Addressing API Security Concerns in AI Projects
Insecure APIs Threaten the Resilience and Security of AI Projects
PALO ALTO, Calif. — Salt Security recently released its insightful semi-annual State of API Security Report, revealing concerning gaps between the rapid adoption of APIs and the corresponding security measures that organizations are implementing. The report highlights how critical AI and automation initiatives are jeopardized by these vulnerabilities. In an age where enterprises rush to embrace the AI Agent Economy, the API security risks cannot be overlooked.
Key Findings from the Report
The report is based on responses from 386 professionals overseeing API management and presents several alarming findings:
- 80% of organizations do not have continuous API monitoring in place, which exposes them to threats targeting their AI applications.
- A staggering 33% of companies reported experiencing an API security incident within the past year, with half of the respondents indicating they had to delay launching new applications due to API security issues.
- Only 19% of the participants expressed high confidence in the accuracy of their API inventories, while 54% rely on potentially unreliable developer documentation to identify sensitive data exposures.
According to Eric Schwake, Director of Cyber Security Strategy at Salt Security, "APIs are now central to digital transformation and AI, but the security measures in place remain inconsistent at best. Managing APIs is crucial for managing AI; without bolstered security, the risks will continue to grow." Schwake asserts that companies must act swiftly to address the unmonitored API attack surfaces that place innovation at risk.
The Complexity of AI Adoption
The integration of Generative AI presents significant complexities in API security. While 62% of organizations have already begun using GenAI in API development, 56% consider it a rising security concern, primarily because of vulnerabilities in AI-generated code. Furthermore, 59% of companies are now utilizing GenAI within their security operations, leading to both new opportunities and risks.
API Adoption Trends
The report sheds light on astonishing growth in API utilization, revealing that 41% of organizations have seen increases between 51% and 100% in the previous year, while another 13% noted even higher growth rates of 101% to 200%. Alarmingly, 6% of respondents reported their API volumes had more than tripled, showcasing an astonishing rise of over 301% in just one year. As the API ecosystem expands, 42% of organizations now manage between 101 and 500 APIs, with 14% overseeing more than 1,000.
Challenges in API Security
Despite increased investments in API security, numerous challenges persist. Nearly 80% of organizations have boosted their budgets for API security initiatives in the past year, though most increases were modest, below 15%. Budget limitations were cited by 25% of respondents as their primary barrier, while 16% mentioned a shortage of human resources. Additional structural issues were highlighted, with 15% citing inadequate runtime security, 14% noting poor manageability, and 12% indicating insufficient pre-production security investments, suggesting a need for improvement.
Evolving Security Strategies
The report advocates for a significant shift in how organizations approach API security. Businesses are encouraged to transition from fragmented and reactive strategies to a comprehensive action plan, focusing on continuous API discovery, stronger governance, runtime protection, and safeguards specifically tailored for GenAI.
"The widespread adoption of AI is clear, but security measures are failing to keep pace. Many existing tools overlook critical layers of API execution, which allows attackers to potentially hijack AI agents at will," Schwake warns. He emphasizes that companies mastering API security will have the upper hand in safely unlocking AI-driven innovation. Those that ignore these principles risk being left behind in an increasingly competitive landscape.
About the Report
The H2 2025 State of API Security Report is derived from a study encompassing 386 professionals across various industries responsible for managing API security. This report meticulously examines the risks, practices, and challenges shaping API security in this era of AI-enhanced digital transformation.
About Salt Security
Salt Security is dedicated to securing the APIs that drive today's digital businesses. The company offers rapid API discovery services to uncover shadow, zombie, and unknown APIs before they can be exploited. Salt's governance engine and centralized Policy Hub streamline security checks and oversee safe API development at scale. With customizable policies and built-in rules, Salt helps organizations stay ahead of compliance and minimize API risks. By leveraging machine learning and AI, Salt delivers early threat detection, providing a crucial advantage against sophisticated API attacks. Many top organizations rely on Salt to identify API vulnerabilities quickly and mitigate risks effectively. To find out more, visit https://salt.security.
Frequently Asked Questions
What are the main findings of the report regarding API security?
The report reveals that a large percentage of organizations lack effective API monitoring, leading to significant security risks and incidents.
How does Generative AI impact API security?
Generative AI complicates API security due to vulnerabilities in AI-generated code, although it also offers opportunities for improved security measures.
What percentage of organizations experience API security incidents?
One in three organizations faced security incidents related to APIs in the past year, highlighting a critical issue within API management.
What are the key barriers to effective API security?
Budget constraints, resource shortages, and structural issues related to runtime security and management hinder organizations from achieving effective API security.
What is recommended for improving API security strategies?
Organizations are encouraged to adopt holistic security strategies, emphasizing continuous API discovery and stronger governance practices.
