Jeremiah Grossman (WhiteHat Security, Inc.) has written an interesting article on automated vulnerability scanners and the limitations of these tools in finding real life web application vulnerabilities .

The challenges of automated web application vulnerability scanning is a subject frequent debate. Specifically because most websites have vulnerabilities (a lot of them) and we need help finding them quickly. The point of contention revolves around what scanners are able to find, or not. Using the OWASP Top Ten as a foundation, I published a white paper describing in detail how scanners approach certain complex situations. There is some marketing-fu within the pages, but the majority of the is content rich. Enjoy! "Automated Scanner vs. The OWASP Top Ten" http://www.whitehatsec.com/home/assets/OWASPTop10ScannersF.pdf