APIs & The Undocumented Attack Surface

With 84% of all internet traffic being API driven, with 64% of APIs being a breach vector, with only 4% of organizations really securing those APIs, how much of the attack surface is going undocumented & unsecured. Zombies, ghost, shadow or orphan APIs, what is getting by? Now, introduce AI generated code, AI generated code review where and how do you address it at the enterprise level?