The IT security staff is concerned about unexpected increases in traffic on an API with...

Use the Spike Arrest policy, to smooth out traffic spikes.

Use a Quota policy, to ensure that no client exceeds a defined quantity of traffic.

Work with operations to ensure autoscaling is set up to respond to traffic events

Use the Concurrent Rate Limit policy, to ensure back-end services are not overwhelmed