Burp Suite Pro is indeed the tool of the trade when performing penetration testing of web applications. I would however not call it an automated tool.
While it contains some automated test functionality (Active Scan), using this functionality will by no means give you a conclusive answer on whether there are vulnerabilities present in your application. As an example in my case, I use Active Scan together with other tools and techniques to perform attack surface analysis, so figuring out interesting parts of the application that can receive some priority when looking for bugs.
I would strongly suggest to enlist the help of a professional security company to perform the security assessment and to also verify whether the application and system in question has been compromised in the previous attack.
That being said, I do indeed think it's a good idea to use tools like Burp during the development cycle, and also to invest in secure development training.