I'm interested in knowing how many vulnerabilities in production code were actually detected. In my former companies, we used Fortify and Zalewski's old tool (

I'm interested in knowing how many vulnerabilities in production code were actually detected. In my former companies, we used Fortify and Zalewski's old tool (seems to have dropped off the grid) with little benefit. The False Positive Rate was just too high for anything beneficial to come out of the so-called automated approach. We had engineers parse through tens of thousands of hits with no real vulnerabilities being found; this made the whole process a drudgery and a financial blunder in terms of work hours and licensing fees. On the dark side of the security industry, some people were making a lot of commission money on million dollars a year inert tools, because the business folks wouldn't get it. To the best of my knowledge this is still a very open problem in the industry, and if any mention is made of it, in compliance standards or in implementations, it just serves as security theater.