if you want really good security, and long term (there is also better support for rescanning etc) - Checkmarx, but with no little investment.
btw, between hp and ibm - language support can tilt strongly in hp's favor. general level of non-crappiness goes to ibm.
it does come with, out of the box, a couple hundred vulnerability queries, which are very generic, and very useful.
e.g. XSS, SQLi, passwords, etc etc. the usual stuff.
you can also customize these existing queries - using a form of polymorphism - to fit your code/environment/infrastructure.
e.g. SQLi doesnt find anything, because you're using a special DB - with Cx you can customize just the part of the query that defines what a database is.
good luck with getting any sense out of any tool. Except maybe splint.
on top of that, you can tailor queries specific to your app, or special things that you want.
e.g. a custom authorization mechanism - find misuse, lack of use, etc.
so these customizations dont really make sense to share generically.
the company does tend to roll in any new vuln queries offered them, though.
