Attackers increasingly combine API abuse, web application attacks and DDoS into a single coordinated campaign. In its 2026 State of the Internet report, Akamai calls this the 'industrialisation' of cyberattacks. The numbers speak for themselves:

• The average number of daily API attacks rose by 113% year over year.
• 87% of surveyed organisations experienced an API-related security incident in 2025.
• Application-layer (Layer 7) DDoS attacks grew by 104% in two years; in Europe, the Middle East and Africa alone they rose 37% in a single year.

The IoT botnets we wrote about in 2019 have since grown into super botnets capable of generating enormous volumes. At the same time, AI adoption is acting as an accelerator: every connection to an AI service is yet another API. Forgotten, outdated or misconfigured APIs ('shadow' and 'zombie' APIs) are the biggest risk.

What can you do? Start by mapping which APIs you actually have. Then protect web applications and APIs as one, at the edge of the network, before traffic ever reaches your platform. For this, we deliver and manage Akamai App & API Protector: a cloud WAF with API protection and DDoS mitigation. With Akamai Edge DNS, your DNS stays available even when it's under fire.

As of this year, most web traffic no longer comes from humans. According to research data, over 57% of all web requests in June 2026 came from bots and AI agents. And that traffic behaves differently than before:

• Malicious bot traffic grew by 124% between July 2025 and June 2026, nine times faster than human traffic (DataDome, 2026).
• Scraping is the largest and fastest-growing threat: almost 71% of malicious bot traffic, up 185% in a year.
• Traffic from AI agents that fill in forms, log in and check out on their own grew by nearly 7,900% (HUMAN Security, 2026).
• More than 65% of popular websites tested failed to stop any of ten simulated bot types.

The challenge is no longer simply 'blocking bots'. A search engine, or an AI assistant looking for a product on a customer's behalf, is exactly what you want to let in. A scraper copying your prices, or a bot testing stolen passwords, is not. On top of that, all this unwanted traffic consumes computing power and skews your analytics.

What can you do? Make sure you can see who or what is visiting your site, and decide per bot type how to respond: allow, slow down, deceive or block. With Akamai Bot Manager, we recognise bots by their behaviour rather than by what they claim to be. Good bots stay welcome and malicious ones stay out, without your real customers noticing a thing.

Why force a wall when you can steal the key? Leaked passwords, hijacked sessions and misused supplier access are the easiest way in for attackers. HUMAN Security saw post-login account takeover attempts more than quadruple in a year. According to the Microsoft Digital Defense Report 2026, the Netherlands ranks 9th in Europe among countries where customers are most often hit by cyber activity.

The real problem starts once an attacker is inside. In a flat network, they can move freely from a compromised laptop to the database holding customer data. It is exactly this 'lateral movement' that turns a minor incident into a ransomware crisis.

What can you do? Adopt zero trust: never trust a user or device based on where it sits, but verify every time. In practice, that means two things:

• Access per application instead of to the entire network. With Akamai Enterprise Application Access, employees and suppliers only get access to the applications they need, when they need them. No traditional VPN required.
• Segmentation from the inside out. With Akamai Guardicore Segmentation, you see which systems talk to each other and block traffic that doesn't belong. If one system gets infected, the damage stays limited to that one system.

Since 15 August 2026, the Cyberbeveiligingswet (Cbw, the Dutch Cybersecurity Act) has been in force in the Netherlands. It is the Dutch implementation of the European NIS2 Directive, and there is no transition period. Around 10,000 organisations fall directly under the law. They must demonstrably manage risks and report incidents quickly, and their directors are personally accountable.

Even if your organisation isn't covered by the law itself, you'll probably feel its effects. Organisations that do fall under the Cbw must also manage the risks at their suppliers. So expect questions from your customers about how you secure, test and monitor your platform.

What can you do? Start with insight: where does your platform stand today, and where are the gaps? Our Security Healthcheck gives you that overview. We also support you with OWASP scans, penetration tests (by an independent third party) and security awareness for your team. And because we are ISO 27001 certified, you can include our management and monitoring directly in your own reporting to regulators and customers.