Is your security testing ready for the API-first era?