As attacks increase, leaders question API security strategies