Vulnerability scans that weren’t designed for API vulnerabilities will result in false-negative findings. False negative vulnerability results are one of the most dangerous threats to plague an information security program.
These results are dangerous because they suggest that your APIs are secure due to a lack of findings, however, it’s much more likely that the scanner didn’t test for the top API weaknesses.
A false negative occurs when a vulnerability scanner indicates nothing is wrong, but an existing vulnerability has gone undetected. This could happen if an API is scanned generically.
Each API is unique in the set of business functionality and this presents a problem to most vulnerability scanners. The vulnerability scan may detect common security misconfigurations but will miss most of the vulnerabilities indicated on the OWASP API Security Top 10.