Two tools that I use regularly to check Java artifacts: FindBugs: http://findbugs.sourceforge.ne... OWASP Dependency Check: https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fwww.owasp.org%2Findex.ph...

Even 0.0023% of the population can give a surveyor an accurate result. It all depends on the way the population was sampled. Sampling can be a science in itself though. http://en.wikipedia.org/wiki/Sampling_(statistics)