Ahh, you do web applications. Then you might like my summary of state of the art for <i>that</i>:<p><a href="https:&#x2F;&#x2F;www.schneier.com&#x2F;blog&#x2F;archives&#x2F;2014&#x2F;04&#x2F;the_security_of_8.html#c5626550" rel="nofollow">https:&#x2F;&#x2F;www.schneier.com&#x2F;blog&#x2F;archives&#x2F;2014&#x2F;04&#x2F;the_security_...</a><p>It&#x27;s due for an update in near future with resources that a few people here shared with me. Still has lots of interesting stuff, though. Might not help in your day job as you can&#x27;t dictate the stuff to management or dev team. However, you could enjoy doing it in private on FOSS project exploring those tools or improving&#x2F;cloning them for others.<p>There&#x27;s also projects that try to automate prevention of known classes of bugs. If you find some easy to use, maybe bring it to attention of your management showing they make QA more efficient &amp; liability lower while requiring no extra costs on dev&#x27;s part. Win-win.