F5 report unveils 'scary' truths about API Security in the AI era

F5’s 2024 State of Application Strategy report: API Security reveals gaps in API protection and urgent need for comprehensive security measures.

  • Tuesday, 15th October 2024 Posted 10 months ago in by Phil Alsop

F5 has published the findings of its 2024 State of Application Strategy Report: API Security, revealing concerning truths about the current state of API security across industries. The report highlights significant gaps in API protection, exposing them to potential threats that could jeopardise enterprise security and operations. These challenges are magnified by the rapid proliferation of APIs in today’s digital landscape.

The survey found that less than 70% of customer-facing APIs are secured using HTTPS (Hypertext Transfer Protocol Secure), leaving nearly one-third of these APIs completely unprotected. This is a stark contrast to the 90% of web pages that are now accessed via HTTPS, following the push for secure web communications over the past decade.

“APIs are becoming the backbone of digital transformation efforts, connecting critical services and applications across organisations,” said Lori MacVittie, Distinguished Engineer at F5. “However, as our report indicates, many organisations are not keeping pace with the security requirements needed to protect these valuable assets, especially in the context of emerging AI-driven threats.”

Key findings of the report include:

• Rapid growth and diverse environments: The average organisation now manages 421 different APIs, with most hosted in public cloud environments. Despite this growth, a significant number of APIs – particularly those that are customer-facing – remain unprotected.

• Evolving API uses and security needs: As APIs increasingly connect to AI services like OpenAI, the security model must adapt to cover both inbound and outbound API traffic. Current practices largely focus on inbound traffic, leaving outbound API calls vulnerable.

• Fragmented responsibility for API security: The report reveals a divided responsibility for API security within organisations, with 53% managing it under application security and 31% through API management and integration platforms. This division can lead to gaps in coverage and inconsistent security practices.

• High demand for programmable security solutions: Respondents ranked programmability as the most valuable API security capability, underscoring the need for real-time inspection and response to API traffic and threats.

Addressing the gaps in API security

To address these security gaps, the report recommends organisations adopt comprehensive security solutions that can cover the entire API lifecycle, from design through deployment. By integrating API security into both development and operational phases, organisations can better protect their digital assets against a growing array of threats.

“APIs are integral to the AI era, but they must be secured to ensure that AI and digital services can operate safely and effectively,” added MacVittie. “This report is a call to action for organisations to re-evaluate their API security strategies and take the necessary steps to protect their data and services.”

Westcon-Comstor's latest sustainability report shows significant progress in renewable energy adoption and emission cuts. The company eyes a...
Zyxel Networks introduces a PAYG billing model via its Circle platform, catering to the varying needs of MSPs and SMBs leveraging the Nebula cloud.
Nebula Global Services launches the Nebulab Verified™ Engineer Ecosystem, setting new benchmarks in engineering excellence and trust.
Abzorb launches a Mobile Masterclass to empower UK channel partners to integrate mobile as a core business offering.

Tool sprawl: The quiet culprit behind MSP burnout

Posted 3 weeks ago by Aaron Sandhu
A Heimdal study reveals how the proliferation of security tools overwhelms and exhausts North American MSPs, leading to significant operational...
StorONE's platform allows Storage Guardian to consolidate its infrastructure and boost efficiency, dramatically reducing its data centre footprint.

Securing the future: Navigating hybrid cloud challenges

Posted 4 weeks ago by Aaron Sandhu
New research indicates organisations face hurdles in securing applications across diverse cloud environments, highlighting a need for unified...
Flexera introduces a new platform for comprehensive SaaS discovery, optimisation, and control, addressing challenges such as shadow AI and fragmented...