APIs Overtake Traditional Vulnerabilities as Top Attack Vector in…

Event summary

Wallarm's 2026 API ThreatStats Report found APIs accounted for 17% of all published vulnerabilities in 2025, with 43% of CISA KEV additions being API-related.
36% of AI-related vulnerabilities involved APIs, highlighting the intersection of AI and API security risks.
97% of API vulnerabilities can be exploited with a single request, making them highly attractive to attackers.
Model Context Protocol (MCP) vulnerabilities grew 270% from Q2 to Q3 2025, tied to a major API breach.

The big picture

Wallarm's report underscores a critical shift in cybersecurity, where APIs have become the dominant attack surface, surpassing traditional vulnerabilities. This trend is particularly acute in AI-driven environments, where API failures can lead to large-scale breaches. The findings suggest that security leaders must prioritize systematic improvements in identity management and access control to mitigate these risks.

What we're watching

API Security Priorities: How CISOs will shift resources from traditional application security to API-specific protections.
AI Integration Risks: Whether the growing overlap between AI and API vulnerabilities will accelerate security investments in both areas.
Regulatory Scrutiny: The pace at which regulators mandate stricter API security standards for industries handling sensitive data.