I guess you can combine the points: if you use static analysis from the start / have it configured right then the amount of false positives should stay relatively low.