APIs have revolutionized every industry. They fuel digital transformation and power the web, making up more than 83% of global internet traffic. And API adoption will only grow, with AI, Web3, and decentralization only further driving API usage and integration.
But these sometimes-overlooked enablers of connectivity and communication present a serious security challenge: APIs are increasingly in the crosshairs of cyber-attackers.
In this post, we'll look at the rising number (and cost) of API-related security incidents, and why APIs should be considered mission-critical infrastructure.
Gartner previously predicted that APIs were becoming the leading attack vector for web applications. And the headlines tell a similar story — with API-led cyberattacks leading to data breaches, customer data leaks, and lawsuits around the world.
In the Kong eBook Leading Digital Transformation: Best Practices for Becoming a Secure API-First Company, we worked with Kong data analysts and outside economists to develop research to get a better look at the risk around poorly managed APIs in the coming years.
Some highlights of the research are below.
Between 2021 and 2030, we project a surge of 996% in API attacks. This signifies an explosion in the frequency and severity of API-related cyber threats. An average annual increase of 31% in API attacks over this decade is projected.
Not only will we see more API attacks, but we will see the cost of these attacks continue to grow as well. Today, the average cost for a security breach stands at $6.1 million, which accounts for remediation and lost value associated with damage to reputation.
Estimates in our study show that these costs are on an upward trend, and are predicted to increase 95% higher — to $14.5 million per breach — by 2030.
In the United States alone, the economic cost of attacks is currently $10.6 billion per year. Our research projects the national cost to reach $198 billion within seven years, amounting to a cumulative cost of $506 billion this decade.
So, are APIs really mission critical infrastructure?
Consider this: APIs are at the heart of everything an organization does and essential to every modern user experience — from user interfaces that delight customers to global partner networks that expand markets and drive revenue.
With this in mind, there's no doubt that APIs constitute mission critical infrastructure.
But even when APIs are recognized as mission critical, their infrastructure is often not accorded the same importance. This can lead to situations where attackers can identify and exploit discrepancies in API management and security, gaining system access and inflicting damage on enterprises and their customers.
Technology leaders are expecting to build more APIs in the next five years, than all the APIs built until now. Are we prepared to manage this scale?
This inconsistency often stems from a well-intentioned but problematic decision: distributing API infrastructure ownership across multiple teams.
This approach aims to promote speed and autonomy, but it unintentionally triggers a chain reaction of adverse issues affecting internal systems and controls.
In practice, we can enable teams to move fast and take ownership of operational policies applied to the underlying API infrastructure without disseminating core infrastructure ownership. The ideal objective? To have teams act as "users" of API infrastructure — not "builders."
This becomes even more crucial when the organization is a national security asset — such as financial institutions or telecommunication companies — when API infrastructure should comply with the same rigorous standards and regulatory mandates as other corporate and operating functions. Regrettably, this compliance often falls short when infrastructure ownership is spread across teams.
Building a robust and reliable API infrastructure requires the establishment of an internal playbook that enables us to:
The ultimate goal? To maintain continuous control over the API infrastructure that drives our organization’s present and future. This can be achieved responsibly, ensuring that teams remain productive and agile. But without the right practices in place, an organization’s ability to scale and expand its API portfolio is reduced — potentially exacerbating problems over time.
For a deep dive into each of these areas and a walkthrough of how to build a framework for establishing modern API practices within your organization, download the Kong eBook Leading Digital Transformation: Best Practices for Becoming a Secure API-First Company.
Most organizations today grasp the importance of APIs, but too few fully recognize that APIs absolutely constitute mission critical infrastructure that demands the appropriate management. As seen with recent API cyberattacks, insufficiently secured and managed APIs can result in severe damage to an organizations reputation and harm to customers.
In this blog post, we'll talk about the significant challenge of managing and governing a growing number of APIs across multiple teams in an organization — and how Control Plane Groups are a clear solution to avoid the chaos of inconsistent policies
While many organizations mistakenly believe a single tool can solve all their API security woes, the truth is far more complex. This blog post will dismantle the myth of the "silver bullet" and demonstrate how a comprehensive, defense-in-depth strat
Ever feel like you're fighting an uphill battle with your API strategy? You're building APIs faster than ever, but somehow everything feels harder. Wasn’t API-first supposed to make all this easier? Well, you're not alone. And now industry analys
Survey Says: Google LLMs See Usage Surge, Most OK with DeepSeek in the Workplace Enterprise adoption of large language models (LLMs) is surging. According to Gartner , more than 80% of enterprises will have deployed generative AI (GenAI) applicatio
Kafka delivers massive value for real-time businesses — but that value comes at a cost. As usage grows, so does complexity: more clusters, more topics, more partitions, more ACLs, more custom tooling. But it doesn’t have to be that way. If your tea
A Practical Look at When (and When Not) to Use Ambient Mesh The word on the street is that ambient mesh is the obvious evolution of service mesh technology — leaner, simpler, and less resource-intensive. But while ambient mesh is an exciting develop
I'm commonly asked by customers for advice on how they can build a good platform cross-charging model for their organization. And my gut reaction is nearly always "don't." We'll come back to why I think that later, but first let's look at what cross
