Your AppSec tools watch API endpoints and server infrastructure. Bad actors run attacks in your users' browser that go undetected by your defenses.