AI Has Changed the Security Landscape
Not long ago, web application security was largely focused on protecting login systems, blocking common attacks, and identifying vulnerabilities in application code. Today, the challenge is far broader. AI is now embedded not only in applications themselves, but also in automation workflows and even in the toolkits used by cybercriminals.
The report highlights a growing readiness gap. Organizations are deploying new technologies faster than they can adequately protect them, creating a disconnect between innovation and security maturity. This gap is reflected in declining confidence levels. Only 29% of respondents report high confidence in their overall application security posture. When it comes to AI-enabled applications, that figure drops to just 15%. Confidence in defending against AI-powered attacks is even lower, at only 12%.
At the same time, 76% of organizations already use AI or machine learning in their security operations. This creates an interesting paradox: adoption is accelerating, but confidence is falling. Simply adding AI to security workflows is not enough if the underlying architecture remains fragmented and slow to respond.
You Can’t Protect What You Can’t See
One of the report’s strongest messages is that visibility remains a fundamental challenge. Only 13% of organizations are highly confident that they have a complete inventory of the applications and APIs operating within their environment. In practice, this means most organizations are securing only part of what they actually run. The problem is compounded by the rise of shadow AI-unauthorized AI tools and services used outside established IT processes. Nearly one-third (31%) of respondents identify shadow AI as a major concern. Because these tools are often adopted outside formal deployment processes, they frequently bypass traditional security controls as well.
In conventional IT environments, resources were deployed, documented, and managed through centralized processes. AI-driven environments are different. Services create API connections automatically, store credentials within applications, and introduce new access points with minimal oversight. As a result, attackers may discover assets that security teams never knew existed. This is why the report places such strong emphasis on automated discovery of applications and APIs. Without an accurate and continuously updated inventory, effective protection becomes almost impossible.
APIs, Bots, and Credential Abuse
The report identifies AI-assisted attacks, undocumented APIs, and vulnerabilities introduced through AI integrations as the most pressing threats facing organizations today. Seventy-four percent of respondents reported an increase in AI-assisted attacks over the past year.
Among automated threats, credential stuffing, account takeover attacks, DDoS campaigns, and web scraping rank among the most significant concerns. Credential stuffing stands out as both the most common attack experienced by organizations and the threat respondents worry about the most. The challenge is not that bots are new - it is that they have become dramatically more sophisticated. Modern bots can rapidly change identities, behavior patterns, and technical characteristics, making them increasingly difficult to distinguish from legitimate users. Traditional defenses such as login attempt limits, IP reputation checks, and CAPTCHAs are often no longer sufficient.
The report also underscores the critical role of APIs. APIs have become the nervous system of the modern digital economy, enabling applications to communicate and exchange data. Yet they are also emerging as one of the most vulnerable components of the technology stack. Respondents ranked APIs as the riskiest application category (67%) while simultaneously identifying them as the area with the greatest visibility gap (53%). This creates a particularly dangerous situation: organizations are most concerned about the assets they understand and control the least.
Another important finding is that many organizations continue to rely heavily on perimeter-based controls such as OAuth, API keys, and gateways. While these technologies are essential, verifying identity alone does not guarantee legitimate behavior. Once an attacker compromises an account or token, they can often operate with the appearance of a trusted user.
Detection and Response Are Still Too Slow
More than half of organizations (53%) experienced a web application or API-related security incident during the past 12 months. However, the report suggests that the greater challenge lies in detection and response. Only 20% of organizations can detect an incident within a few hours. Meanwhile, 54% require a week or longer to identify that something has gone wrong.
Response times are even more concerning. Sixty-eight percent of organizations need more than a day to remediate an issue, while 39% require a month or longer. In an environment where attacks can unfold within minutes, these timelines are unsustainable.
According to the report, one of the main reasons for slow response is the fragmented nature of security data. Information relevant to an attack is often spread across application logs, network telemetry, API activity, and security alerts. Security teams must manually correlate findings across multiple consoles before they can fully understand what is happening. As a result, the challenge is not only stopping attacks but also overcoming operational complexity. Every day of delay gives attackers more time to steal data, map internal systems, and establish long-term access.
Security Tool Sprawl Is Becoming a Liability
Only 5% of respondents say they are satisfied with their current application security tools. The most frequently cited problems include limited visibility, excessive false positives, management complexity, and poor integration between platforms. This finding points to a broader issue. Organizations are no longer struggling with individual products-they are struggling with fragmented security architectures. When tools operate independently, teams face more manual work, more correlation tasks, and more opportunities for critical signals to be missed. As a result, 62% of organizations are either consolidating their security tools today or planning to do so in the near future.
Notably, cost reduction is not the primary motivation. Organizations are pursuing consolidation to simplify operations and improve efficiency. This reflects a growing recognition that architectural simplicity is itself a security advantage. Consolidation offers three key benefits: streamlined operations, consistent policy enforcement, and lower management overhead. The objective is not simply to reduce the number of tools, but to establish a unified security framework.
What Business Leaders Should Do Next
The report concludes with five practical recommendations:
- Discover Your Hidden Assets. You cannot secure what you do not know exists. Automated discovery of applications, APIs, and AI services should be a foundational capability.
- Look Beyond Authentication. A valid login does not automatically mean legitimate behavior. Monitor user activity after authentication to detect suspicious patterns and anomalies.
- Accelerate Response Times. Manual processes are no longer sufficient. Security operations should be increasingly automated to enable immediate action when threats are detected.
- Move AI to the Front Line. Rather than using AI solely for retrospective analysis, organizations should leverage it for real-time threat detection and response.
- Simplify the Security Stack. Instead of managing multiple disconnected solutions, adopt an integrated platform capable of unifying API security, WAF protection, bot mitigation, and DDoS defense under a common policy framework and shared telemetry.
Final Thoughts
The report’s central message is clear: AI is accelerating everything-from application development and cyberattacks to expectations around security performance. Yet many organizations continue to defend themselves using processes and architectures designed for a slower era. To keep pace, businesses must stop viewing web application security as a collection of separate tools and start treating it as a unified, coordinated platform capable of delivering visibility, automation, and real-time protection across the entire application ecosystem.
