## 1 Introduction  
In recent years, the use of web applications has increased in many types of organizations, such as public and private, government, critical infrastructures, etc. These applications have to be continuously developed in the shortest time possible to face the competitors. Therefore, developers make programing security vulnerabilities or use third-party modules or components that are vulnerable. Sometimes they have limited budgets. These cases often make them forget an essential component within the development life cycle--security. In addition, companies find that developers do not have enough security knowledge, which increases the risk of producing insecure developments. Taking into account the different types of analysis security testing (AST) [1] and the great amount of security vulnerabilities that web applications have in their code and configurations, it seems necessary that the security analyst making a security analysis should select the best static (SAST), dynamic (DAST) and interactive (IAST) analysis security testing tools in combination. The results of several studies [2; 3; 4] confirm that the web applications analyzed did not pass the OWASP Top Ten project [5]. SQL injection (SQLI) and cross site scripting (XSS) vulnerabilities continue to be the most frequent and dangerous vulnerabilities. Several tools of the same type can be combined to achieve a better performance in terms of true and false positives [6; 7; 8; 9]. Several works have also shown that better ratios of true and false positives can be obtained by combining different types of techniques to leverage the synergies that different type of tools can have [10; 11; 12]. These works show how a tools combination can reduce false positives (detected vulnerabilities that do not really exist) and false negatives (real vulnerabilities not found). Analyzed works concluded that each security vulnerability included in an AST tool report, including manual reviews, is required to be verified. False positives are not really a danger and can be fixed by the security analyst. However, a false negative is more difficult to find if the tool has not previously detected it, causing a real danger. These techniques include the use of static white box security analysis (SAST), dynamic black box security analysis (DAST) or interactive white box security analysis (IAST) tools. Manual analysis requires highly specialized staff and time. To carry out an analysis of web application security, using any method, it is necessary to cover the entire attack surface accessing all parts and application layers and using tools to automate security analysis as much as possible. There are some questions to investigate:  
* How is each type of AST tool's average effectiveness, considering each type of vulnerability without combination? * How is each type of AST tool's combinations average effectiveness, considering each type of vulnerability and the number of tools in a combination? * How is each type of AST tool's average effectiveness at detecting OWASP Top Ten security category vulnerabilities without combination? * How is the n-tools combination's average effectiveness at detecting OWASP Top Ten security vulnerabilities computing different metrics? * Which are the best combinations for analyzing the security of web applications with different levels of criticality? It is necessary to establish in the organizations a Software Development Life Cycle (SSDLC), as defined in the work of [PERSON] et al. [13], in order to standardize the use of SAST, DAST and IAST tools with the objective of deploying in production web applications as secure as possible. This work aims to be the first of its kind--to study the best way to combine the three types of security analysis tools for web applications.