Akamai Study Finds Widespread API Security Incidents and Growing AI-Linked Risks in APAC
Summary
An Akamai-commissioned survey of 640 cybersecurity decision-makers in China, India, Japan and Singapore found 81% of organizations experienced API security incidents in the past year, amid poor inventory visibility and growing AI-linked API risks.
Key points
- The report is based on a November 2025 survey commissioned by Akamai and conducted by Phronesis Partners; the regional findings cover 640 respondents in China, India, Japan and Singapore.
- Overall, 81% of respondents said their organization experienced an API security incident in the past 12 months; the country figures ranged from 63% in China to 93% in India.
- Attacks involving APIs linked to AI applications, agents or LLMs were the most commonly reported incident type, at 43%; 37% reported exploitation of missing or insufficient access controls.
- Only 22% said they had a full API inventory and knew which APIs return sensitive data. Japan’s figure was 11%, down from 37% in 2025.
- Among organizations hit by incidents, 56% reported four or more API-related incidents, and the report puts the average regional incident cost at more than US$1 million.
- Although 72% said their focus on API security had increased, only 19% reported security testing fully embedded across the API SDLC and CI/CD.
Article Details
- Publisher
- Akamai
- Report Period
- Survey conducted November 2025; report published in 2026.
- Scope
- API security across China, India, Japan, and Singapore, based on cybersecurity decision-makers’ survey responses.
- Sample Size
- 640 respondents in the regional study; 1,840 across the broader global study.
- Key Statistics
- 81% of respondents across the four APAC markets reported at least one API security incident in the prior 12 months.
- 43% reported an incident involving APIs linked to AI technologies, including applications, agents, or LLMs (APAC average; prior 12 months).
- 22% said they had a full API inventory and knew which APIs returned sensitive data (APAC average).
- Among organizations hit by incidents, the average was 3.6 API incidents; 56% reported four or more.
- 19% of APAC respondents said security testing was fully embedded across the API SDLC and CI/CD.
- Recommendations
- Maintain a full API inventory and identify which APIs return sensitive data.
- Embed security testing across the API SDLC and CI/CD.
- Analyze APIs for OWASP API Security Top 10 risks, run automated tests that simulate malicious traffic, and prioritize vulnerabilities by impact for remediation.