Rampant API Growth Causing Cybersecurity Risks for Businesses

A recent survey of 235 IT and cybersecurity decision-makers commissioned by Fastly, Inc. (NYSE: FSLY), one of the world’s fastest edge cloud platforms, has found that - despite the critical role of APIs - the vast majority of commercial decision-makers are ignoring the burgeoning security risk for businesses. Application Programming Interfaces (APIs) have long been recognised as a bedrock of the digital economy and recent figures suggest that the majority of all internet traffic is now directed via APIs.

Lack of advanced API security endemic

The ubiquity of APIs means they have become one of cybercriminals’ favourite gateways for account takeover attacks. In a recent survey by Fastly, 84% of respondents admitted to not having advanced API security in place.

The lack of action on API breaches comes despite the vast majority of decision-makers knowing there is a problem. 95% of respondents surveyed by Fastly said they had experienced API security problems in the last twelve months. Over three quarters (79%) had delayed the rollout or integration of a new application due to API security concerns. In addition, 79% claim to place a ‘high or very high’ level of importance on API security. Asked why none of this has translated into action, ‘insufficient budget’ and a ‘lack of expertise’ were the most commonly stated reasons.

Risk of operational and reputational damage

Jay Coley, Senior Security Architect at Fastly, said: “The results of our survey show that decision-makers know that increased reliance on APIs creates a risk of serious cyberattacks. But so far they are not doing enough about it. This is surprising given that the operational and reputational cost of a breach far outweighs the price of deploying a consolidated web application and API security solution from a single provider.”

Key areas of concern

Asked which attributes of an API security platform would be the most important to their company, respondents said number one would be identifying which APIs expose personal or sensitive data (43%). Other top concerns included identifying all APIs, including those that are undocumented (40%) and logging and monitoring (28%). However, companies are increasingly struggling to identify API attacks because of the sheer volume of notifications that they receive using legacy security solutions.