The rapid evolution of application architectures, driven by accelerated digital transformation during the pandemic, has transformed traditional monolithic applications into agile, distributed microservices connected via application programming interfaces (APIs). These APIs, now the bedrock of modern business operations, facilitate seamless communication between diverse applications and services.
As a result of this shift, API usage has surged in recent years, with API calls now accounting for the majority (71%) of web traffic. Enterprises, in particular, rely heavily on APIs to create engaging online customer experiences. In 2023, the typical enterprise site saw an average of 1.5 billion API calls. This increased reliance on APIs has introduced new cybersecurity risks as cybercriminals seek to exploit APIs, which act as direct pathways to sensitive data.
The growing threat of automated API abuse
Today, the biggest security risk impacting APIs is automated abuse by bad bots, one of the most pervasive and growing threats facing every industry. Bots are software applications that leverage APIs and run automated tasks across the internet every day. Good bots, such as those that improve search results or monitor website performance, serve useful functions. Alternatively, bad bots abuse the same APIs meant for good bots to carry out a range of tasks, from scalping to content scraping—resulting in higher infrastructure and support costs, increased customer churn, and damaged brand reputations.
Account takeover (ATO) attacks, in which cybercriminals use bad bots to facilitate credential stuffing and brute force attacks to break into online accounts, are a persistent risk. In fact, 44% of all ATO attacks in 2023 targeted APIs. These APIs handle crucial identity verification processes, making them an ideal target to gain unauthorized access to user accounts.
Challenges in protecting APIs
Protecting APIs from automated abuse by bots is challenging because all traffic looks the same to the API, as they are machine-readable by nature. Conventional bot protection mechanisms also do not work for APIs. For example, implementing a CAPTCHA challenge on an API request can break the calling application. This makes it difficult to detect and block malicious bot traffic, allowing attackers to use automation without raising alarms.
More broadly, organizations lack visibility over all their APIs, where they’re located, and the associated risks—making it difficult to identify and protect all public, private, and shadow APIs within their ecosystem against automated abuse.
Shadow APIs, which are undocumented and not maintained by normal IT management and security processes, account for about 4.7% of an organization's active APIs. Often introduced for specific purposes such as supporting legacy clients, diagnostics, or testing, these APIs are not properly cataloged or managed. These endpoints typically have access to sensitive information and pose significant risks since their existence and connections are unknown. A single shadow API can be exploited by bots to gain unauthorized access, steal sensitive data, or abuse legitimate functionality, resulting in compliance violations, regulatory fines, or a security incident.
Proactive Measures to Mitigate Automated API Abuse
To effectively mitigate API abuse by bots, organizations should:
While these steps are a great start, organizations will be challenged to mitigate automated attacks targeting their API libraries until they use bot management and API security in tandem. This combined approach identifies vulnerable APIs, continuously monitors for automated attacks, and delivers actionable insights to promptly detect and mitigate potential threats.
As the backbone of modern digital ecosystems, APIs are essential for seamless communication between applications and services. However, this critical role also makes them a prime target for automated abuse by bots. The rise in API traffic and the growing volume and sophistication of bot attacks presents a significant business risk. Protecting APIs from automated threats requires a multi-faceted approach. By staying vigilant and taking proactive steps, organizations can protect their APIs against automated abuse by bots, ensuring the integrity, performance, and reliability of their digital services.
About the authors
Lebin Cheng is a technologist and serial entrepreneur with more than 20 years of experience in cybersecurity. Cheng co-founded Netskope and later cofounded CloudVector, acquired by Imperva. He was awarded 15 patents in areas such as network security, application infrastructure and API inspection. He holds an MBA degree from the Haas School of Business at the University of California Berkeley and a MS in Computer Science from Purdue University.
Lynn Marks is a skilled product manager with more than 10+ years of experience in R&D and B2B product management. Previously, she was product manager at Model N and Distil Networks (acquired by Imperva) where she oversaw the product roadmap and innovation. At Imperva she manages Imperva Advanced Bot Protection, Imperva Client Side Protection, and works closely with customers to solve complex business challenges. She holds a Bachelor's Degree in Economics from UC Santa Barbara.
