What kinds of tools work? How best to use tools? What doesn't work?

Hi -- I'd like to know what people here think about
tools to find/counter security vulnerabilities
(source scanning tools, fuzzers, etc.).

Can people here post their thoughts on how effective various tools are?
What works? What doesn't?  Are there tools or types of tools
that seem to be really effective, & when, or are they all hopeless?
What are the best ways to use them?  Is there any way to tell
that a tool is more effective than using only eyeballs & grep?

I _am_ the author of Flawfinder, but I'm not looking for
comments specifically on that. Instead, I'm trying to learn more
generally what works & what doesn't.  You don't need to
sugar-coat things; if something just isn't helpful, say so.

I'm aware of the info about security auditing tools at:
  http://www.debian.org/security/audit/tools
but that page just describes how to USE a few tools.
I want to know what tools/approaches seem to be EFFECTIVE.

Thanks for your time!!

--- David A. Wheeler