The financial impact of API and bot attacks on large enterprises

In recent years, large enterprises have undergone unprecedented digital transformation journeys, driven by the pandemic and a rapid shift to the cloud. Application architectures have changed rapidly during this time, fundamentally reshaping how organizations operate and enabling them to adapt quickly to evolving market demands and customer expectations. Central to this evolution has been the proliferation of application programming interfaces (APIs), which streamline processes, facilitate integrations, and accelerate innovation. However, as organizations embrace these new application architectures, they also encounter significant challenges, particularly in the realm of security.

To better understand the financial impact of vulnerable or insecure APIs and automated abuse by bots — two of the greatest security threats impacting large enterprises today — Imperva, a Thales company, engaged the Marsh McLennan Cyber Risk Intelligence Center to quantify the cost of API and bot-related security incidents. The analysis of more than 161,000 cybersecurity incidents reveals that these security threats could cost businesses up to $186 billion annually. In addition, it was found that larger organizations, specifically those with revenue exceeding $100 billion, are more likely to have a higher percentage of security incidents that involve both insecure APIs and bot attacks.

The Correlation Between Increased Revenue and API Attacks

APIs have become omnipresent, facilitating seamless integration and data exchange among applications. Large enterprises rely on them to accelerate innovation, improve collaboration, and enhance the customer experience. But this reliance comes with cost and risk. Enterprises with revenues exceeding $100 billion face the highest risk out of any revenue bracket for API attacks. It’s estimated that up to 18% of their cyber incidents are due to vulnerable or insecure APIs.

The rapid adoption of APIs (the average number of API endpoints was 613 per enterprise in 2023, according to Imperva Threat Research), inexperience of many API developers, and lack of collaboration between development and security teams, creates security issues. Security teams don’t always have visibility into the APIs that development teams are pushing to production, limiting their ability to ensure proper security measures are implemented. It’s no wonder why API-related incidents rose 40% from 2021 to 2022 and increased a further 9% 2023. Today, vulnerable or insecure APIs result in up to $87 billion of losses annually, a $12 billion increase from 2021.

Why Bad Bots Are Targeting Large Enterprises

The widespread availability of attack tools and artificial intelligence has resulted in the evolution of bot attacks, enabling even low-skilled attackers to launch sophisticated bot attacks, with the ability to target multiple businesses simultaneously. Consequently, bot-related security incidents rose 88% in 2022 and 28% in 2023.

For companies with revenues over $100 billion, up to 14% of their cyber incidents are linked to bad bots — the highest risk of any revenue bracket. This is ultimately attributed to the fact that large enterprises have an extensive digital presence and extremely valuable assets. They’re attractive targets for bot operators and attackers to conduct malicious activities such as web scraping, brute-force login attempts, digital ad fraud, denial-of-service attacks, and more. These activities consume bandwidth, slow servers, and steal sensitive data, resulting in financial and reputational damage.

Why Large Organizations Should be Concerned About API Abuse

Attacks on APIs and automated abuse by bots are detrimental enough on their own. When the two threats work together, it’s a troubling partnership.

Bots have emerged as one of the most significant threats to API security. Last year, automated attacks accounted for 30% of all API attacks, with 17% directly linked to bots exploiting business logic vulnerabilities. The increasing reliance on APIs, which provide direct access to sensitive data, has made organizations a target for these automated attacks. Consequently, automated abuse is costing businesses up to $17.9 billion per year. These issues are particularly pronounced in large enterprises, which are 2-3 times more likely to experience automated API abuse by bots compared to small or mid-size businesses. Additionally, API and bot-related attacks account for up to 26% of total cyber incidents in organizations with revenues exceeding $100 billion.

As API usage expands, malicious actors exploit these interfaces using bad bots to manipulate business logic, evade security measures, and steal sensitive information. Because bad bots mimic legitimate user behavior, they’re complicated to detect and mitigate. Successful attacks can have serious impacts on organizations, such as:

The Need for Enhanced API and Bot Protection Measures as Companies Grow

As organizations grow and expand their API usage, the complexity of their ecosystems increases, making them attractive targets for cybercriminals. It’s clear that the largest enterprises are the most vulnerable when it comes to API and bot incidents — with vulnerable or insecure APIs and automated abuse by bots accounting for as many as 1 in 4 cyber incidents.

Organizations need to implement comprehensive security strategies that address both API and bot threats, such as:

Proactive, adaptive measures are essential to protect against automated attacks. In light of the increasing digital landscape, organizations must prioritize security to safeguard their valuable assets and maintain the trust of their customers.

By: Erez Hasson