Key Findings from the State of API Security 2026
Broken Input Validation dominates API risk (28%)
The single largest category of vulnerabilities, including injection attacks, mass assignment, and path traversal, highlighting APIs as a primary conduit for malicious input into backend systems.
Authorization failures remain a leading cause of breaches
Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA) continue to expose sensitive resources and privileged operations, confirming authorization as one of the most difficult API security challenges to implement correctly.
Missing Authentication accounts for 17% of reported vulnerabilities
The most frequently reported single vulnerability in 2025, driven by APIs that fail to enforce authentication server-side and instead rely on frontend or client-side controls.
Strong alignment with OWASP Top API Risks
Four of the most prevalent real-world vulnerabilities directly map to four of the top five OWASP API Security Risks, validating the relevance of OWASP guidance against production data.
The "trusted client" assumption is still widespread
Nearly 20% of analyzed cases showed APIs relying on client applications to enforce security, leaving APIs exposed when accessed directly by attackers.
Few confirmed exploits of shadow or undocumented APIs
Despite heavy industry focus on API discovery, the report found little evidence that unmanaged or undocumented APIs are a primary driver of real-world breaches compared to weaknesses in known, documented APIs.
Commenting on the publication of the report, Hugh Carroll, CMO with 42Crunch, said "This study sheds light on how everyday API implementation mistakes can turn into real-world security incidents. The research reviewed over 200 vulnerabilities and offers valuable guidance on how security and development teams can prevent these problems occurring in the first place. Furthermore, it highlights how in an increasingly AI-driven world, predictability should become a security control designed in from the beginning, and APIs must be governed by deterministic guardrails, otherwise, agentic AI systems will find and operationalize weaknesses faster than organizations can respond."
APIs, AI, and a Changing Risk Model
The report also highlights the critical shift in API risk as AI agents and LLM-powered systems become first-class API consumers. Unlike traditional applications, AI agents adapt their behavior based on API responses, probe boundaries, and infer undocumented capabilities. This dramatically increases the likelihood that long-standing, latent API vulnerabilities—often present in production for months or years—will be discovered and exploited automatically.
Readers gain actionable insights into the scenarios most likely to expose sensitive data, enabling them to prioritize defenses and governance across their API landscape. Get a copy of the report here
