The report findings show visibility of API inventories has improved. Nearly three-quarters (72%) of cybersecurity professionals have full API inventories, but of those, 40% have visibility into which return sensitive data. This represents a year-on-year increase (67%) of those that had a complete inventory in 2022.

Over two-thirds of U.S. respondents (69%) admitted they had experienced an API security incident in the last 12 months, down from 77% in 2022, whereas 85% of U.K. respondents said they suffered an incident in the last 12 months, a 10% year-on-year increase from the year prior.

Between 73% and 84% of C-suite and senior security professionals said they had experienced an incident in the last 12 months, and 48% of AppSec professionals said the same. This disparity extends to the top security attack vectors for APIs, with 64% of AppSec teams citing web application firewalls as the top attack vector for APIs, with more of a spread across other job functions.

Other key findings include:

• 81% of respondents stated that API security is more of a priority now than it was 12 months ago.
• 51% cited loss of customer goodwill and churned accounts as the biggest impact of an API security incident.
• 48% cited fees incurred to help fix the issues, and similarly, 48% said loss of productivity was the biggest impact.
• 53% now view API security as a necessary requirement for their business.
• 53% say their developers spend between 26% and 50% of their time on refactoring and remediation.

Read the full report here.