The "zombie & dormant API" detection is something I rarely see mentioned. That's often where risk hides. Offensive DAST scans with 15,000+ test feel robust.