android devices – and here's what it does