You could certainly try, but no off the shelf software, commercial or open source, could fully replicate what the author did. It's sort of the golden dream of t

You could certainly try, but no off the shelf software, commercial or open source, could fully replicate what the author did. It's sort of the golden dream of the security world to fully automate this work to intelligent scanners like Acunetix or Fortify. When doing this work I personally find it helpful to frame vulnerabilities as areas in development where an engineer's mental model and design expectations were inadequate (or simply flawed). This is in contrast to the way most automated security scanning software implicitly understands vulnerabilities as lists of things that are known to go wrong. Both are helpful perspectives, but the reason why humans are much better at the actual work is because the former encompasses the latter without missing the more abstract issues. This is all a long-winded way of saying that in order to do this, you'd probably need to design an excellent machine learning system, preferably with supervised learning, and train it to classify vulnerabilities in source code and applications by running through the same things successful security engineers do. Depending on your definition of automated this would probably start to border on AGI in order to be really effective at fully removing all the schlep work. If I had to guess, I'd say the first company that will develop anything realistically close to this will be Hackerone or Bugcrowd. They are the companies with the most data, and they have already started working on machine learning systems that can classify bug bounty reports as likely signal or likely noise in production. I could even see a very long term Uber-esque plan where they attempt to replace their bug bounty participants with systems developed on their training data.