The State of API  Security and Management
Application programming interfaces (APIs) drive new app
experiences — from tracking health data to personalizing
online gaming. They also fuel countless businessadvantages: customer analytics, SaaS integrations,generative AI capabilities, and more.

At the same time, APIs are complex to manage andconstantly under attack. Take a look at security andmanagement trends in API traffic — which now comprises
more than half (57%) of all dynamic Internet traffic*.

30.7%

Nearly 31% more API REST endpoints werediscovered through machine learning than throughcustomer-provided session identifiers

An API-centric world

id al-Adha

id al-Fitr

EE

asterECaselineB

New yearhristmas Day

Growth vs baseline

As a whole, total API traffic throughout the world grew steadily throughout 2023.

Time

op 10 industries with the highest share of API trafficout of their overall web traffic:Tonsumer Electronic
Financial Softwar
Security and Investigation
Banking, Financial Services & Insuranc
Medical Devices

IoT Community Platform
Rail, Bus & Tax
Legal Service
Multimedia, Games & Graphic Softwar
Logistics, Supply Chain & Transportation

C

Unprotected APIs
Organizations that lack a comprehensive
API inventory risk having ‘shadow APIs’ —essentially hidden attack surfaces:

59.2%

Providing API ‘write’ access to the wrong
person can lead to security risks. Many
(59.2%) organizations permit ‘write’ access(the ability to push updates) to at least halfof their APIs.

15,000+More than 15,000 accounts using
Cloudflare had API endpoints discovered
through machine learning methods only

Common API vulnerabilities

Market demand for API security and management has skyrocketed inparallel to the growth of API traffic, errors, and attacks.
1 threat toward APIs

#HTTP anomalies — the most frequent threat toward APIs — arecommon signals of malicious API requests.

1 API traffic error#More than half (51.6%) of traffic errors from API origins comprised‘429’ error codes: “Too Many Requests.”

1 mitigation method#One-third of API mitigations comprised blocking Distributed
Denial of Service (DDoS) attacks

The challenge of protecting
APIs vs. web appss.

v

A web application

An APIIs visible to the end user

Is invisible to the app user

Is accessed by end users
through a web browser

ets systems and apps
exchange dataL

Visualizes data from thebackend (using HTML, CSS,and JavaScript) with varied

Transports data by accessing
servers and applications using
a defined format (mostcommonly RESTful JSON,gRPC, XML, GraphQL).

Is typically protected through a“negative security ” model thatblocks known malicious traffic.

Is more effectively protected
through a “positive security”
model that only allows
validated, authenticated traffic.

user interactions.

ey ways to defend APIs

3 k

Move toward a “positive security” model vs.
“negative security ”
In a positive security model, you only accept “known good” API traffic(as defined by API schemas). This is more effective than negativesecurity, which focuses only on restricting “known bad” API traffic.

Apply machine learning to free up resources andreduce costs
Machine learning can uncover all API traffic (including attackvariations), differentiate between legitimate traffic spikes vs.  
malicious bot traffic, and manage other resource-intensive API
management tasks.

Unify app development, visibility, performance,and security

A connectivity cloud — which enables any-to-any connectivity
between networks, clouds, apps, and users — provides criticalconnective tissue between app development and API defense-indepth services.

Want to learn more?

Read Report

Access Cloudflare’s full 2024 API
Security and Management Report*The data findings throughout this infographic are based on aggregatedtraffic patterns observed by Cloudflare’s global network (including Cloudflare’s
web application firewall, DDoS protection, bot management, and API gatewayservices) between Oct. 1, 2022 and Aug. 31, 2023.

© 2024 Cloudflare, Inc.