We recently set up Nessus, but the annual cost is not cheap. Recently Google published SkipFish which appears to compete in the area of webapps.
As best I can tell, Nessus operates via a large database of known exploits. And, as best as I can tell, Skipfish automatically generates vulnerability tests. Has anyone done a comparison of the effectiveness of these two approaches yet?