18.9% of API-related exploits involved legacy APIs, including AJAX backends and URL parameter-based systems.

Only 11% of AI-powered APIs implemented robust security measures, such as bearer tokens with expiration times.

Less than half of the respondents (44.1% of CISOs) described the relationship between compliance and security as completely synchronized.

Almost one in ten (9.6% of CISOs) said their relationship between compliance and security is in a period of complex negotiations while 8.5% said their relationship is out of sync.

Over 50% of exploits in CISA’s Known Exploited Vulnerabilities (KEV) report were API-related in 2024, up from 20% in 2023.

API-related data breaches tripled in 2024.

Of the organisations that measure the operational cost of managing compliance, more than three quarters (75.4%) track all costs.

Of the organisations that measure the operational cost of managing compliance, 14.5% track compliance expenses.

Almost all (94.2% of CISOs) believe that continuous controls monitoring will improve both compliance and security.

57% of AI-powered APIs were externally accessible.

89% of AI-powered APIs relied on insecure authentication mechanisms, like static keys.

98.9% of AI vulnerabilities are API related.