APIs have become the backbone of modern applications, enabling seamless data exchange and integration, but increased reliance on APIs has also made them a prime target for cyber-criminals.

This is according to research by Raidiam, which found that API security vulnerabilities are becoming more advanced, more frequent, and more dangerous than ever before.

For technology leaders, this is not just a technical issue, but a strategic business threat.

Most enterprises appear unprepared for the rising threat, Raidiam found.

The data sharing firm found that 84% of security professionals experienced an API security incident in just the past year, with 92% of organisations using APIs suffering a breach in the same time span. This is costing organisations up to $87 billion a year.

In Raidiam’s API Security report, which surveyed 68 organisations, the vast majority handle sensitive data, but only one out of 68 organisations had adequate protections that were strong enough for the data they manage.

Static API keys and long-lived tokens are exposing high-value data, and most firms lack appropriate monitoring of API activity, often leaving them blind to misuse.

In a rating system by Raidiam, most (84%) of surveyed companies fell into the ‘act urgently’ category when it came to their API defences, meaning that the vast majority of organisation have a lot of work to do to develop adequate API security measures.

About 15% landed in the ‘start planning’ category, indicating some level of security though at an insufficient level, while only one organisations achieved the ‘you’re good’ designation.

“The trend is clear: most organisations are behind the curve on API security hardening, even as their reliance on APIs has grown,” the report noted.

Recommended reading

• UK Experiencing More API Security Incidents Than Ever Before
• API and Bot Attacks Cost Businesses £141 Billion A Year
• New Report Reveals API Security Incidents in the UK Are Rising

Some of the most common vulnerabilities to watch for include credential theft, token interception, supply chain vulnerabilities, data exposure, and business logic abuse.

APIs reply on credentials and tokens for authentication, while the increasing interconnections in modern business means that third-party API security is just as vital as in-house defences.

Flaws in security measures can expose data, while API business logic flaws can be manipulated by threat actors to bypass security controls.

To combat these threats, Raidiam suggests organisations follow leaders already adopting Financial-grade API (FAPI) security, which has become the gold standard in open banking and relies on a framework of authentication with extra cryptography with mTLS.

Raidiam also suggests making mTLS, or mutual transport layer security, the standard for all API integration. MTLS requires mutual authentication between both a server and a client with two-way identity verification.

The firm also calls for organisations to abandon their API keys – a static, symmetric security solution, in favour of asymmetric, short-lived credentials that are certificate-backed, and tokens that are bound to identities.