It looks like Invicti has done some work in this space [1]. I'm sure you've seen this pretty good Stack Exchange discussion on the topic [2, 3]. As you say, th

It looks like Invicti has done some work in this space [1]. I'm sure you've seen this pretty good Stack Exchange discussion on the topic [2, 3]. As you say, the boutique shops aren't going to be relying on automated scans, they're going to have engineers who'll use their experience, knowledge and personal tooling (metasploit modules etc.) I don't really have any skin in the space, but IMHO it'd be kind of surprising to see a successful new REST API security startup. 1. https://www.invicti.com/support/scanning-restful-api-web-service/ https://www.invicti.com/support/scanning-restful-api-web-ser... 2. https://security.stackexchange.com/questions/51010/api-security-testing-methodologies https://security.stackexchange.com/questions/51010/api-secur... 3. https://security.stackexchange.com/questions/126936/how-do-you-pen-test-a-rest-api#126942 https://security.stackexchange.com/questions/126936/how-do-y...