Latest State of API Security report: 400% increase in attackers and more!

The latest Salt Labs State of API Security report is out, and we’re excited to share with you some of the key findings. The security industry news has frequently covered high-profile application programming interface (API) breaches over the past few years, so it’s no surprise that our research found that attackers have upped their activity. Salt Labs analyzed the past year of Salt customer data and found a 400% increase in unique attackers just over the last six months alone. In addition, we found that 78% of attacks happened over authenticated APIs.

The Q1 2023 report also revealed that 94% of survey respondents experienced security problems in production APIs in the past year, with 17% stating their organizations suffered a data breach as a result of security gaps in APIs. Not surprisingly, nearly half (48%) of respondents now state that API security has become a C-level discussion within their organization.

As always, the State of API Security Report pulls from a combination of survey responses and empirical data from Salt customers. This year’s report provides our deepest insights yet with “in the wild” API vulnerability research that demonstrates how respondents’ top concerns in API security manifest in real-world scenarios.

Other key highlights from the fifth edition of the report include:

API security has emerged as a significant business issue, not just a security problem

API security has become a critical business issue for survey respondents' organizations, as indicated by application rollout delays, heightened awareness of API security breaches, and a lack of confidence in existing API security approaches. Specifically:

• More than half of respondents (59%) report they have had to slow the rollout of new applications because of API security concerns.
• Just 23% of respondents believe their existing security approaches are very effective at preventing API attacks.
• 48% of survey respondents say that API security has become a C-level discussion over the past year. That percentage runs even higher within heavily regulated industries, such as Technology (59%), Financial Services (56%), and Energy/utilities (55%).

The top two most valued API security capabilities are to stop attacks and identify PII exposure, while the ability to implement shift-left practices was rated the lowest

Survey respondents cited the following as the most “highly important” API security capabilities:

• 44% cited the ability to stop attacks.
• 44% cited the ability to identify which APIs expose PII or sensitive data.
• 38% cited meeting compliance or regulatory requirements.
• Only 22% cited the ability to implement shift-left API security practices as highly important.

Attackers are more relentless than ever

Salt customer data shows that API attacks are on the rise and bad actors are targeting internal and authenticated APIs. Empirical data from Salt customers shows:

• 78% of API endpoint attacks come from seemingly legitimate users but are actually attackers who have maliciously achieved the proper authentication.
• 8% of attack attempts are perpetrated against internal-facing APIs, typically left entirely unprotected.
• 4,845 unique attackers operated in December 2022 – a 400% increase from just six months earlier.

Most API security strategies remain immature

The survey found that the vast majority of organizations still lack mature API security programs:

• Only 12% of respondents consider their API security programs to be advanced and include dedicated API testing and runtime protection, up from 10% in Q3 2022.
• 30% of respondents have no current API security strategy, despite all respondents having production APIs in place. Of those, 25% say they’re in planning stages, while 5% say API security plans are non-existent.
• Respondents are largely relying on traditional approaches to API security such as WAFs, API gateways, and log file analysis, but only 23% find these methods very effective.

“Zombie” APIs followed by ATO top the list of API worries

When asked about the most concerning API security risks:

• 54% of respondents said outdated or "zombie" APIs are a high concern, up from 42% from last quarter. (Zombie, or outdated, APIs have been the #1 concern in the past five surveys from Salt, likely the result of increasingly fast-paced development as organizations seek to maximize the business value associated with APIs.)
• 43% stated account takeover (ATO) as a high concern.
• Only 20% cited shadow APIs as a top concern. Given API documentation challenges, it is likely most environments are running APIs that are not documented and that the risk in this area is likely higher than many respondents realize.

Vulnerabilities discovered in the wild represent a critical concern

Companies large and small have many unknown security gaps. The report notes:

• 90% of investigations undertaken by Salt Labs uncover API security vulnerabilities, and 50% of those vulnerabilities discovered should be considered critical.
• 41% of survey respondents stated that they had identified a vulnerability in their production APIs, a number that has fluctuated between 39% and 55% since the initial survey but a number that is most likely substantially higher in reality, according to Salt Labs.

Additional interesting findings from the State of API Security Report include:

• Only 18% of respondents say they are very confident that their API inventories provide enough detail about their APIs and the PII or sensitive data within.
• Organizations continue to update their API frequently –  37% of organizations update their APIs at least weekly, up from 32% in Q3 2022, and 9% update their primary APIs on a daily basis.
• OAS and Swagger files are updated at least weekly in only 12% of organizations. 20% update documentation at no regular cadence, and 23% update it approximately every six months. These gaps reinforce the shortcomings of relying on shift-left practices for securing APIs.
• Just about half the respondents (54%) say their security team highlights the OWASP API Security Top 10 in their security program, an unfortunate finding given that 66% of attempted attacks within the Salt customer base leveraged at least one of the ten methods on that list.