That report is getting passed around like it's gospel. Yes, APIs are a juicy target. No, this isn't some revolutionary new threat vector. It's the same old story: people build things without thinking about how they can be broken, and then act surprised when someone breaks them.
The real issue, which the report predictably glosses over, is the sheer number of services that treat their API endpoints like they're internal infrastructure. No rate limiting, no cost-aware scaling, and authentication that's either non-existent or a brittle token that gets logged in a dozen client-side scripts. The "DDoS-for-hire" angle is just the delivery mechanism. The vulnerability is poor design.
As for mitigation, if you're just now thinking about this after reading a report, you're already behind. But since everyone loves tips:
* Your WAF is not a magic wand. Tuning it to actually understand your API traffic patterns, versus just blocking the OWASP Top 10, is the hard part. Expect false positives. Deal with it.
* Edge-based rate limiting is your first, cheapest line of defense. It should be based on more than just IP, which is trivial to spoof. Layer in API keys, user-agent patterns, even request complexity if you can.
* The origin is where you lose. If your database queries or backend services can't handle a spike of legitimate traffic, they'll fold under an attack just the same. So you need to think about scaling and, more importantly, *cost*. Auto-scaling into oblivion because of junk traffic is a great way to get a bill that makes you wish the attack took you offline.
Most of the case studies in these reports suffer from survivorship bias. We hear from the companies that got hit, mitigated, and lived to tell the tale. We don't hear from the ones that got a $50k cloud bill and shut down, or the ones where the "mitigation" was simply making the service unusable for actual users. Start with the basics before you go buying the premium "AI-powered" solution.
Anecdotes aren't data.