1. A system for identifying and tracking application vulnerabilities, comprising: an interface operable to receive a plurality of applications from one or more business units, each of the plurality of applications comprising source code; a processor communicatively coupled to the interface and operable to: identify a vulnerability associated with the source code of each of the plurality of applications; and identify a vulnerability type; the interface further operable to: communicate the vulnerability to one of a plurality of specialists for confirmation, the specialist chosen based on, at least in part, the vulnerability type; and receive a confirmation that the vulnerability is not a false positive; a memory communicatively coupled to the interface and the processor and, after receiving the confirmation, operable to store the vulnerability and the source code associated with the vulnerability in a vulnerability database; the processor further operable to create a vulnerability tag for the vulnerability stored in the vulnerability database; and the memory further operable to store the vulnerability tag for the vulnerability in a reporting database; and the interface further operable to communicate an alert, the alert automatically generated when the vulnerability has a status date greater than a predetermined period of time.