One of the easiest ways to overcome security vulnerabilities, is to prevent them from being written into the code. Microsoft is doing a good (not great, but good) job stepping up to that challenge. The advances in FxCop/Code Analyzer look promising. Also, the anti-XSS library is looking good, and has benefited from some interaction with RSnake. Get your developers to start playing with these.