The State of Cybersecurity APIs

About this paper

The cybersecurity industry is good at APIs. It is the second-best-scoring market of the twenty-five in the catalog — 30.2 against a catalog average of 22.5 — and it holds the highest single score ever recorded in this series, Trulioo at 81.1. That belongs established before the rest of this, because the rest of this is uncomfortable.

542 of 1,933 cybersecurity companies publish a vulnerability disclosure policy. Twenty-eight percent. Among the best-run 48 it is still under two-thirds. In threat intelligence — the sub-sector that sells you information about exposed infrastructure and unpatched software — it is two organizations in nine. As of the EU Cyber Resilience Act that is no longer merely ironic; a published policy with a named contact point is a legal requirement, and it is a text file. Meanwhile idempotency comes in at 2.9%, the third market in a row to land between 2.6% and 2.9% across ten points of competence — which makes it an industry-wide default rather than anybody’s failing. The deepest finding is the one hiding in the taxonomy: this market already models users, groups, roles, policies, tokens, sessions and audit better than any other in the catalog. That is the entire vocabulary of agentic delegation. It sells it to everyone else, and points it at its own agent surface 7.1% of the time.

What's inside

1. Executive summary — second of twenty-five, and 28% disclosure
2. The state of the market — second place, and the shape of it
3. The resource taxonomy — the market already has the words
4. The composite Kin Score
5. Agent-readiness — and the first market where the top is moving
6. The blueprint
7. The standards layer — rich in protocols, absent a market standard
8. The regulatory layer — the first market where the artifacts are the compliance
9. Standards and artifacts for the agentic turn
10. Security, auth, scopes and compliance
11. Provider-by-provider intelligence
12. The investable thesis
13. Where this is going

What you get for $500.00