I want to find all of the security bugs. I'm sure you do too.
(Click here to skip all the background info and just jump to the two one-liners.)
Some security bug classes are easy to find at scale through automated dynamic security scanning. Maybe you're also doing some manual application penetration testing. And maybe you can invest the time to perform in-depth manual code review of important portions of an application, such as core libraries and high-value actions. But a high-impact vulnerability -- such as remote code execution -- in an insignificant, overlooked portion of your codebase can ruin your day. Automated code review needs to play a part in any software security effort.