Conventional static analysis tools come nowhere close to catching all bugs, even accounting for the false positives.