1. A method of determining whether software includes malicious code, comprising the steps of: providing a validation machine; instrumenting the validation machine with tools and monitors that capture the static and dynamic behavior of software; executing software on the validation machine; using the tools and monitors to log data representative of the behavior of the software during execution to detect vulnerable or malicious code; automatically performing one or more operations on the software to enhance the security of the software by neutralizing the vulnerable or malicious code; and flagging for human inspection activities that cannot be neutralized automatically.