An API security program should use both vulnerability scanning and penetration testing to support comprehensive API security. • Defenders should not think in terms of choosing between them ...