IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

90% of businesses experienced API security vulnerabilities in 2020

Report finds that more than a quarter of organizations haven't yet launched an API security strategy

Nine in ten organizations suffered a security incident with their application programming interfaces (APIs) last year, according to a report from security company Salt Security.

An API is a tool that software uses to field queries over the internet, including other cloud-based and mobile apps. They can also make browser-based applications more responsive and fluid. APIs are becoming increasingly popular, with Akamai stating that API queries comprise 83% of web traffic.

However, poorly crafted APIs can be a security risk, allowing people to query information they shouldn't. Examples in the past include a flaw an ethical hacker discovered in a GitLab API that could have exposed private group information. In 2018, an API bug at Google exposed 52.5 million private users’ data, and another at the US Postal Service made near real-time data on 60 million users public.

The report's findings don't mean 90% of people have experienced breaches via APIs. The incidents it described range from the discovery of vulnerabilities (54% of companies found those in production systems) to authentication problems (46%). However, the number of attacks on APIs was still a concern.

One in five companies experienced bot scrapers, and almost the same proportion experienced denial of service attacks via their APIs. Account misuse via APIs plagued 14% of respondents, while 9% saw an API-based data breach.

Related Resource

IBM Maximo 8.0: Moving to an integrated suite of applications

A report on the business benefits of the new Maximo solution

What are the benefits of Maximo 8.0 - integrated suite of applications - whitepaper from IBMDownload now

The respondents surveyed across all company sizes and various sectors revealed a lack of knowledge and strategy around API security. Of those surveyed, 5% had no API security strategy, and 22% were in the planning stages for API security. It's no surprise, then, that 83% of them lacked confidence in the APIs they were using, and 8% had no confidence at all. Companies had not documented their APIs properly because their tools relied on human interaction.

API blindness is a problem when it comes to version control. Outdated ”zombie” APIs that should have been retired long ago are often left exposed. According to Salt, there were anywhere from 40% to 800% more APIs in its clients' infrastructures than employees had documented.

This lack of visibility makes APIs a critical attack point. Salt's software found that 91% of its clients' APIs exposed personal or otherwise sensitive data.

Companies are aware of these security issues and see them as a significant risk and, according to the report, these concerns have delayed 66% of API deployments. There is too much of a focus on pre-production API threat-hunting, it warned, adding that too many people rely on developers and DevOps teams to catch API security issues. Companies must increase collaboration between their security and development teams, it warned.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

Best free malware removal tools 2022
Security

Best free malware removal tools 2022

22 Jun 2022
A guide to cyber security certification and training
Careers & training

A guide to cyber security certification and training

16 Jun 2022
What is shoulder surfing?
social engineering

What is shoulder surfing?

10 Jun 2022
CIAM buyer’s guide
Whitepaper

CIAM buyer’s guide

6 Jun 2022

Most Popular

Salaries for the least popular programming languages surge as much as 44%
Development

Salaries for the least popular programming languages surge as much as 44%

23 Jun 2022
The top programming languages you need to learn for 2022
Careers & training

The top programming languages you need to learn for 2022

23 Jun 2022
Swift exit: How the world cut off Russian banks
finance

Swift exit: How the world cut off Russian banks

24 Jun 2022