APIs are no longer a technical side quest, with 58% of enterprise organizations reporting API use for data access and that share rising from 48% in 2018. Yet the same API momentum is colliding with risk and cost, including a $6.60 million average financial-sector breach cost in 2024 and $1.0 billion spent globally on API security tools in 2023. Let’s look at the aggregated statistics behind that tension, from adoption and management to the incidents that force teams to take observability and control seriously.
Key Takeaways
- 58% of enterprise organizations reported using some form of application programming interface (API) for data access, up from 48% in 2018
- 70% of organizations say they have at least one system with an API that is used to integrate with other systems
- 57% of organizations say they have implemented API management or are planning to do so within the next 12 months
- Average total cost for a breach in the financial sector in 2024 was $6.60 million (IBM)
- NIST estimates that the cost of implementing security controls varies, with “Security Control Implementation” guidance emphasizing that costs depend on system type and risk level (Special Publication 800-53 cost considerations)
- $1.0 billion was spent on API security tools globally in 2023 (estimate)
- $6.3 billion global API management market size in 2023 (estimate)
- $3.9 billion global iPaaS market size in 2023 (estimate)
- OWASP API Security Top 10 includes Improper Assets Management as a top risk category
- In the 2024 DBIR, 10% of breaches involved social engineering
- The U.S. CISA reported that 40% of observed intrusions involved exploitation of public-facing applications in 2023 (CISA alert analytics)
- 69% of developers used Postman at work in 2023, per the “State of API Report 2023” developer survey
- The NIST National Vulnerability Database contains 29,000+ vulnerabilities affecting web application components in 2023 (yearly total for CWE category mapping reported by NVD statistics)
- API security issues are commonly associated with Broken Access Control; in OWASP ASVS 4.0, “Access Control” verification requirements account for a substantial portion of controls (ASVS structure)
- In the 2024 AWS Well-Architected Tool (security pillar) guidance, “increased logging/monitoring coverage” is a core measurable action (AWS recommends enabling audit logging across services)
APIs power integration across enterprises, but rising breach costs and security risks are driving API security investment.
Related reading
01 · Category
Industry Trends7 stats
01
58% of enterprise organizations reported using some form of application programming interface (API) for data access, up from 48% in 2018
02
70% of organizations say they have at least one system with an API that is used to integrate with other systems
03
57% of organizations say they have implemented API management or are planning to do so within the next 12 months
04
48% of organizations reported having production incidents caused by APIs
05
64% of organizations reported they plan to deploy AI in customer service within the next 12 months (2024 survey)
06
In 2024, 37% of respondents reported that they are prioritizing API observability/monitoring as a key initiative (survey result)
07
In 2023, the U.S. Federal Government’s incident reporting showed 3,000+ security incidents reported under US-CERT/agency reporting channels (as summarized in federal incident reporting dashboards)
Interpretation
Industry Trends Interpretation
Under Industry Trends, the rapid rise from 48% in 2018 to 58% today in enterprises using APIs for data access is paired with growing operational pressure, with 48% reporting API caused production incidents and 37% prioritizing API observability in 2024.
02 · Category
Cost Analysis2 stats
01
Average total cost for a breach in the financial sector in 2024 was $6.60 million (IBM)
02
NIST estimates that the cost of implementing security controls varies, with “Security Control Implementation” guidance emphasizing that costs depend on system type and risk level (Special Publication 800-53 cost considerations)
Interpretation
Cost Analysis Interpretation
Cost analysis shows that breaches in the financial sector averaged $6.60 million in 2024, and since NIST notes that implementing security controls can vary by system type and risk level, budgeting must account for differing costs to reduce exposure.
03 · Category
Market Size11 stats
01
$1.0 billion was spent on API security tools globally in 2023 (estimate)
02
$6.3 billion global API management market size in 2023 (estimate)
03
$3.9 billion global iPaaS market size in 2023 (estimate)
04
$19.5 billion global integration software market size in 2023 (estimate)
05
$7.4 billion global data integration tools market size in 2023 (estimate)
06
$1.7 billion global API gateway market size in 2023 (estimate)
07
Cloud computing spending reached $679 billion worldwide in 2023 and is forecast to reach $1.3 trillion by 2027 (CAGR 20.0%)
08
Worldwide public cloud services end-user spending totaled $675.4 billion in 2024
09
$19.9 billion was the estimated global spend on data integration and data quality solutions in 2023 (estimate)
10
$2.9 billion global API connectivity revenue projected in 2024 (estimate)
11
$6.9 billion global enterprise integration platform market in 2024 (estimate)
Interpretation
Market Size Interpretation
In the Market Size landscape, spending on integration and connectivity is already in the tens of billions, with 2023 estimates ranging from $3.9 billion for iPaaS to $19.5 billion for integration software and reaching $6.3 billion for API management, while cloud growth is accelerating from $679 billion in 2023 to a projected $1.3 trillion by 2027, signaling that demand for API, data integration, and enterprise platforms is scaling alongside the cloud.
More related reading
04 · Category
Security & Risk5 stats
01
OWASP API Security Top 10 includes Improper Assets Management as a top risk category
02
In the 2024 DBIR, 10% of breaches involved social engineering
03
The U.S. CISA reported that 40% of observed intrusions involved exploitation of public-facing applications in 2023 (CISA alert analytics)
04
The U.S. FBI/IC3 reported that ransomware losses were $30.3 billion in 2023 (IC3)
05
The UK’s NCSC reported that around 65% of ransomware infections could have been prevented by basic cyber hygiene measures (NCSC guidance estimate)
Interpretation
Security & Risk Interpretation
For the Security & Risk angle, the data points to a clear pattern that preventable weaknesses drive real-world harm, with 40% of 2023 intrusions exploiting public-facing applications and 65% of ransomware infections in the UK estimate avoidable through basic cyber hygiene.
05 · Category
User Adoption1 stats
01
69% of developers used Postman at work in 2023, per the “State of API Report 2023” developer survey
Interpretation
User Adoption Interpretation
In the User Adoption category, 69% of developers used Postman at work in 2023, showing strong mainstream uptake of the tool among working API developers.
06 · Category
Security Metrics4 stats
01
The NIST National Vulnerability Database contains 29,000+ vulnerabilities affecting web application components in 2023 (yearly total for CWE category mapping reported by NVD statistics)
02
API security issues are commonly associated with Broken Access Control; in OWASP ASVS 4.0, “Access Control” verification requirements account for a substantial portion of controls (ASVS structure)
03
In the 2024 AWS Well-Architected Tool (security pillar) guidance, “increased logging/monitoring coverage” is a core measurable action (AWS recommends enabling audit logging across services)
04
In the EU’s NIS2 Directive, operators of essential services and important digital service providers must report certain incidents within 24 hours after becoming aware (Article 23 initial notification timeline)
Interpretation
Security Metrics Interpretation
Security Metrics show that web application vulnerability exposure remains high with 29,000+ NVD issues in 2023 mapped to CWE categories, while major frameworks and regulations focus on controlling access and improving detection, as reflected by OWASP ASVS 4.0’s heavy Access Control coverage, AWS’s push for increased audit logging and monitoring, and NIS2’s 24 hour incident reporting requirement.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Julian Richter. (2026, February 13). Aggregated Statistics. Gitnux. https://gitnux.org/aggregated-statistics
MLA
Julian Richter. "Aggregated Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/aggregated-statistics.
Chicago
Julian Richter. 2026. "Aggregated Statistics." Gitnux. https://gitnux.org/aggregated-statistics.
Sources & references
30 datasets cited across this report · attribution is report-level
docs.aws.amazon.com+13 additional datasets cited (not shown individually)