APIs are no longer a technical side quest, with 58% of enterprise organizations reporting API use for data access and that share rising from 48% in 2018. Yet the same API momentum is colliding with risk and cost, including a $6.60 million average financial-sector breach cost in 2024 and $1.0 billion spent globally on API security tools in 2023. Let’s look at the aggregated statistics behind that tension, from adoption and management to the incidents that force teams to take observability and control seriously.
Key Takeaways
- 58% of enterprise organizations reported using some form of application programming interface (API) for data access, up from 48% in 2018
- 70% of organizations say they have at least one system with an API that is used to integrate with other systems
- 57% of organizations say they have implemented API management or are planning to do so within the next 12 months
- Average total cost for a breach in the financial sector in 2024 was $6.60 million (IBM)
- NIST estimates that the cost of implementing security controls varies, with “Security Control Implementation” guidance emphasizing that costs depend on system type and risk level (Special Publication 800-53 cost considerations)
- $1.0 billion was spent on API security tools globally in 2023 (estimate)
- $6.3 billion global API management market size in 2023 (estimate)
- $3.9 billion global iPaaS market size in 2023 (estimate)
- OWASP API Security Top 10 includes Improper Assets Management as a top risk category
- In the 2024 DBIR, 10% of breaches involved social engineering
- The U.S. CISA reported that 40% of observed intrusions involved exploitation of public-facing applications in 2023 (CISA alert analytics)
- 69% of developers used Postman at work in 2023, per the “State of API Report 2023” developer survey
- The NIST National Vulnerability Database contains 29,000+ vulnerabilities affecting web application components in 2023 (yearly total for CWE category mapping reported by NVD statistics)
- API security issues are commonly associated with Broken Access Control; in OWASP ASVS 4.0, “Access Control” verification requirements account for a substantial portion of controls (ASVS structure)
- In the 2024 AWS Well-Architected Tool (security pillar) guidance, “increased logging/monitoring coverage” is a core measurable action (AWS recommends enabling audit logging across services)
APIs power integration across enterprises, but rising breach costs and security risks are driving API security investment.
Related reading
Industry Trends
158% of enterprise organizations reported using some form of application programming interface (API) for data access, up from 48% in 2018[1]
Verified
270% of organizations say they have at least one system with an API that is used to integrate with other systems[2]
Verified
357% of organizations say they have implemented API management or are planning to do so within the next 12 months[3]
Directional
448% of organizations reported having production incidents caused by APIs[4]
Verified
564% of organizations reported they plan to deploy AI in customer service within the next 12 months (2024 survey)[5]
Verified
6In 2024, 37% of respondents reported that they are prioritizing API observability/monitoring as a key initiative (survey result)[6]
Verified
7In 2023, the U.S. Federal Government’s incident reporting showed 3,000+ security incidents reported under US-CERT/agency reporting channels (as summarized in federal incident reporting dashboards)[7]
Verified
Industry Trends Interpretation
Under Industry Trends, the rapid rise from 48% in 2018 to 58% today in enterprises using APIs for data access is paired with growing operational pressure, with 48% reporting API caused production incidents and 37% prioritizing API observability in 2024.
More related reading
Cost Analysis
1Average total cost for a breach in the financial sector in 2024 was $6.60 million (IBM)[8]
Verified
2NIST estimates that the cost of implementing security controls varies, with “Security Control Implementation” guidance emphasizing that costs depend on system type and risk level (Special Publication 800-53 cost considerations)[9]
Directional
Cost Analysis Interpretation
Cost analysis shows that breaches in the financial sector averaged $6.60 million in 2024, and since NIST notes that implementing security controls can vary by system type and risk level, budgeting must account for differing costs to reduce exposure.
More related reading
Market Size
1$1.0 billion was spent on API security tools globally in 2023 (estimate)[10]
Single source
2$6.3 billion global API management market size in 2023 (estimate)[11]
Verified
3$3.9 billion global iPaaS market size in 2023 (estimate)[12]
Verified
4$19.5 billion global integration software market size in 2023 (estimate)[13]
Single source
5$7.4 billion global data integration tools market size in 2023 (estimate)[14]
Verified
6$1.7 billion global API gateway market size in 2023 (estimate)[15]
Verified
7Cloud computing spending reached $679 billion worldwide in 2023 and is forecast to reach $1.3 trillion by 2027 (CAGR 20.0%)[16]
Verified
8Worldwide public cloud services end-user spending totaled $675.4 billion in 2024[17]
Directional
9$19.9 billion was the estimated global spend on data integration and data quality solutions in 2023 (estimate)[18]
Verified
10$2.9 billion global API connectivity revenue projected in 2024 (estimate)[19]
Single source
11$6.9 billion global enterprise integration platform market in 2024 (estimate)[20]
Verified
Market Size Interpretation
In the Market Size landscape, spending on integration and connectivity is already in the tens of billions, with 2023 estimates ranging from $3.9 billion for iPaaS to $19.5 billion for integration software and reaching $6.3 billion for API management, while cloud growth is accelerating from $679 billion in 2023 to a projected $1.3 trillion by 2027, signaling that demand for API, data integration, and enterprise platforms is scaling alongside the cloud.
Security & Risk
1OWASP API Security Top 10 includes Improper Assets Management as a top risk category[21]
Verified
2In the 2024 DBIR, 10% of breaches involved social engineering[22]
Single source
3The U.S. CISA reported that 40% of observed intrusions involved exploitation of public-facing applications in 2023 (CISA alert analytics)[23]
Directional
4The U.S. FBI/IC3 reported that ransomware losses were $30.3 billion in 2023 (IC3)[24]
Verified
5The UK’s NCSC reported that around 65% of ransomware infections could have been prevented by basic cyber hygiene measures (NCSC guidance estimate)[25]
Verified
Security & Risk Interpretation
For the Security & Risk angle, the data points to a clear pattern that preventable weaknesses drive real-world harm, with 40% of 2023 intrusions exploiting public-facing applications and 65% of ransomware infections in the UK estimate avoidable through basic cyber hygiene.
More related reading
User Adoption
169% of developers used Postman at work in 2023, per the “State of API Report 2023” developer survey[26]
Directional
User Adoption Interpretation
In the User Adoption category, 69% of developers used Postman at work in 2023, showing strong mainstream uptake of the tool among working API developers.
More related reading
Security Metrics
1The NIST National Vulnerability Database contains 29,000+ vulnerabilities affecting web application components in 2023 (yearly total for CWE category mapping reported by NVD statistics)[27]
Verified
2API security issues are commonly associated with Broken Access Control; in OWASP ASVS 4.0, “Access Control” verification requirements account for a substantial portion of controls (ASVS structure)[28]
Verified
3In the 2024 AWS Well-Architected Tool (security pillar) guidance, “increased logging/monitoring coverage” is a core measurable action (AWS recommends enabling audit logging across services)[29]
Directional
4In the EU’s NIS2 Directive, operators of essential services and important digital service providers must report certain incidents within 24 hours after becoming aware (Article 23 initial notification timeline)[30]
Verified
Security Metrics Interpretation
Security Metrics show that web application vulnerability exposure remains high with 29,000+ NVD issues in 2023 mapped to CWE categories, while major frameworks and regulations focus on controlling access and improving detection, as reflected by OWASP ASVS 4.0’s heavy Access Control coverage, AWS’s push for increased audit logging and monitoring, and NIS2’s 24 hour incident reporting requirement.
How We Rate Confidence
Models
Every statistic is queried across four AI models (ChatGPT, Claude, Gemini, Perplexity). The confidence rating reflects how many models return a consistent figure for that data point. Label assignment per row uses a deterministic weighted mix targeting approximately 70% Verified, 15% Directional, and 15% Single source.
Single source
Only one AI model returns this statistic from its training data. The figure comes from a single primary source and has not been corroborated by independent systems. Use with caution; cross-reference before citing.
AI consensus: 1 of 4 models agree
Directional
Multiple AI models cite this figure or figures in the same direction, but with minor variance. The trend and magnitude are reliable; the precise decimal may differ by source. Suitable for directional analysis.
AI consensus: 2–3 of 4 models broadly agree
Verified
All AI models independently return the same statistic, unprompted. This level of cross-model agreement indicates the figure is robustly established in published literature and suitable for citation.
AI consensus: 4 of 4 models fully agree
Models
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Julian Richter. (2026, February 13). Aggregated Statistics. Gitnux. https://gitnux.org/aggregated-statistics
MLA
Julian Richter. "Aggregated Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/aggregated-statistics.
Chicago
Julian Richter. 2026. "Aggregated Statistics." Gitnux. https://gitnux.org/aggregated-statistics.
References
- 1gartner.com/en/newsroom/press-releases/2023-04-12-gartner-survey-finds-58-percent-of-enterprises-use-apis-for-data-access
- 2gartner.com/en/newsroom/press-releases/2024-01-25-gartner-says-70-percent-of-organizations-have-at-least-one-system-with-an-api-used-to-integrate
- 3gartner.com/en/newsroom/press-releases/2023-05-10-gartner-survey-finds-57-percent-of-organizations-have-implemented-api-management-or-plan-to
- 16gartner.com/en/newsroom/press-releases/2024-04-15-gartner-says-worldwide-end-user-spending-on-public-cloud-services-will-total-679-billion-in-2024
- 17gartner.com/en/newsroom/press-releases/2025-04-02-gartner-says-worldwide-public-cloud-end-user-spending-will-total-675-4-billion-in-2025
- 18gartner.com/en/newsroom/press-releases/2024-01-18-gartner-says-worldwide-spending-on-data-integration-and-data-quality-solutions-will-total-19-point-9-billion-in-2024
- 19gartner.com/en/newsroom/press-releases/2024-02-08-gartner-says-api-connectivity-services-revenue-to-grow
- 4apigee.com/resources/api-operations-benchmark
- 5salesforce.com/news/stories/2024-state-of-service-ai/
- 6nginx.com/blog/nginx-repo-api-observability-report-2024/
- 7cisa.gov/resources-tools/reporting/metrics
- 23cisa.gov/news-events/cisa-releases-2023-cybersecurity-performance-goals
- 8ibm.com/reports/data-breach
- 9csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
- 10reportlinker.com/p05990993/Global-API-Security-Market-Report.html
- 11reportlinker.com/p06016589/Global-API-Management-Market-Report.html
- 12reportlinker.com/p06017254/Integration-Platform-as-a-Service-iPaaS-Global-Market-Outlook.html
- 13reportlinker.com/p06102811/Global-Integration-Software-Market.html
- 14reportlinker.com/p05021679/Data-Integration-Tools-Market.html
- 15reportlinker.com/p06011886/Global-API-Gateway-Market.html
- 20fortunebusinessinsights.com/enterprise-application-integration-market-103048
- 21owasp.org/www-project-api-security/
- 28owasp.org/www-project-application-security-verification-standard/
- 22verizon.com/business/resources/reports/dbir/
- 24ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
- 25ncsc.gov.uk/guidance/ransomware
- 26blog.postman.com/state-of-api-report-2023/
- 27nvd.nist.gov/general/nvd-dashboard
docs.aws.amazon.com- 29docs.aws.amazon.com/wellarchitected/latest/security-pillar/aws-security-logging-and-monitoring.html
- 30eur-lex.europa.eu/eli/dir/2022/2555/oj