Automated vuln scanning seems to wax and wane in utility. I tend to use a lot of them to augment my work. Automated web app scanners tend to lag heavily behind

Automated vuln scanning seems to wax and wane in utility. I tend to use a lot of them to augment my work. Automated web app scanners tend to lag heavily behind the current "trends" in web development - for example, only recently did BurpSuite start properly supporting auditing single page apps, and it still misses loads of shit. Fuck, almost none of them can handle OpenAPI or Swagger specs properly, let alone WSDL files. Handling complex authentication flows is still a nightmare, and almost none of the commercial scanner offerings have ways to "hook" or "trace" the app under test.