Less than 50% of companies have API security testing tools in place