Findings illustrate that attacks on APIs are more relentless than ever, with bad actors targeting internal and authenticated APIs
PALO ALTO, Calif. – March 29, 2023 – Salt Security, the leading API security company, today released the Salt Labs State of API Security Report, Q1 2023. This fifth edition of the report found that attackers have upped their activity, with Salt customer data showing a 400% increase in unique attackers in the last six months. In addition, about 80% of attacks happened over authenticated APIs. Not surprisingly, nearly half (48%) of respondents now state that API security has become a C-level discussion within their organization. The report also revealed that 94% of survey respondents experienced security problems in production APIs in the past year, with 17% stating their organizations suffered a data breach as a result of security gaps in APIs. The findings from Salt Labs highlight why 2023 has been dubbed the “Year of API Security.”
The State of API Security Report pulls from a combination of survey responses and empirical data from Salt customers. This year’s report provides the deepest insights yet, including “in the wild” API vulnerability research from Salt Labs that demonstrates how respondents’ top concerns in API security manifest in real-world scenarios.
“The rapid increase in attacks in addition to the data provided by our survey respondents reflect a growing understanding in the C-suite about the importance of purpose-built API security to reduce business risk,” said Roey Eliyahu, co-founder and CEO, Salt Security. “Powered by APIs, ongoing digital transformation continues to deliver new business opportunities and competitive advantages. However, the cost of API breaches, such as those experienced recently at T-Mobile, Toyota, and Optus, put both new services and brand reputation, in addition to business operations, at risk. With bad actors continuing to find new and unexpected ways to attack APIs, organizations need to get serious about securing these critical assets.”
API security has become a critical business issue for survey respondents' organizations, as indicated by application rollout delays, heightened awareness of API security breaches, and a lack of confidence in existing API security approaches. Specifically:
Survey respondents cited the following as the most “highly important” API security capabilities:
Salt customer data shows that API attacks are on the rise and bad actors are targeting internal and authenticated APIs. Data from the Salt cloud shows:
When asked about the most concerning API security risks:
The survey found that the vast majority of organizations still lack mature API security programs:
Companies large and small have many unknown security gaps. The report notes:
The survey results from the Q1 2023 State of API Security Report are clear. Respondents overwhelmingly stated that reliance on APIs is continuing to grow as APIs become ever more imperative to their organizations' success. At the same time, APIs are getting harder to protect as attacks increase and traditional tools and processes cannot stop them. Organizations must move beyond yesterday’s security practices and last-generation tools to a modern security strategy that addresses security at every stage of the API lifecycle and provides a broad range of protections that foster collaboration across teams.
The State of API Security Report, Q1 2023, was compiled by researchers from Salt Labs, the research division of Salt Security, utilizing survey data from nearly 400 respondents across a range of job responsibilities, industries, and company sizes, globally. Nearly half of those surveyed, 48%, hold roles in security, 19% are executive-level security or IT leaders, and another 26% sit within the platform, DevOps, or product teams. Technology and financial services companies – widely viewed as at the forefront of API use – make up 48% of respondents. Companies large and small are evenly represented. The report also draws from anonymized and aggregated empirical data of Salt Security customers running the Salt Security API Protection Platform.
To learn more about Salt Security or to request a demo, please visit https://content.salt.security/demo.html.