The FireTail API Data Breach Tracker shows a rise in API security incidents, increasing from 22 in 2023 to 26 in 2024.

Cumulatively, over 1.6 billion records have been exposed since 2017 due to API breaches.

In the last three years, there have been 79 documented API breaches, significantly more than the 22 cloud-related breaches in the same period, indicating APIs are a growing focal point for attackers.

Despite the rise in API security incidents, the number of breaches dropped from 18 to 93.

A vulnerability in the Irish Government COVID-19 Vaccination Portal, present since December 2021, was disclosed in March 2024 and exposed the vaccination records of approximately one million residents.

The mean number of warnings per OpenAPI specification significantly increased, from an average of 215 warnings per spec in 2023 to 1,078 warnings per spec in 2025. Unrestricted String and Array Lengths emerged as the most common warning type.

MIT's AI Risk Repository identifies over 1000+ risks from an academic perspective.

97% of organizations believe AI introduces unique security challenges.

Approximately 70% of AI data breaches have no secondary breach vector, deviating from typical multi-vector API breaches.

Approximately 9% of API traffic from Russia, China, and Iran was flagged as bot activity, particularly in January, November, and December 2024.

Nearly 60% of organizations report inadequate visibility into the APIs supporting their AI systems.

TracFone Wireless faced a $16 million settlement and a comprehensive consent decree due to API vulnerabilities that exposed customer data.

In the US, the percentage of phishing emails accepted dropped from 68.8% in 2023 to just 14.2% in 2025 following strict DMARC mandates.

92% of the world's top email domains are reported to remain unprotected against phishing and spoofing.

Among domains with DMARC records, over 40% fail to include reporting mechanisms like RUA tags.

Only 7.7% of the world’s top 1.8 million email domains are fully protected against phishing and spoofing by having implemented the most stringent DMARC policy, 'p=reject'1.

More than half (52.2%) of the domains analysed in the report still lack even a basic DMARC record.

Over 96% of manufacturing respondents have plans to incorporate AI into remote access security.

37% of organizations are utilizing over 50 cybersecurity tools.

58% of CISOs and cybersecurity executives say it is difficult to articulate their value beyond risk mitigation.