[ckozlowski]

I concur with some of the other posters in that automated application vulnerability detection is far from flawless (Heh.....far indeed.)

But that's not to say they aren't using them already. I used to perform high-level security audits of networks. For our cursory app testing, we used:

- Application Testing: HP Web Inspect https://download.hpsmartupdate.com/webinspect/

- Database/Backend: AppDetective http://www.appsecinc.com/products/appdetective/

Automated tools won't, by themselves, ensure you're bulletproof. But they do use them.