This paper examines the current dilemma that security auditors face with the bottleneck for Web application deployment, it also presents strategies that can help security auditors navigate through the rough waters by enlisting software development personnel in the Web application security effort.