- Financial services organizations face frequent API incidents, led by data leaks and AI-linked attacks. AI applications, agents, and large language models (LLMs) depend on APIs to reach sensitive systems and customer records. In financial services, these same APIs have become high-value targets. Financial services also stands out for incident frequency: Nearly half of organizations that were hit reported four or more separate events.
- Lack of visibility into sensitive customer and payment data flows is a critical gap. Most financial services organizations maintain a full API inventory, yet only 27% also know which APIs return sensitive data. Since these APIs handle personal financial information, account details, and payment data governed by PCI DSS, DORA, and GDPR, the visibility gap is especially concerning.
- Financial services leaders claim to prioritize API security, but gaps remain in practice. Protecting AI technologies against attack is now the leading cybersecurity priority across the sector. At the same time, 74% of financial services leaders reported a sharper focus on API security in the past year, driven by rapid API growth from AI and digital initiatives, along with regulatory pressure and audit findings.