Pros: the API solution can block API requests in real-time when it's implemented inline. Cons: in order to minimize false positives, the API security solution should be able to learn what's a normal use of an API endpoint is and what's considered an anomaly and suspected attack. In order to reach that level of context and accuracy, an offline analysis should be done based on an adequate amount of API traffic data, which is typical for an API security solution that is not deployed inline.