AppScan (IBM Security AppScan) is a commercial penetration testing tool that dynamically tests web applications for security vulnerabilities. It automates the process of finding security flaws. Ounce and DevInspect are static tools, while FxCop is for .NET static analysis.