The global API security market reached $2.85 billion as APIs account for 83.0% of all internet web traffic, 78.0% of enterprises suffered an API security incident in the past year, BOLA causes 46.0% of API breaches, and 82.0% of API exploits bypass traditional WAFs. While malicious API traffic surged +168% and 34% of production endpoints are uncataloged Zombie APIs, 12.8 million API keys leaked on GitHub and the average API breach costs $3.42 million. The figures below come from empirical research published by Gartner, Cloudflare, Salt Security, OWASP Foundation, Postman, and GitGuardian.
TL;DR
- The global API security software, API gateway protection, and runtime mitigation market reached $2.85 billion (Gartner)
- 83.0% of total global internet web traffic consists of API requests between applications and microservices (Cloudflare)
- 78.0% of enterprise organizations experienced an API-related security incident or data leak in the past 12 months
- Malicious API attack traffic surged +168.0% year-over-year across e-commerce, fintech, and SaaS platforms (Imperva)
- Broken Object Level Authorization (BOLA / IDOR) causes 46.0% of all successful API data breach incidents (OWASP)
- 34.0% of active enterprise production APIs are unmanaged, undocumented Zombie or Shadow APIs (Postman)
- Enterprises maintain an average catalog of 612 distinct internal, public, and partner microservice APIs
- 58.0% of software developers acknowledge that production API endpoints deviate from written Swagger / OpenAPI specs
- 82.0% of malicious API business logic exploits successfully bypass traditional signature-based Web Application Firewalls
- Over 12.8 million valid corporate API tokens, JWT keys, and cloud secrets were leaked in public GitHub commits (GitGuardian)
- 54.0% of all API traffic directed at e-commerce login and inventory endpoints is generated by automated bots
- 42.0% of production GraphQL APIs lack depth-limiting query protection against nested Denial-of-Service loops
- An enterprise customer data breach resulting from an exploited API vulnerability incurs an average cost of $3.42 million
1. Market Sizing: $2.85B Industry and 83% Internet Traffic APIs
Microservice decoupling and mobile-first architectures have converted the modern internet into a massive mesh of machine-to-machine API calls. Cloudflare logs 83.0% of web traffic as APIs.
Market expansion: the API security sector reached $2.85 billion (+28.4% CAGR, Gartner), driven by urgent enterprise requirements for runtime JSON transaction inspection.
| Metric | Value | Source |
|---|---|---|
| Global API security software, API gateway protection, and runtime threat mitigation market valuation | $2.85 Billion global API security market valuation | Gartner / IDC / MarketsandMarkets |
| Share of global web application internet traffic represented by Application Programming Interface (API) calls (REST, GraphQL, gRPC) | 83.0% of total internet web traffic consists of API requests | Cloudflare Radar / Akamai State of the Internet |
| Annual growth rate of specialized API discovery and runtime behavioral security platforms | +28.4% compound annual growth rate (CAGR) | Gartner Emerging Tech: API Security Report |
Cloud security posture and microservice infrastructure connect to our cloud security posture statistics. Source: Gartner Research.
2. Incident Surge & The BOLA Epidemic: 78% Incident Rate and 46% BOLA
Flawed authorization checks allow authenticated users to view unauthorized database records by modifying URL parameter integers. BOLA causes 46.0% of API breaches.
Attack volume: 78.0% of enterprises suffered API incidents (Salt Security), as malicious API attack traffic surged +168.0% YoY across public endpoints (Imperva).
| Metric | Value | Source |
|---|---|---|
| Enterprise API security incidents: share of organizations that experienced an API security incident or data breach in the past 12 months | 78.0% of enterprises experienced an API-related security incident in the past year | Salt Security State of API Security Report |
| Increase in API attack traffic: annual growth rate in malicious API scrape, credential stuffing, and logic exploit attempts | +168.0% year-over-year surge in malicious API attack traffic | Imperva Threat Research / Salt Labs |
| Top OWASP API vulnerability: share of API security incidents caused by Broken Object Level Authorization / BOLA (OWASP API1:2023) | 46.0% of all API data breach incidents stem from BOLA vulnerabilities | OWASP API Security Top 10 / Noname Security |
Data breach forensics and identity exploitation connect to our data breach statistics. Source: Salt Security State of API Security.
3. Zombie APIs & Documentation Drift: 34% Shadow APIs and 612 Enterprise APIs
Fast sprint cycles frequently leave deprecated testing endpoints and staging microservices exposed to the open internet. 34.0% of production APIs are Zombie APIs.
Scale and drift: enterprises average 612 active APIs (Postman), with 58.0% of development teams admitting live code has drifted from Swagger documentation.
| Metric | Value | Source |
|---|---|---|
| Zombie and Shadow APIs: enterprise APIs active in production that are uncataloged, unmonitored, or undocumented by security teams | 34.0% of all production enterprise APIs are unmanaged Zombie or Shadow APIs | Postman State of the API Report / Curity |
| Average number of APIs per enterprise: distinct internal, public, and third-party partner APIs managed across enterprise infrastructure | 612 average active APIs maintained per enterprise organization | Postman Annual API Census / MuleSoft |
| API documentation accuracy: development teams admitting their OpenAPI / Swagger documentation is out of sync with production code | 58.0% of developers acknowledge production APIs deviate from written Swagger specs | SmartBear State of Software Quality |
Common Vulnerabilities and Exposures remediation connect to our cve vulnerability statistics. Source: Postman State of the API.
4. WAF Blind Spots & Secrets Sprawl: 82% WAF Bypass and 12.8M Leaked Keys
Because logic manipulation uses syntactically valid JSON payloads, traditional regex firewalls remain completely blind. 82.0% of API attacks bypass legacy WAFs.
Secrets exposure: GitGuardian detected 12.8 million leaked API tokens on public GitHub commits, while automated bots generate 54.0% of e-commerce API traffic.
| Metric | Value | Source |
|---|---|---|
| WAF limitations: traditional Web Application Firewalls (WAFs) and API gateways that fail to detect business logic API attacks | 82.0% of malicious API logic exploits bypass traditional signature-based WAFs | Gartner Magic Quadrant for WAAP |
| API key and token exposure: public GitHub repositories accidentally leaking active corporate API keys, JWT tokens, and cloud secrets | 12.8 Million corporate API secrets and tokens detected in public GitHub commits in 2025/2026 | GitGuardian State of Secrets Sprawl Report |
| Bot and automated scraping attacks: share of API traffic directed at e-commerce login, ticketing, and pricing endpoints generated by bots | 54.0% of all e-commerce API requests are automated bot traffic | Cloudflare Web Traffic Telemetry |
Bot traffic identification and malicious automation connect to our bot traffic statistics. Source: GitGuardian State of Secrets Sprawl.
5. GraphQL Risks & CI/CD Shift-Left: 42% Query Loops and 38-Day Patch Times
Arbitrary nested object queries in GraphQL can trigger massive relational database joins that exhaust backend compute. 42.0% of GraphQL endpoints lack query limits.
Remediation velocity: fixing reported API vulnerabilities requires 38.0 days (Salt Security), with 44.0% of teams embedding automated DAST scanning in CI/CD pipelines.
| Metric | Value | Source |
|---|---|---|
| GraphQL vulnerability exposure: public GraphQL endpoints vulnerable to nested query Denial-of-Service (DoS) and excessive data introspection | 42.0% of production GraphQL APIs lack depth-limiting query protection | Escape GraphQL Security Report / Wallarm |
| Time to patch API vulnerabilities: average duration required for software development teams to remediate a reported API security flaw | 38.0 days average time required to patch an enterprise API vulnerability | Salt Security State of API Security |
| Shift-left API security testing: organizations integrating automated API security scanning (DAST, SAST) into CI/CD build pipelines | 44.0% of development teams enforce automated API security testing in CI/CD | Checkmarx AppSec Benchmark |
Software supply chain vulnerabilities and dependencies connect to our supply chain attack statistics. Source: Escape GraphQL Security.
6. Breach Economics & Governance: $3.42M Breach Cost and 62% Blind Spots
Exfiltrating structured records directly via API endpoints allows threat actors to steal millions of customer records without touching host filesystems. API breaches average $3.42 million.
Executive visibility: 62.0% of security leaders lack visibility into newly deployed microservice APIs (ESG), while Broken Function Level Authorization drives 24.0% of breaches.
| Metric | Value | Source |
|---|---|---|
| Broken Function Level Authorization (BFLA): incidents where unprivileged users access administrative endpoints (OWASP API5:2023) | 24.0% of API breaches exploit Broken Function Level Authorization | OWASP Foundation Security Census |
| Cost of an API data breach: average financial loss incurred by enterprises following a major customer data exfiltration via API | $3.42 Million average cost of an enterprise API-driven data breach | Ponemon Institute / Salt Security Study |
| API governance ownership: CISOs reporting that security teams lack visibility into which development teams deploy new public APIs | 62.0% of security leaders report inadequate visibility into newly deployed microservice APIs | Enterprise Strategy Group (ESG) Survey |
Summary: API Security by the Numbers
| Metric | Value | Primary Source |
|---|---|---|
| Global API security market valuation | $2.85 Billion | Gartner / IDC / MarketsandMarkets |
| Internet web traffic represented by API calls | 83.0% of internet traffic | Cloudflare / Akamai |
| API security software market CAGR | +28.4% CAGR | Gartner Emerging Tech |
| Enterprises experiencing an API incident in past year | 78.0% of enterprises | Salt Security State of API |
| Surge in malicious API attack traffic YoY | +168.0% YoY attack surge | Imperva Threat Research |
| API breaches caused by BOLA vulnerabilities | 46.0% of API breaches | OWASP API Top 10 |
| Production APIs that are uncataloged Zombie APIs | 34.0% Zombie/Shadow APIs | Postman State of API |
| Average active APIs per enterprise organization | 612 APIs / enterprise | Postman / MuleSoft Census |
| Developers admitting Swagger docs are outdated | 58.0% out of sync | SmartBear Software Quality |
| API logic exploits bypassing traditional WAFs | 82.0% bypass legacy WAFs | Gartner WAAP Magic Quadrant |
| API secrets leaked in public GitHub commits | 12.8 Million secrets | GitGuardian Secrets Sprawl |
| E-commerce API traffic generated by bots | 54.0% bot traffic | Cloudflare Radar Telemetry |
| GraphQL endpoints lacking query depth limits | 42.0% of GraphQL APIs | Escape Security Report |
| Average time to patch an API vulnerability | 38.0 days to remediate | Salt Security Benchmarks |
| Average cost of an enterprise API data breach | $3.42 Million / breach | Ponemon / Salt Security |
Methodology and Sources
The statistics in this report were compiled from market sizing digests and WAAP Magic Quadrants from Gartner and IDC, global internet traffic telemetry from Cloudflare Radar and Akamai, empirical vulnerability analyses from Salt Security and OWASP Foundation, developer ecosystem surveys from Postman, MuleSoft, and SmartBear, and secrets sprawl metrics from GitGuardian and Ponemon Institute.
-
Gartner & IDC: Emerging Technology: API Security, WAAP Magic Quadrant, and Market Forecasts ($2.85B market, 82% WAF bypass, +28.4% CAGR).
-
Cloudflare & Akamai: State of the Internet: API Traffic Volume, Bot Scraping, and DDoS Resilience (83% of internet traffic is APIs, 54% e-commerce bots).
-
Salt Security & OWASP Foundation: State of API Security Report, BOLA Exploits, and OWASP API Top 10 (78% experienced incidents, 46% BOLA share, +168% attacks).
-
Postman & MuleSoft: State of the API Report: Shadow APIs, Swagger Documentation, and Enterprise API Count (612 avg APIs, 34% shadow APIs, 58% outdated docs).
-
GitGuardian & Ponemon Institute: State of Secrets Sprawl and Cost of API Data Breaches (12.8M leaked tokens on GitHub, $3.42M avg API breach cost).
-
Data watch: API security statistics reflect dedicated API threat protection platforms, API discovery tools, runtime behavioural analyzers, and API gateway security modules. Standard network DDoS layer-3/4 filtering is categorized separately.
-
Last updated: August 2026. This roundup is updated quarterly as OWASP API updates, Salt Security telemetry digests, and Postman developer reports are published.