"Should I get a manual review or just run a scanner" is a question I hear framed as an either-or a lot more often than it should be. The honest answer is that they're built to catch genuinely different kinds of problems, and most apps benefit from both rather than picking one over the other.
What an automated scanner is good at
A scanner checks a known, well-defined list of patterns quickly and consistently: exposed keys, missing access rules on a database, common misconfiguration patterns that show up repeatedly across thousands of apps built the same way. It doesn't get tired, doesn't skip a check because it's the fifth app that day, and can check an entire app in minutes rather than hours.
What an automated scanner structurally can't do
A scanner checks for patterns it was built to recognize. It generally can't reason about your specific business logic: whether a discount code should only apply once per customer, whether a specific workflow lets someone skip a step they shouldn't be able to skip, whether two features that are individually fine combine into a problem when used together in a particular order. Those require actually understanding what the app is supposed to do, not just what it's built out of.
What a manual review adds
A person actually testing the app, trying to break specific workflows, thinking through what a motivated user might try, can catch exactly the category of issue a pattern-based scan structurally can't reach. It's slower, and it costs more per check, but it reaches a different layer of the app entirely.
What a manual review isn't good at
Speed and consistency. A manual review over a large app takes real hours, sometimes days, and quality varies with who's doing it and how much time they actually spend. Running the same review twice a week apart won't reliably surface the same findings a scanner would catch identically both times.
How I'd actually think about it
A scanner as the fast, repeatable first pass, catching the common, well-defined issues before anything else, and a manual review for the business-logic and workflow-specific risk a scanner can't see, especially before anything handling real money or real customer data goes live. Neither replaces the other. They're solving different halves of the same problem.