Anyone have experience with nexpose or other automated penetration testing?

We just asked for, and got, our first audit, from our university's nexpose install. A lot of it seems pretty legit, most of it I knew before hand. Considering that zero holes out of umpteen thousand is the score you want, what's a "good" score? How does nexpose stack up to nessus, etc?

Also, how do people handle xss? Do you prefer sanitizing all your own code or do you run mod_security? How do you handle mod_security's stringency? Are there well-established "looser" and "tighter" rule sets out there?

All questions of a med student working on a side project for no money: I'm unabashedly trying to optimize both time and money and quality. "Pick two" is not the advice I'm looking for. I would greatly appreciate actual comparisons based on your experience and suggestions I can act on.