82% of the organizations have adopted some level of an API-first approach.

Nearly 80% of organizations increased their API security budgets in the past year.

59% of organizations said the tools they use to detect and prevent API attacks are only somewhat effective.

16% of organizations identify enabling AI agents or other autonomous systems as a main driver behind the use of APIs.

Only 23% of organizations rated the tools they use to detect and prevent API attacks as very effective.

6% of respondents identified that their company's API program is too cumbersome and slows down delivery.

51% of developers worry about unauthorized or excessive API calls from AI agents, making it their number one security concern.

3% of organizations rated the tools they use to detect and prevent API attacks as not effective at all.

2% of attack attempts target internal-facing API endpoints.

6% of organizations do not know how effective their existing security tools are in preventing API attacks.

2% of organizations use other methods to assess the effectiveness of their API security measures.

5% of organizations reported that GenAI is not a concern at all for API security.

13% of organizations reported using GenAI for all API development.

49% of organizations are using GenAI for some API development.

8% of organizations conduct incident response analysis to assess the effectiveness of their API security measures.

23% of organizations plan to adopt GenAI within the next 6–12 months for API development.

45% of respondents cited the potential for new API vulnerabilities tied to AI-generated code.

47% of respondents cited difficulty understanding and securing AI-generated code.

65% of organizations generate revenue from their API programs.

56% of respondents cited a lack of control over AI model security used for code generation.