Have you had a security audit done on your web application? If so, can you please share your experience and vendor? It is one of the PCI requirements.
We use McAfee Secure and have been happy with the service. I had to call their customer service department several times during the process and they were very helpful and had a lot of knowledge on the whole process of PCI compliance. We were able to scan as many times as we needed to in order to get problems fixed and become certified.