The final review of Web application security scanners has been released by darkreading.

"As we wrap up our four-month Rolling Review series, we do want to award some partial credit. While only IBM's WatchFire AppScan automatically handled our Ajax applications, Acunetix Web Vulnerability Scanner, Cenzic Hailstorm and Hewlett-Packard WebInspect (post-update) were capable of analyzing and detecting vulnerabilities in the Ajax application, albeit only when we manually walked them through the relevant bits.

Unfortunately, that's just not good enough. Much of the value of a scanner is that it's a repeatable, exhaustive crawler. Requiring a human to replace the automated spider reduces the code coverage, and thus the effectiveness, of the scanner. So while we don't give those products a complete failing grade, they have a ways to go before they can claim to be truly Ajax-capable. Until then, expect to dig into code manually. "

Previous products
* Rolling Review: N-Stalker Web App Scanner
* Rolling Reviews: Cenzic Hailstorm
* Rolling Reviews: SPI Dynamics WebInspect

Review Link: http://www.darkreading.com/document.asp?doc_id=13563