If I had to do it my way in your situation on the pay for play + freeware model I would go for:

Network and vulnerability scanning:
1.   Nessus (cheaper ~ 3600$ for 3 licenses, very good product, and we already have it)
+ OpenVAS
+ Metasploit Express
+Hailstorm

Database vulnerability scanners
SQL Ninja http://sqlninja.sourceforge.net/
Typhon III (http://www.ngssoftware.com/services/software-products/Internet-Security/TyphonIII.aspx)
NGS *anything* (http://www.ngssoftware.com/services/software-products/Database-Security.aspx)


Web application
1.   Burpsuite pro – 225$ plus Accunetix – 5000$
2.   Webinspect – 6000$
Wikto
N-Stalker over Acunetix

Penetration testing
1.   Core impact
Canvas (period)

For the reasoning... Metasploit + OpenVAS alongside Nessus for network mapping AND vulnerability scanning. OpenVAS because its free and sometimes their signatures are more accurate on the "low day" exploits... What the heck is low day? Low day is a term I'm throwing out there for exploits that are in the wild yet have no defined CVE, author, etc., for example, my mushroomcloud is not necessarily 0day because I semi disclosed it. It is a known problem that affects Trend Micro which in turn messes up VMWare. So "low day" it is a visible threat and sort of known... Hailstorm is an excellent (albeit pricey) tool which complements the other two... Now why Metasploit for scanning/vuln testing? Its capable of accurately finding the low hanging fruit quickly.

DB Vuln Testing tools... I selected SQL Ninja because its free and a kick .... tool.  Typhoon and anything else from NGS. I say this because of Dave Litchfield. He is the defacto db pimp and knows his stuff

Web app tools: Burpsuite is worth the money and Webinspect is a little noisy not to mention you HAVE TO (repeat HAVE TO) fiddle with your timing variables and depth of scanning otherwise it WILL take out your servers. Wikto is a definitive must. Acunetix you can do without if you'd like me to I can make you a quickie video using a real time comparison of a known to be vulnerable server of mine using Acunetix versus N-Stalker. N-Stalker is capable of finding and drilling down into a lot more than Acunetix can. While Acunetix WVS is ok, its not all that.
N-Stalker over Acunetix

Core Impact if you can afford it but a MUST is Canvas period. If you can fork out for the exploit packs even better (D2 Exploit pack, etc.)

Canvas is 1/10th the cost of Core

BTW - for full disclosure: I work for Rapid7, the company behind the Metasploit Project and the commercial editions of Metasploit.

Chris