More UK organisations than ever before are experiencing API security incidents, with the total soaring from 69% to 83% year-on-year vs 2023.

This is according to Akami’s API Security Impact study, now in its third year, which explores the state of API protection based on a survey of 1,207 leaders and practitioners across the US, UK, and Germany.

The study find that collectively, 84% of respondents report suffering an API security incident over the past 12 months, with the UK experiencing the sharpest year-on-year increase of 14%.

Alarmingly, the figure stands much higher across the UK’s critical infrastructure. 94.1% of the UK’s government/public sector organisations, 92% of the financial services industry and 90% of the healthcare industry reported suffering API security incidents.

The survey also found that nine in 10 US and UK respondents are not testing their APIs in real time. In 2024, only 13% of respondents reported doing so.

Worryingly, testing is not gaining ground as the figure has fallen from 18% in 2023.

A lack of testing can lead to disastrous financial consequences, as the average cost for UK organisations to address API incidents in the past 12 months amounts to £420,103. This includes system repairs, downtime, legal fees, fines, and other associated expenses.

UK respondents specifically called out the dual nature of API incident’s impact, however, with 31.2% of respondents sharing that it led to increased stress or pressure.

Across the board, respondents ranked the heightened stress and pressure notably higher than the monetary costs.

But consumers should also be concerned, as oversight on sensitive data is falling. In the UK, only 28.5% of enterprises with full API inventories know which APIs return sensitive data – down from 40% in 2023 and compared to 27% globally.

This becomes even more concerning considering the UK government and public services are the most targeted industries, with 94.1% of organisations in the sector experiencing incidents over the last 12 months.

Recommended reading

• Gartner: GenAI is Coming for APIs Next
• API and Bot Attacks Cost Businesses £141 Billion A Year
• New Report Reveals API Security Incidents in the UK Are Rising

Conversely, retail/eCommerce reported the lowest number of API incidents at 68%  and cited API security as a top priority at 21.3% – higher than any other industry surveyed.

“Our research shows that API security has yet to become a key element in a comprehensive security strategy,” said Richard Meeus, director of security technology and strategy, EMEA at Akamai.

“Organizations mostly treat API threats as emerging, when the attack data — as well as the financial impact and stress on security teams — shows they keep growing. We believe that the API Security Impact Study will help companies to better assess API protections and improve them where needed.”