API Security Statistics: Attack Volumes, Incident Rates and Shadow API Data

APIs now carry most application traffic and a growing share of attacks, but the statistics quoted about them are often years old or come from roundup pages that have lost their source. This page collects API security figures from the publishers' own reports: API share of traffic, incident rates, attack growth, bot attacks on APIs, shadow and undocumented endpoints, and the new exposure created by AI agents and MCP servers. Every figure carries the report, the publisher and the year or data period, and most of these reports come from vendors that sell API or bot protection, so the caveats section explains how to use them. The overview of controls is in the API Security Guide. It is written for application security leads, API platform owners and executives sizing API risk. Last reviewed: November 2026.

Key takeaways

• API incidents are close to universal. Akamai's 2026 Apps, APIs and DDoS State of the Internet report finds 87% of surveyed organisations reported an API-related security incident in 2025.
• Attack volume is climbing fast. The same Akamai 2026 report finds the average number of daily API attacks rose 113% year over year.
• Attackers arrive authenticated. Salt Security's H2 2026 State of AI and API Security report finds 95.8% of attack attempts analysed by Salt Labs came from authenticated sources, which is why authorisation flaws such as BOLA matter more than missing login checks.
• Bots go after APIs directly. The 2026 Thales Bad Bot Report finds 27% of bot attacks targeted APIs, in a year when bots made up more than 53% of web traffic.
• Organisations undercount their APIs. Cloudflare's 2024 API Security and Management Report found machine learning discovered about 31% more API endpoints than customers had self-reported, and AI agent tooling is now adding a new shadow layer.

Headline statistics

Figures are from the latest edition we could read on each publisher's own site in November 2026.

API traffic share and automation

• Share of traffic: Cloudflare's 2024 API Security and Management Report, based on aggregated traffic from 1 October 2022 to 31 August 2023, found APIs make up 57% of internet traffic. It is the most quoted API traffic figure, and it is now more than three years old: quote it with its data period.
• Automated clients: the Cloudflare Radar 2025 Year in Review, published on 15 December 2025, reports that one fifth of automated API requests were made by Go-based clients, a reminder that most API traffic is machine to machine and authenticated with keys, tokens or certificates rather than user logins.
• Bots overall: the 2026 Thales Bad Bot Report, based on full-year 2025 bot activity observed by Thales Threat Research, found bots made up more than 53% of web traffic in 2025, up from 51%, with humans at 47%.
• Rate limiting in practice: Cloudflare 2024 found 51.6% of API errors were HTTP 429 Too Many Requests responses, and 33% of API mitigations involved blocking DDoS attacks. Rate limiting is the most visible API control in production traffic. See the OWASP API Top 10 API4 Unrestricted Resource Consumption Guide.

Incident rates and attack growth

Akamai published the 2026 SOTI on 17 March 2026. Its press release does not state the survey sample size behind the 87% figure, so treat it as a strong directional signal rather than a population estimate. Layer 7 DDoS and API abuse overlap: many application layer floods target API endpoints because they are expensive for the server to answer. The DDoS Attack Statistics page covers volumetric trends.

Authenticated attacks and authorisation flaws

• Authenticated sources: Salt Security's H2 2026 report finds 95.8% of attack attempts analysed by Salt Labs originated from authenticated sources. An attacker with a valid session or API key, often a legitimate customer account, then tests what else the API will return.
• Bots look legitimate: the 2026 Thales Bad Bot Report says API-directed bot attacks often look legitimate because they use valid authentication and well-formed requests, which defeats checks that only validate syntax.
• Account takeover: Thales 2026 reports financial services accounted for 46% of account takeover incidents. Login and token endpoints are APIs, so credential stuffing (ATT&CK T1110 Brute Force) is largely an API problem.
• What OWASP ranks first: the OWASP API Security Top 10 2023 lists API1 Broken Object Level Authorization, API2 Broken Authentication and API3 Broken Object Property Level Authorization as the top three risks. The authenticated attack data explains why: once authentication passes, object and property level checks are the only barrier. See the OWASP API Top 10 API1 Broken Object Level Authorization Guide.

Shadow APIs, inventory and AI agents

Shadow APIs are endpoints that run in production without being in the inventory, gateway or security testing scope. The Cloudflare discovery figure measures the gap between what customers declared and what traffic analysis found. MCP servers are a new class of API that exposes tools to AI agents, and the Salt figures show they are spreading faster than governance. See the OWASP API Top 10 API9 Improper Inventory Management Guide for inventory practice.

API breach examples

Statistics show scale; incidents show mechanism. Two cases from the NHI Mgmt Group breach database illustrate the patterns behind the numbers.

• Abused production API: in the T-Mobile API Breach 2023, a bad actor called a single customer API without permission from around 25 November 2022 until detection on 5 January 2023, returning records for about 37 million accounts. About six weeks passed between first access and detection, the kind of gap API traffic monitoring is meant to close.
• Unauthenticated endpoints: in the McKinsey AI Platform Hack 2026, a research disclosure, 22 of more than 200 documented endpoints required no authentication, and one was vulnerable to SQL injection chained with an object reference flaw. The flaw was patched a day after disclosure; McKinsey's forensic review found no evidence of client data access.
• Keys as the credential: most API access uses API keys and tokens, which is why leaked keys feature heavily in the breach database. See the Non-Human Identity and Secrets Statistics Guide.

What the numbers mean for defenders

• Treat API clients as identities: every API key, OAuth client and service account calling your APIs is a non-human identity that needs an owner, scope and rotation. See the API Key Management Guide.
• Measure your own baseline: count endpoints in production against endpoints in the inventory, and the share of endpoints with authorisation tests. These are more useful than any industry figure.

Methodology notes and caveats

• Vendor data: Akamai, Cloudflare, Salt Security and Thales sell API, bot or DDoS protection. Traffic figures describe their customers' traffic, not the whole internet; survey figures come from commissioned samples whose size is not always published.
• Traffic versus survey: the 113% attack growth and 27% bot figures are measured from traffic; the 87% incident figure and the AI agent figures are survey responses. Do not combine them into a single rate.
• Definitions vary: "API attack", "API incident" and "shadow API" have no common definition across vendors. Quote each with its source.
• Age: the Cloudflare 57% traffic figure covers data to August 2023. Check for a newer edition before quoting it in a current business case.

Practitioner checklist

• Run traffic based API discovery and reconcile it with the gateway and specification inventory every month.
• Test object, property and function level authorisation for every endpoint, using two authenticated test users.
• Inventory MCP servers and agent-facing APIs alongside public and partner APIs.
• Apply rate limits per client identity, not only per IP address, on login, token and high cost endpoints.
• Assign an owner, scope and rotation schedule to every API key and OAuth client.
• Baseline normal call volume per client and alert on unusual enumeration or data volume.
• Track the number of endpoints without authentication and drive it to only those intentionally public.
• Record the edition and data period for every API statistic you quote internally, and refresh them yearly.

Standards and references

• OWASP: API Security Top 10 2023
• Akamai: 2026 Apps, APIs and DDoS State of the Internet report
• Thales: 2026 Bad Bot Report
• Salt Security: State of AI and API Security, H2 2026
• Cloudflare: 2024 API Security and Management Report
• Cloudflare: Radar 2025 Year in Review
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: API Security Guide · Application Security Statistics Guide · API Gateway Security Guide · Identity Attack Statistics Guide · Top 10 Automated Bot Attacks