Salt Security

90% of security leaders have active concerns about security risks introduced by AI-generated code.

38% of organizations still rely primarily on manual review for AI-generated code.

15% of security leaders cite misalignment with internal security policies as a major concern with AI-generated code.

66% of organizations report API growth of more than 50% in the past year

24% of organizations have a fully automated API inventory

32% of organizations experienced an API security incident in the past year

25% of organizations said APIs are used to create new revenue streams.

A small but notable 6% of organizations indicated their API volume more than tripled (301%+) in just 12 months.

41% of organizations cited vulnerabilities as the most common API security problem.

Just 37% of organisations have a data privacy team overseeing AI initiatives.

19% of organisations deploy between 21 and 50 types of AI agents.

7% of organisations assess API risk monthly or less.

95% of API attacks originated from authenticated sources, and 98% of attack attempts targeted external-facing APIs.

37% have deployed specialised AI security tools, and 40% are deploying code reviews and security testing.

37% evaluate improvements to compliance posture for evaluating API security effectiveness, 25% measure ROI through cost savings achieved by preventing security breaches, and 16% measure reductions in API-related security incidents to measure program success.

29% of security leaders identify insecure coding patterns as the leading risk introduced by AI coding assistants.

67% of organizations report that AI coding assistants are now widely adopted across development teams.

Nearly 90% of organizations are already using or planning to use GenAI in API development

18% of boards and executive teams are extremely confident in their ability to detect API attacks leveraging Generative AI

65% of API attacks exploit Security Misconfiguration (OWASP API8)

79% of boards and executive teams have increased scrutiny of AI security risks

8% of organizations report advanced API security maturity

92% of organizations lack the advanced security maturity required to defend agentic AI environments

99% of API attack attempts originate from authenticated sources

47% of organizations have delayed production releases due to API security concerns

39% of organizations adhere to the NIST Cybersecurity Framework for API development and deployment.

56% of organizations perceive GenAI as a growing security concern for APIs.

45% of organizations identify digital transformation initiatives as a main driver behind the use of APIs.

45% of organizations pointed to digital transformation initiatives as a primary driver for modernizing legacy systems and accelerating new services.

50% of security leaders have slowed a new application rollout due to API security concerns.

14% of organizations oversee 1,001 or more APIs.

41% of organizations reported API growth of 51–100% over the past year.

33% of organizations flagged authentication problems as the most common API security problem.

17% of organizations were 'not very confident' in the accuracy of their API inventories.

14% of respondents identified that their company's API program is out of control or hard to manage.

30% of organizations are in the planning stage for their API security programs.

7% of respondents pointed to time constraints as the primary barrier to implementing a strong API security program.

23% of organizations identify leveraging AI/ML capabilities for business insights or automation as a main driver behind the use of APIs.

52% of organizations identify development efficiencies and/or standardization as a main driver behind the use of APIs.

15% of organizations admitted they do not know which APIs expose PII.

61% of all organizations reported modest increases (≤15%) in their API security budgets.

21% of organizations have basic API security programs focused on risk assessments or manual reviews.

10% of organizations raised their API security budgets by 0–5%.

11% of organizations adhere to NIS2 for API development and deployment.

25% of organizations said they were 'not very' or 'not at all confident' in the accuracy of their API inventories.

36% of organizations say GenAI is somewhat concerning for API security.

4% of organizations do not perform or have no formal assessment of their API security measures.

18% of organizations perform security audits to assess the effectiveness of their API security measures.

42% of organizations conduct code reviews and security testing.

13% of organizations experienced explosive API growth of 101–200%.