IBM has bought Ounce Labs, a privately held Massachusetts company whose security and compliance widgetry will be integrated into IBM's Rational AppScan line. Financial terms were not disclosed.

Ounce Labs scans source code to identify potential security and compliance vulnerabilities during the early stages of software development when they are less expensive to correct. It can also assess and remediate the level of risk posed.

IBM says many application vulnerabilities can be prevented or avoided by taking a pre-emptive approach to security.

And it quotes NIST, the National Institute of Standards and Technology, as reckoning that 80% of development costs are spent identifying and fixing defects.

Building an early warning system into the development and delivery process is supposed to help prevent at least some of these issues from arising.

Rational general manager Daniel Sabbah observed that "The complexity of today's systems and the sophistication of attacks require comprehensive technology. The acquisition of Ounce Labs allows IBM to provide customers an end-to-end application security testing solution for managing security and compliance across all stages of the software delivery process."