# Why Robust API Security Is Essential for Every AI Application

This presentation explains why API security is the foundation of AI security, especially as AI agents, LLM-connected applications, and MCPs rapidly expand enterprise attack surfaces. The speakers argue that APIs act as the control plane behind AI apps, which means attackers can target either the agent itself or the underlying API, often through unmanaged, shadow, rogue, zombie, or deprecated endpoints. Drawing on Akamai’s fourth annual API Security Impact Study of more than 1,800 security professionals across 10 countries and six industries, they highlight that AI-linked API attacks are both the most common and the area organizations feel least prepared to defend, while 87% of respondents reported an API security incident in the last 12 months. Key concerns include data leakage, business-logic abuse, prompt-injection-related API misuse, poor visibility, misconfigurations, and limited awareness of which APIs handle sensitive data. Akamai and Kong position their joint approach around runtime-based discovery, posture assessment, behavior-based protection, automated testing, and optional blocking through Kong-integrated controls.