Enterprise Strategy Group Research Reveals 75% of Organizations Change or Update APIs on a Daily or Weekly Basis Increasing their Attack Surface

According to the ESG Study, 92% of Organizations Have Experienced at Least One Security Incident Related to Insecure APIs in the Past Year

PALO ALTO, Calif.–(BUSINESS WIRE)–#APIsecurity–Data Theorem, Inc., a leading provider of modern application security, today announced the “Securing the API Attack Surface”¹ report in partnership with Enterprise Strategy Group (ESG). The study found that the majority (75%) of organizations typically change or update their APIs on a daily or weekly basis, creating a significant challenge for protecting the changing API attack surface. In a related finding, study results also revealed the majority (92%) of organizations have experienced at least one security incident related to insecure APIs in the last 12 months, while the majority of organizations (57%) have experienced multiple security incidents related to insecure APIs during the past year.

To gather data for this report, ESG surveyed 397 respondents from private- and public-sector organizations in North America (US and Canada) across IT (38%), Security (30%) and Application Development (32%) on issues, challenges and trends around cloud native applications and API security. The majority of respondents (64%) were from organizations with 1,000 or more employees while 36% were from organizations with 100 to 999 employees.

To address these API security concerns, the study found that the leading approaches organizations will increase their spending on over the next 12-18 months are API security tools (45%), Cloud-Native Application Protection Platforms – CNAPPs (43%), and integrated application security and API security tools (41%). The study also found that the most cited security challenge organizations face with faster development cycles of CI/CD is that security lacks visibility and control in development processes (41%). The second most cited security challenge with faster development cycles of CI/CD is that new builds are deployed to production with misconfigurations, vulnerabilities, and other security issues (40%), followed by developers skipping security processes (39%), and software released without security checks and/or testing (38%).

“It’s no surprise that most organizations are experiencing API-related security incidents,” said Melinda Marks, Senior Analyst for Enterprise Strategy Group. “Modern development cycles bring faster, more frequent product releases and updates, and the growing number of APIs that change on a daily and weekly basis make it imperative to address the changing attack surface. This rapid rate of change also creates shadow APIs and zombie APIs, which can be hackers’ favorite APIs to exploit because organizations often do not know about them.”

The study also found that the types of API vulnerabilities of greatest concern to organizations are sensitive data exposure due to no SSL or TLS (34%), attribute-based access control (ABAC) vulnerabilities and API business logic flaws (both at 31%), and distributed denial of service attacks – DDoS (30%).

“According to ESG, with the overwhelming majority (80%) of organizations reporting that all or most of their cloud-native applications use APIs today, and a similar majority (75%) of organizations typically changing or updating their APIs at least weekly, API and cloud-native security remains a critical issue for organizations today,” said Doug Dooley, Data Theorem COO. “The good news the research shows is that two security approaches – API security tools and Cloud Native Application Protection Platforms (CNAPPs) – appear to be the most promising options to help organizations reduce their vulnerabilities to attack, and organizations are taking action over the next 12-18 months to best secure their applications and data. Data Theorem is in an ideal position to supply organizations with both API security and CNAPP solutions.”

For a free copy of the ESG “Securing the API Attack Surface” report, see https://www.datatheorem.com/resources/reports/securing_the_api_attack_surface_esg.

Data Theorem’s broad AppSec portfolio protects organizations from data breaches with application security testing and protection for modern web frameworks, API-driven microservices and cloud resources. Its solutions are powered by its award-winning Analyzer Engine, which leverages a new type of dynamic and runtime analysis that is fully integrated into the CI/CD process, and enables organizations to conduct continuous, automated security inspection and remediation. Data Theorem is one of the first vendors to provide a full stack application security analyzer that connects attack surfaces of applications starting at the client layers found in mobile and web, the network layers found in APIs, and the infrastructure layers found in cloud services.

Note 1 – Source: Enterprise Strategy Group, a division of TechTarget Inc. Research eBook, Securing the API Attack Surface, May 2023.

About Enterprise Strategy Group

TechTarget’s Enterprise Strategy Group is an integrated technology analysis, research, and strategy firm providing market intelligence, actionable insight, and go-to-market content services to the global technology community.

About Data Theorem

Data Theorem is a leading provider of modern application security, helping customers prevent AppSec data breaches. Its products focus on API security, cloud (serverless apps, CSPM, CWPP, CNAPP), mobile apps (iOS and Android), and web apps (single-page apps). Its core mission is to analyze and secure any modern application anytime, anywhere. The award-winning Data Theorem Analyzer Engine continuously analyzes APIs, Web, Mobile, and Cloud applications in search of security flaws and data privacy gaps. The company has detected more than 5 billion application incidents and currently secures more than 25,000 modern applications for its enterprise customers around the world. Data Theorem is headquartered in Palo Alto, Calif., with offices in New York and Paris. For more information visit www.datatheorem.com.

Data Theorem and TrustKit are trademarks of Data Theorem, Inc. All other trademarks are the property of their respective owners.

Contacts

Dan Spalding

dan@datatheorem.com
(408) 960-9297