New methods for attacking web applications are growing in volume, complexity and frequency. Organizations should regularly scan Web applications for vulnerabilities and push for early testing. Because many organizations may not have the resources to do this internally, Web application security solution vendors should provide their scanning capabilities in multiple ways - as a product, as a service or in a hybrid model that combines both approaches. Neil MacDonald