What do you like best about HCL AppScan?
What I like most about HCL AppScan is the clarity with which it presents security results. When it detects a vulnerability, it not only indicates where the problem is located but also provides clear information and recommendations for its correction. This greatly facilitates communication with the development team, as I can share the evidence of the finding along with concrete guidance on how to remediate it. In practice, this reduces the time needed to analyze the results and considerably speeds up remediation.
I also highly value its integration with tools we commonly use, such as Jira, Jenkins, and GitLab. These integrations allow security analyses to be incorporated directly into development and CI/CD workflows. For example, findings can be turned into follow-up tickets and assigned to the corresponding team, avoiding the need to perform this process manually and facilitating the tracking of vulnerabilities until their resolution.
Another feature I find especially useful is the ability to perform SAST and DAST analyses. This allows me to identify vulnerabilities during different stages of the development cycle and reduce the number of issues that reach pentesting or, worse yet, production. In my experience, this has helped me save hours of work during pentesting windows and focus that time on vulnerabilities that require deeper analysis.
Regarding AI and intelligence, I find HCL AppScan's ability to analyze and organize security results in a way that makes it easier to interpret the findings and determine which ones require priority attention particularly useful. The recommendations and contextual information it provides help reduce the time I would normally spend manually interpreting each result. This is especially valuable when many findings are generated because it allows focusing on the issues with the greatest impact and facilitates decision-making about their remediation.
In terms of performance, HCL AppScan allows me to perform security analyses efficiently and automatically, especially when integrated into CI/CD processes. This reduces the number of manual reviews needed and allows security issues to be identified earlier. Additionally, the ability to prioritize findings makes it easier for the team to focus first on the highest-risk vulnerabilities, making better use of the available time.
From the perspective of price and return on investment (ROI), I consider the greatest value to be in the time it saves in detecting, documenting, assigning, and tracking vulnerabilities. Integration with Jira, Jenkins, and GitLab eliminates several manual tasks and ensures that findings reach the teams responsible for correcting them directly. Moreover, detecting vulnerabilities during the early stages of development helps prevent issues from reaching production, where their correction could require much more time and resources. Therefore, although the cost should be evaluated according to the size and needs of each organization, in my experience, the time savings, automation, and reduction in remediation effort justify the investment.
An additional benefit I have found is that HCL AppScan helps establish a more continuous and automated security process. Instead of relying solely on manual reviews or spot tests, it allows security controls to be incorporated into the regular development flow. This facilitates early detection of issues, improves collaboration between security and development teams, and reduces the risk of critical vulnerabilities reaching production and subsequently becoming much more costly incidents or remediation efforts. Review collected by and hosted on G2.com.
