HCL AppScan Reviews & Product Details

HCL AppScan is a comprehensive suite of market-leading application security testing solutions (SAST, DAST, IAST, SCA, API), available on-premises and on-cloud. These powerful DevSecOps tools pinpoint application vulnerabilities, allowing for quick remediation in every phase of the software development lifecycle. Fast and Accurate Scanning for Secure DevOps Developers and DevOps teams can quickly and accurately scan code, applications, and APIs for security vulnerabilities while applications are being developed. This allows companies to fix issues at the earliest stages of the software development lifecycle, when it is least costly to the business. Focus on the Fix Continuous monitoring with IAST, along with auto issue correlation with DAST and SAST scan results allows DevOps teams to group and prioritize findings for faster, more streamlined remediation. Enterprise Management for Security Teams Centralized, easy-to-use dashboards provide visibility and oversight of all security scanning and remediation, and allow users to set scan parameters and compliance policies.

Seller

HCL Technologies

Discussions

HCL AppScan Community

Languages Supported

English

Solution Type

All-in-One

Overview by

Alyson Kelly (Event Manager)

Used by Cognizant and 2 others

Beta

Pricing

Pricing provided by HCL AppScan.

Basic

$200.00

Per User With One-Time Purchase

View More Pricing Information

HCL AppScan Integrations

(32)

Verified by HCL AppScan

Show More Integrations

HCL AppScan Reviews FAQs

Generated using AI

Last updated: Nov 04, 2026

What is HCL AppScan, and what problem is it built to solve?

HCL AppScan is an application security testing tool used to find vulnerabilities in web applications, APIs, and code during development and before release. It helps teams review findings, prioritize remediation, and bring security checks into development workflows.

What company sizes and industries is HCL AppScan the best fit for?

The strongest fit in the reported customer mix is among enterprise and mid-market organizations, with representation across several technology and financial-services fields.

Enterprise: Organizations with more than 1,000 employees form a prominent segment.
Mid-market: Organizations with 51–1,000 employees are also well represented.
Industries: Information technology and services, computer and network security, and computer software are among the recurring fields.
Financial services: Banking and financial services also appear in the customer mix.

How long does it take to implement HCL AppScan across a team?

Implementation timelines vary, but one to three months is the most commonly reported range. Other reported timelines range from under a day to more than a year.

Time to go live	Relative frequency
1–3 months	Most commonly reported
Under 1 month	Also frequently reported
Under 1 day	Also reported
3–6 months, 6–12 months, or over 12 months	Reported in some implementations

What customer support options does HCL AppScan provide, and how do users find the overall support experience?

Support is available through phone, email/help desk, and self-service resources such as a knowledge base. The experience can be responsive and helpful, though users also describe delays and occasional difficulty getting issues resolved.

What features or capabilities could make HCL AppScan even more useful?

The most useful improvements would make setup and day-to-day scanning less demanding, while helping teams act on findings with less manual effort.

Simplify initial configuration, especially scan tuning and authenticated-scan setup, with clearer guidance for new teams.
Improve scan speed and reduce resource demands, particularly for large applications and deep scans.
Reduce false positives and make triage and vulnerability prioritization more straightforward.
Make reporting more flexible and easier to interpret, including clearer remediation priorities and customized exports.

Is HCL AppScan considered safe and secure for handling data?

HCL AppScan is used to identify vulnerabilities in applications and APIs, and teams describe using its findings and remediation guidance to address risks before release. Integrating scans into development workflows can make security checks more consistent. Results still need human review: false positives and findings that require manual validation are recurring considerations, so it works best as part of a broader security process rather than as a guarantee that every issue will be found.

G2 reviews are authentic and verified.

Here's how.

Gaurav S.

Security Engineer

Mid-Market (51-1000 emp.)

10/25/2026

"AppScan’s Strong DAST Heritage and Full AppSec Coverage in One Platform"

5/5

What do you like best about HCL AppScan?

Long DAST heritage: AppScan began as a dynamic scanner, and its web and API scanning is often viewed as one of its strongest areas. By contrast, some competitors started with SAST and only added DAST later.

Full testing coverage in one family: SAST, DAST, IAST, and SCA are available from a single vendor, whereas some rivals are notably stronger in only one or two of these areas.

Flexible deployment: It supports on-premises, cloud, and hybrid deployments. Some competitors are primarily SaaS, which can be a deciding factor for regulated or air-gapped environments.

AI-assisted triage: AppScan has introduced capabilities aimed at reducing false positives and helping prioritize findings. Others offer similar functionality as well, so this is more of a competitive requirement than a clear differentiator.

Mature enterprise reporting: Its compliance mapping and reporting features fit large organizations with audit and governance needs.

Legacy and mixed-language support: Because of its long history, it tends to cover a wide range of older technologies and mixed enterprise stacks. Review collected by and hosted on G2.com.

What do you dislike about HCL AppScan?

False positives: Like most scanners, it can flag issues that aren’t actually real, which means teams end up spending extra time on triage and tuning. Users often mention that this tends to be worse in SAST than in DAST.

Learning curve and setup: Getting scans configured properly—especially authenticated scans, complex login flows, and custom scan policies—can take time and usually requires some security expertise.

Scan speed: Deep scans on large applications can be slow. In a fast CI/CD pipeline, that can become a bottleneck unless you tune the scope and rely on incremental scans where possible. Review collected by and hosted on G2.com.

What problems is HCL AppScan solving and how is that benefiting you?

HCL AppScan is an application security testing suite from HCLSoftware (part of HCL Technologies). It helps identify security vulnerabilities in web apps, mobile apps, APIs, and source code, so teams can address issues before attackers exploit them.

Background: AppScan originally began at Watchfire, was acquired by IBM in 2007 (as IBM Rational AppScan), and has been owned and developed by HCL since 2019.

What it does: It brings together several testing approaches:

SAST (static analysis): scans source code for flaws without running the app.

DAST (dynamic analysis): tests a running application from the outside, similar to how an attacker would.

IAST (interactive testing): monitors the app from the inside while tests run, which can reduce false positives.

SCA (software composition analysis): checks open-source libraries and dependencies for known vulnerabilities and license risks.

How it’s delivered: It’s available as on-premises tools, a cloud-based service, and IDE and CI/CD integrations. This allows scans to run on a developer’s machine, in a build pipeline, or on a schedule. Product names and packaging have changed over the years, so it’s worth checking HCL’s site for the current lineup.

The on-premises option is especially useful for banks and the finance industry, where tighter control and governance are often required. Review collected by and hosted on G2.com.

Kishan T.

Network Administrator

Information Technology and Services

Mid-Market (51-1000 emp.)

10/20/2026

"HCL AppScan Delivers Actionable Vulnerability Detection and Clear Reporting"

4.5/5

What do you like best about HCL AppScan?

AppScan is its ability to identify security vulnerabilities in applications, provide actionable remediation guidance, and help development teams catch issues early in the software development lifecycle. It supports secure coding practices and strengthens overall application security through efficient scanning and clear, useful reporting. Review collected by and hosted on G2.com.

What do you dislike about HCL AppScan?

One downside of HCL AppScan is that scans can sometimes take time to complete, especially for large applications. The initial configuration may also require technical expertise, and some vulnerability findings need manual verification to avoid false positives. Review collected by and hosted on G2.com.

What problems is HCL AppScan solving and how is that benefiting you?

HCL AppScan helps us identify security vulnerabilities in our web applications and APIs early in the development process. It enables our team to spot potential risks, prioritize the most important issues, and address security weaknesses before deployment. As a result, our overall application security improves, we spend less time on manual testing, and it becomes easier to support compliance requirements. Ultimately, it helps us deliver software that is more secure and reliable. Review collected by and hosted on G2.com.

Ahmad J.

ICT Specialist 2

Information Technology and Services

Mid-Market (51-1000 emp.)

Originally submitted 9/24/2026

"Accurate Vulnerability Detection with Easy Setup and Strong Compliance Templates"

5/5

What do you like best about HCL AppScan?

I’ve found HCL AppScan to be pretty solid at catching real vulnerabilities without drowning me in false positives. It also covers both static and dynamic testing across a good range of languages, which is really handy. On top of that, it’s a strong fit if you’re working in a regulated space, plus the compliance templates save time. and getting it up and running hasn’t been a headache very easy to use Review collected by and hosted on G2.com.

What do you dislike about HCL AppScan?

Automatic alert APIs once a scan finishes, can be enhanced into CI/CD pipelines.

and also the support team is very good but the response time can be improved a bit Review collected by and hosted on G2.com.

What problems is HCL AppScan solving and how is that benefiting you?

Honestly, it saves me from discovering security problems the hard way specially after something is already live. It flags vulnerabilities early, both in the code and in the running app, so I can address them before they turn into real issues. It also reduces the time I waste chasing false alarms and makes it easier to stay compliant without a ton of extra work. Overall, it helps me build security into the process instead of scrambling to patch things later. Review collected by and hosted on G2.com.

G2 Icon

Luis A.

Delivery Manager Middleware & Automation (Technology Integration)

Information Technology and Services

Enterprise (> 1000 emp.)

10/31/2026

"If critical issues occur, attach the report to the release record"

4.5/5

What do you like best about HCL AppScan?

Normally, I'd include a scanner report that hadn't been opened. Every time the release manager asked if it would be okay to just ship. If something important is found, the build will fail and the report will be automatically attached to the release record. So there's no need for discussion before a launch. Quarterly: I haven't added any late security holds myself. No escalations. Review collected by and hosted on G2.com.

What do you dislike about HCL AppScan?

When we're building stuff, HCL AppScan stops our builds if it finds a critical issue, and the scan report comes out as its own document with the release. Review collected by and hosted on G2.com.

What problems is HCL AppScan solving and how is that benefiting you?

AppScan is integrated and captures build artifacts during the job execution. Dynamic scans log in with a series of logins and are against staging. We didn't need to get used to a new scale of severity for rules, as they've been grouped into OWASP categories and applied to the severity levels we already had in our release policy. I clear the blocked queue and allow exceptions. Review collected by and hosted on G2.com.

Marian C.

Data Engineer

Information Services

Enterprise (> 1000 emp.)

10/31/2026

"Integrated via Jenkins into our CI system"

4.5/5

What do you like best about HCL AppScan?

Since the code was added to the staging area, it was also added to the checkout service. It was found that there is a SQL injection path in the checkout service using HCL AppScan, which started identifying it before the merge. People just used to say "guessing" about it. Then an injection went on the radar of a penetration test for one of the pre-signed off modules and this one became a sprint and a customer notification. Review collected by and hosted on G2.com.

What do you dislike about HCL AppScan?

It took me a couple of weeks to get the first rule-set. There were hundreds of false positives in the default profile, and trust in the report was lost before the very start of the sprint review in our framework helpers. I stamped down those helpers and repeated the scan until all of the other findings were done by hand. Review collected by and hosted on G2.com.

What problems is HCL AppScan solving and how is that benefiting you?

The rule-sets are based on the OWASP categories. Dynamic scans against staging authenticate by replaying recorded series of logins. This means the scanner can navigate to pages behind the session wall that otherwise remain hidden. For each finding, the following info is exported as a ticket: Just to let you know, the file path, severity and data flow trace are all there. Review collected by and hosted on G2.com.

Aakash P.

Senior Data Analyst

Information Technology and Services

Enterprise (> 1000 emp.)

10/29/2026

"Reliable API & Web Security with Intelligent Threat Detection and Solid Performance."

5/5

What do you like best about HCL AppScan?

'Amazing' Performance directs attention to potential security threats, cutting away the noise thanks to AI and intelligence. Its scanning capabilities in large data portals are outstanding, as well as the native integration with Jira and Jenkins enabled us to integrate security checks into our current process. Review collected by and hosted on G2.com.

What do you dislike about HCL AppScan?

Several parts of UI/UX are cluttered while exporting customized metrics for compliance. The enterprise pricing is a bit tricky to manage and the technical support responsiveness when first joining the team was below what we'd hoped to be in that situation. Review collected by and hosted on G2.com.

What problems is HCL AppScan solving and how is that benefiting you?

It removes any gaps that are present in our customer-facing analytics applications and our internal data pipelines. We detect SQL injections and flaws in APIs at an early stage by automating both static and dynamic tests. This not only reduces countless hours that can be spent on manual log auditing, but it also accelerates project delivery and results in a positive ROI whilst ensuring safety of client data. Review collected by and hosted on G2.com.

Brandon R H.

System Software Developer

Telecommunications

Mid-Market (51-1000 emp.)

10/28/2026

"It has significantly assisted in streamlining our process."

4.5/5

What do you like best about HCL AppScan?

We've seen a big improvement in application security, which has had a huge impact on how we work: HCL AppScan. It's been great at bringing together different testing techniques, saving a lot of overhead. The autofix feature in HCL AppScan uses AI to save time, and agentic automation helps highlight high-risk vulnerabilities while minimising noise. This helps us to keep the trust and reduce risk. We had to do some pretty hands-on learning to get the hang of it, but we're big fans of HCL AppScan. Review collected by and hosted on G2.com.

What do you dislike about HCL AppScan?

Actually, HCL AppScan is a big investment, especially as it's a subscription-based platform with custom enterprise licensing on offer. But, given the benefits of lowering errors, ensuring compliance and achieving a secure software delivery without any blind spots, we always agree that the return on investment for secure delivery, day-to-day, makes it worth our while! Review collected by and hosted on G2.com.

What problems is HCL AppScan solving and how is that benefiting you?

HCL AppScan's advanced AI feature is what makes it special, as it can detect and fix vulnerabilities. The GenAI-powered autofix feature and LLM-driven remediation are a key strength and a vital part of what's making our turnaround possible. The Auto Issue Correlation – this is a great tool that connects the dots between the findings of all scan types (SAST, DAST and IAST) to confirm the exploitability and prioritise remediation. Review collected by and hosted on G2.com.

Prateek K.

Associate Vice President

Mid-Market (51-1000 emp.)

10/27/2026

"Effective Application Security Testing"

4/5

What do you like best about HCL AppScan?

What I like best about HCL AppScan is its ability to identify security vulnerabilities early in the development lifecycle, helping teams improve application security and reduce risks. Its automated scanning, detailed reports, and actionable remediation recommendations make it easier to detect and address potential security issues efficiently. Review collected by and hosted on G2.com.

What do you dislike about HCL AppScan?

Some scans can take time to complete, and the results may occasionally include false positives that require manual validation. The user interface and reporting could also be more intuitive, with clearer prioritization of vulnerabilities and more actionable remediation guidance to improve the overall user experience. Review collected by and hosted on G2.com.

What problems is HCL AppScan solving and how is that benefiting you?

HCL AppScan helps identify security vulnerabilities in applications early in the development process, which reduces the risk of security breaches and compliance issues. It allows developers to address potential threats proactively, strengthens overall code security, and cuts down on the effort needed for manual security testing. As a result, we can deliver more secure applications, improve development efficiency, and minimize security risks before deployment. Review collected by and hosted on G2.com.

Kamal Kumar M.

Senior Information Technology Security Analyst

Enterprise (> 1000 emp.)

10/27/2026

"Powerful AppSec Scanning and CI/CD Reporting, Though Tuning Takes Work"

5/5

What do you like best about HCL AppScan?

I like that HCL AppScan quickly identifies vulnerabilities in code and running applications before they reach production. Its automated scanning gives developers actionable findings so they can fix issues faster. I find the SAST and DAST scanners valuable for covering both code and runtime, and the triage and baselining features help reduce noise and focus on what matters. The CI/CD integrations, reporting, and dashboards make it easier to standardize and automate security checks, and provide clear, audit-ready visibility across teams. I also find that prioritization and reporting make remediation and compliance tracking easier, and that basic installation and the first scans were straightforward. Review collected by and hosted on G2.com.

What do you dislike about HCL AppScan?

I still spend time triaging false positives, and scan tuning and configuration aren’t as intuitive as they could be. Scans can be resource-intensive on larger apps, and the UI and report customization could be more streamlined. I’d like guided presets and clearer explanations of how settings affect coverage, runtime, and false positives. DAST setup also needs simpler, more reliable authentication and actionable error messages when login or session handling fails. Basic installation and first scans were straightforward, but fine-tuning rules and configuring DAST authentication took the most time. Review collected by and hosted on G2.com.

Bhagyashree K.

Consultant

Mid-Market (51-1000 emp.)

10/26/2026

"Gets Straight to the Root Cause"

4/5

What do you like best about HCL AppScan?

Comprehensive Coverage: Unified SAST, DAST, and SCA in a single platform, eliminating tool fragmentation. Low Noise & Actionable Fixes: Intelligent Finding Analytics cuts false positives and provides clear source-to-sink code tracing for fast remediation. Seamless DevSecOps: Plugs easily into CI/CD pipelines (Jenkins, GitHub, GitLab) and outputs audit-ready compliance reports (OWASP Top 10, PCI-DSS). Review collected by and hosted on G2.com.

What do you dislike about HCL AppScan?

High Resource Usage & Scan Times: Large codebases and deep dynamic scans can take considerable time and strain system resources. Complex Configuration: Tuning rules and authentication flows to avoid false alarms has a steep initial learning curve. Legacy UI/UX: The interface feels heavier and less intuitive than lightweight, modern developer-centric security tools. Review collected by and hosted on G2.com.

What problems is HCL AppScan solving and how is that benefiting you?

Problem Solved: Eliminates emergency hotfixes and deployment delays caused by catching critical security bugs at the tail end of QA. Direct Workflow Benefit: Saves hours of triage time by distinguishing real attack paths from theoretical vulnerabilities, giving our engineering team clean, prioritized tasks. Business Benefit: Gives our leadership and audit partners immediate, verifiable visibility into compliance standards without requiring manual security audits for every release. Review collected by and hosted on G2.com.