Asking if APIs are secure is like asking if web applications are secure. So, the easy answer is it completely depends on the implementation and life cycle management.
APIs can be secure, but due to the quantity and complexity of APIs, it’s easy to have security gaps. Like many other facets of cybersecurity, the API defenders must get defense right every time, while an attacker only needs one weakness for a successful compromise.
An organization can have dozens, hundreds, and even thousands of APIs connecting internal applications to each other and the outside world. APIs can provide a direct gateway from the outside to an organization's critical data and applications if they aren’t properly secured.
The problem is API adoption tends to exceed the rate at which organizations can secure and manage them.
Over the years, an organization may have done a lot of work adding firewalls, segmentation, vulnerability management programs, and more, but if an organization has insecure APIs, then an attacker could evade many typical security measures. An insecure API exposed to the internet could lead to a serious compromise.
If you don’t properly manage the security of your APIs, it could be a recipe for disaster and pave the way for a major security breach.