Whitepaper · from Akamai
API Security & Compliance: Implicit and explicit requirements for data protection
The emergence of APIs as a major compliance issue is not surprising. Exposed or misconfigured APIs are prevalent, easy to compromise, and often unprotected. And just one breached API can result in millions of records
- Format
- Whitepaper
- Published by
- Akamai
- Category
- Cybersecurity & Compliance
- Added
- 7 Jan 2026
About this whitepaper
The emergence of APIs as a major compliance issue is not surprising. Exposed or misconfigured APIs are prevalent, easy to compromise, and often unprotected. And just one breached API can result in millions of records being stolen.
That is why evolving regulations like PCI DSS v4.0, GDPR and DORA clearly focus on securing the applications and infrastructure within which APIs operate. It is implied that your organization must:
- Account for every API, including elusive shadow APIs
- Uncover and fix any API vulnerabilities
- Apply controls tailor-made to prevent API-centric data breaches
This white paper explores the nature of growing API risks, highlights six examples of regulations and frameworks that require API protections (either explicitly or implicitly), and offers advice on how to meet compliance requirements through API security best practices.
Listen or skim
Summaries are generated from this page’s text. Read the full piece for the detail.
More from Akamai
All 2 →
Elsewhere in Cybersecurity & Compliance
See the category →
Simplifying security in the age of complexity
In an effort to achieve “digital transformation,” businesses have found that technology investments have actually outpaced their ability to see and secure everything.
Threat Vector Investigates
To stop sophisticated attacks, you need to know what you’re up against. Turn adversary insight into informed threat defense.
Secure work on all of devices, managed or not.
The average employee spends over 85% of their day working in a browser. But the lack of visibility and control over users' actions within corporate applications is leaving sensitive data vulnerable to threats. That's