The majority (75%) of organisations typically change or update their APIs on a daily or weekly basis, creating a significant challenge for protecting the changing API attack surface, according to a new report.

Data Theorem has announced the “Securing the API Attack Surface” report in partnership with Enterprise Strategy Group (ESG). 

In a related finding, study results also revealed the majority (92%) of organiwations have experienced at least one security incident related to insecure APIs in the last 12 months, while the majority of organiwations (57%) have experienced multiple security incidents related to insecure APIs during the past year.

To gather data for this report, ESG surveyed 397 respondents from private- and public-sector organisations in across IT (38%), Security (30%) and Application Development (32%) on issues, challenges and trends around cloud native applications and API security. The majority of respondents (64%) were from organisations with 1,000 or more employees while 36% were from organisations with 100 to 999 employees.

To address these API security concerns, the study found that the leading approaches organisations will increase their spending on over the next 12-18 months are API security tools (45%), Cloud-Native Application Protection Platforms – CNAPPs (43%), and integrated application security and API security tools (41%).

The study also found that the most cited security challenge organisations face with faster development cycles of CI/CD is that security lacks visibility and control in development processes (41%). The second most cited security challenge with faster development cycles of CI/CD is that new builds are deployed to production with misconfigurations, vulnerabilities, and other security issues (40%), followed by developers skipping security processes (39%), and software released without security checks and/or testing (38%).

“It’s no surprise that most organisations are experiencing API-related security incidents,” says Melinda Marks, Senior Analyst for Enterprise Strategy Group. 

“Modern development cycles bring faster, more frequent product releases and updates, and the growing number of APIs that change on a daily and weekly basis make it imperative to address the changing attack surface," she says. 

"This rapid rate of change also creates shadow APIs and zombie APIs, which can be hackers’ favourite APIs to exploit because organisations often do not know about them.”

The study also found that the types of API vulnerabilities of greatest concern to organisations are sensitive data exposure due to no SSL or TLS (34%), attribute-based access control (ABAC) vulnerabilities and API business logic flaws (both at 31%), and distributed denial of service attacks – DDoS (30%).

“According to ESG, with the overwhelming majority (80%) of organisations reporting that all or most of their cloud-native applications use APIs today, and a similar majority (75%) of organisations typically changing or updating their APIs at least weekly, API and cloud-native security remains a critical issue for organisations today,” says Doug Dooley, Data Theorem COO. 

“The good news the research shows is that two security approaches – API security tools and Cloud Native Application Protection Platforms (CNAPPs) – appear to be the most promising options to help organisations reduce their vulnerabilities to attack, and organisations are taking action over the next 12-18 months to best secure their applications and data. Data Theorem is in an ideal position to supply organisations with both API security and CNAPP solutions.”