How do we evaluate application security testing tools when we only have one junior developer who handles all our web app deployments?