Two tools that I use regularly to check Java artifacts: FindBugs: http://findbugs.sourceforge.ne... OWASP Dependency Check: https://www.owasp.org/index.ph...

Even 0.0023% of the population can give a surveyor an accurate result. It all depends on the way the population was sampled. Sampling can be a science in itself though. http://en.wikipedia.org/wiki/Sampling_(statistics)