31% of security and IT leaders identify agentic/API logic failures as security incidents tied to AI systems.

More than 1 in 7 organizations expose API documentation to the internet.

92% of organizations lack the advanced security maturity required to defend agentic AI environments

24% of organizations have a fully automated API inventory

47% of organizations have delayed production releases due to API security concerns

32% of organizations experienced an API security incident in the past year

8% of organizations report advanced API security maturity

65% of API attacks exploit Security Misconfiguration (OWASP API8)

99% of API attack attempts originate from authenticated sources

56% of organizations invest in agentic discoverability, 55% invest in API security, and 54% invest in web application firewalls.

In 2025 breach data, AI platforms and tooling accounted for 15% of API-related breaches, tying software as the largest category in the dataset.

In 2025, 43% of CISA KEV additions were API-related, making APIs the single largest exploited surface in that dataset.

In 2025, 17% of 67,058 published vulnerabilities (11,053 vulnerabilities) were API-related.

88% of CISOs and AppSec executives are willing to replace API security solutions.

Malicious web application and API transactions rose 128% year over year.

99% of API vulnerabilities are remotely exploitable.

In 2025, 36% of AI-related KEVs involved an API attack surface.

In 2025, 36% of AI-related vulnerabilities involved APIs (786 of 2,185 AI-related vulnerabilities).

97% of API vulnerabilities can be exploited with a single request.

98% of API vulnerabilities are easy or trivial to exploit.