Fortify Software has a new tool for figuring out how well Web applications have been tested for vulnerabilities with the idea of making the applications safer.

Called Fortify Tracer, the product figures out what lines of code make an application vulnerable so the customer can patch it.

Tracer works in conjunction with automated application testers called black boxes that simulate attacks on points that take in data. WatchFire's AppScan is one such black box product, and Fortify has a partnership with WatchFire. If a black box discovers vulnerabilities, customers can take steps to patch them.

The problem with black boxes is there is no way to measure how thoroughly they do their job. So Tracer positions software sensors around all the possible points of attack in an application and records whether each has been probed by the black box.

If Tracer finds, for example, that a black box security test tried only 20% of the attack points, a business would want to improve the test. At the same time, if the black box discovers flaws, Tracer pinpoints the lines of code involved in the vulnerability.

"This gives us insights into what's happening in an application when we're doing a limited test," says Brian Holyfield, co-founder of Gotham Digital Science, a consultancy in New York City that tests application security for businesses.

Holyfield says Tracer can be used to satisfy his customers as well. "It validates you've done a comprehensive test because it documents the results," he says.

Tracer works on any Web application.