New research has found that vulnerable APIs and bot attacks are costing Australian businesses up to AUD2.95 billion annually.
Thales has released a report titled The Economic Impact of API and Bot Attacks, which analysed over 161,000 unique cybersecurity incidents and estimates that API insecurity and automated abuse by bots are responsible for as many as one in four cybersecurity incidents in Australia.
The report, conducted by the Marsh McLennan Cyber Risk Intelligence Center, uncovers the rising global costs of vulnerable or insecure APIs and automated abuse by bots – two security threats that are increasingly interconnected and prevalent.
In 2023, Asia Pacific and Japan accounted for 17.7% of global API and bot-related security incidents, leading to over AUD24.4 billion in business losses. The region saw the highest rate of API-related attacks at 14%, and 24% of attacks were bot-related, the second highest globally after Africa.
Globally, the report found that larger organisations are statistically more likely to have a higher percentage of security incidents that involve both insecure APIs and bot attacks. Enterprises with revenues of more than USD1 billion were two to three times more likely to experience automated API abuse by bots than small or mid-size businesses. The study suggests large companies are particularly vulnerable to security risks associated with automated API abuse by bots because of complex and widespread API ecosystems.
Enterprises rely heavily on APIs to enable communication between diverse applications and services. Data from the Thales-owned Imperva Threat Research finds that the average enterprise managed 613 API endpoints in production last year. That number is growing rapidly as businesses face mounting pressure to deliver digital services with greater agility and efficiency.
In 2023, automated threats accounted for 30% of all global API attacks, according to the Imperva data. Today, automated API abuse by bots costs organisations up to AUD26.3 billion annually. As the number of APIs in production multiplies, cybercriminals will increasingly use automated bots to find and exploit API business logic, circumvent security measures, and exfiltrate sensitive data.
“Many businesses across Asia Pacific and Japan are unaware that undesirable bot traffic is impacting their bottom line by targeting their applications, APIs, and infrastructure,” said Imperva’s Reinhart Hansen. “Business leaders can’t manage this risk if they’re unaware of it or don’t fully understand it.”
“The same can also be said about lack of visibility across an organisation’s API endpoint assets and the data they exchange, internally, publicly, and directly with third parties. Without an accurate and continuously updated API endpoint inventory and security assessment, organisations remain open to significant security risks, such as large-scale data loss and exfiltration.”
Key Global Trends identified in The Economic Impact of API and Bot Attacks report include;
Increased API adoption and usage is growing the attack surface: The rapid adoption of APIs, inexperience of many API developers, and lack of collaboration between security and development teams means insecure APIs are resuting in losses of up to AUD127.8 billion annually, an AUD17.6 billion increase from 2021.
Bots negatively impact organisation’s bottom line: The widespread availability of attack tools and generative AI models has enhanced bot evasion techniques and enabled even low-skilled attackers to launch sophisticated bot attacks. Up to AUD170 billion of losses annually can be attributed to automated attacks by bots.
API and bot-related security incidents are becoming more frequent: In 2022, API-related security incidents rose by 40%, and bot-related security incidents spiked by 88%. These increases were fuelled by a rise in digital transactions, the expanding use of APIs, and geopolitical tensions. In the following year, as digital traffic began to stabilise and the pandemic-driven surge in internet activity subsided, the frequency of these incidents moderated. API-related security incidents grew by 9%, while bot-related security incidents jumped by 28%. The overall upward trend in attacks highlights the growing persistence and frequency of these threats.
Insecure APIs and bot attacks pose a significant threat to large enterprises: Companies with revenue of at least AUD145 billion are most likely to suffer security incidents related to insecure APIs or bot attacks. These threats constitute up to 26% of all security incidents experienced by such businesses.
Countries around the globe are vulnerable to API and bot attacks: Brazil experienced the highest percentage of events related to insecure APIs or bot attacks, with the threats accounting for up to 32% of all observed security incidents. This was closely followed by France (up to 28%), Japan (up to 28%), and India (up to 26%). While the percentage of events attributed to API and bot-related security incidents was lower in the United States, 66% of all reported events related to vulnerable APIs or automated abuse by bots occurred within the country.
“API ecosystems will continue to grow exponentially, driving connections to generative AI applications and large language models,” adds Hansen. “In parallel, cybercriminals will leverage emerging technologies to create sophisticated bots at an accelerated and alarming pace. Business leaders should take proactive measures to assess and interpret the potential risk to their bottom line and adopt a holistic solution that covers the entire application landscape without impacting end-user experience.”
You can read the full report here.
