Paid $1,200 for an API security scanner last year and it caught nothing
Honestly the demo looked great but after 8 months on our production API it flagged 3 things that were all false positives. We ran a manual pentest after that and found 2 auth issues it completely missed, which stung. Anyone else here had luck with a cheaper scanner or is manual review just the way to go for smaller teams?