The topic of "Security tools" and the vagueness of the questions are way too open for a reddit comment.
From a basic approach standpoint, scanning tools are a reactive -and all too often useless- tool, and security needs to be a proactive process.
"Malware" just doesn't work on web servers like it does on desktop. The environments are too varied, as is the code and the form the malware takes. A compromised WordPress site may be getting its bad code from an injection into what used to be a legitimate plugin file. The only way to find the file automatically would be to diff the files against source, which really can't be done in practice with any regularity or reliability.
The form the malware takes may also not be apparent to scanning tools. Not every hacked site is delivering known viruses to their clients. It could be mining bitcoins, sending spam, or just waiting on the ready to partake in a DDOS.
So security is proactive. Configurations and understanding your potential attack surface matter. I would begin by looking into penetration testing. There are Linux distros dedicated to finding holes.
At some point, security and convenience will clash and compromises need to be made. Part of security is disaster recovery and having a plan to restore backups and what the process of cleansing looks like. Sometimes restoring from a backup won't be enough, if you're simply restoring hacked code.
How you handle 200+ websites depends on how much control you have. Are these sites on shared hosting servers run by another company? They're all insecure.
Are they hosted on a dedicated server you run? That's potentially better, but you're still placing everyone in the same pool.
Can you divide your customers into their own VMs? That's getting much closer to ideal.
TL;DR It sounds like a non-answer, but front-end scanning is useless. The best tool is understanding your attack surface and how to recover in the event of a breach.