HCL AppScan Reviews & Product Details

AppScan is its ability to identify security vulnerabilities in applications, provide actionable remediation guidance, and help development teams catch issues early in the software development lifecycle. It supports secure coding practices and strengthens overall application security through efficient scanning and clear, useful reporting. Review collected by and hosted on G2.com.

One downside of HCL AppScan is that scans can sometimes take time to complete, especially for large applications. The initial configuration may also require technical expertise, and some vulnerability findings need manual verification to avoid false positives. Review collected by and hosted on G2.com.

I’ve found HCL AppScan to be pretty solid at catching real vulnerabilities without drowning me in false positives. It also covers both static and dynamic testing across a good range of languages, which is really handy. On top of that, it’s a strong fit if you’re working in a regulated space, plus the compliance templates save time. and getting it up and running hasn’t been a headache very easy to use Review collected by and hosted on G2.com.

Automatic alert APIs once a scan finishes, can be enhanced into CI/CD pipelines.

and also the support team is very good but the response time can be improved a bit Review collected by and hosted on G2.com.

I use HCL AppScan to catch security risks like SQL injection and cross-site scripting early, before release. Automating static and dynamic scans reduces manual work for our security team, and the detailed remediation advice gives developers clear context and instructions to fix issues faster. I like that CI/CD scans run seamlessly during automated builds and catch issues before code reaches production, helping keep releases on schedule and saving hours of back-and-forth between security and development. Having both SAST and DAST in one platform also helps us maintain consistent security coverage across projects. The deployment was smooth for basic static scanning. Review collected by and hosted on G2.com.

I find the interface in some legacy modules slightly outdated. Setting up dynamic scanning rules takes extra effort to eliminate false positives, and fine-tuning the CI/CD integrations required some initial effort from our security engineers. Review collected by and hosted on G2.com.

The most unique aspect of HCL AppScan is its "Independent AI Verifier" architecture and Agentic-AI remediation ecosystem.While many AppSec platforms use basic AI to suggest fixes, HCL AppScan acts as an independent auditor specifically designed to secure code generated by humans and other AI coding assistants Review collected by and hosted on G2.com.

Steep Learning Curve and "Heavy" UI: The interface, especially for HCL AppScan Standard (the desktop application), can feel dated, cluttered, and overwhelming for developers. Configuring complex scans or advanced filters requires specialized security expertise rather than a plug-and-play experience. Review collected by and hosted on G2.com.

Flattering and elegant Complex Vulnerability Data that are as simple as Brilliant UI/UX. It possesses this incredible AI intelligence that filters the false positive with a screening that's absurdly correct. This provides us with fast scanning speeds, and allows our team to deploy secure code quickly, with confidence. Review collected by and hosted on G2.com.

The onboarding and support are a little tedious on this extremely strong system. That's certainly something that's going to come at a higher initial cost, but a sense of security for your security can easily be used to warrant it in enterprise environments. Review collected by and hosted on G2.com.

What I like best about HCL AppScan is the UI/UX. In my experience, security tools are often clunky and difficult to navigate, but AppScan’s dashboard is intuitive and well-organized. The newer interface (especially in the 360 version) has a clean look and feel that makes it much easier to triage issues and navigate through complex scan results without getting lost. It strikes a good balance between providing deep technical data and remaining user-friendly for daily use.User-Friendly Interface Review collected by and hosted on G2.com.

On the downside, I find the Pricing/ROI to be a sticking point. It is definitely an enterprise-grade investment, and for smaller teams, the cost can be prohibitive. Additionally, while the Performance is generally solid, I have found that the initial setup and tuning require a significant time investment to get the scanning speed right and reduce false positives. The onboarding process for new users can also be a bit heavy if you aren't already familiar with the ecosystem. Review collected by and hosted on G2.com.

I appreciate HCL AppScan for its ability to catch bugs directly in the source code before deployment, which saves me a lot of headaches. The "bring your own language" feature is fantastic, as it isn't limited to just one language, making it versatile for my needs. I love the customization options, including custom rules and knowledge, which allow me to tailor scans specifically to my codebase. This flexibility not only makes the tool very simple to use but also helps me avoid wasting time, letting me invest my time in other tasks. The ease of integration with Jenkins is another standout feature for me, making it one of the best things about what HCL offers. Plus, the initial setup was straightforward and didn't require much technical staffing, and that adds to the overall ease of use. Review collected by and hosted on G2.com.

I would like more automation because the manual work and effort is still a thing, especially in triaging results. Review collected by and hosted on G2.com.

I find HCL AppScan incredibly valuable for its ability to give us a consistent structure for release checks, while still leaving room for technical judgment about what matters in our environment. The ease of taking a finding back to developers, working through it, and then rescanning to verify fixes is the most valuable part for me. It provides a common starting point for discussions about security issues with the ICT team and developers, and the follow-up scans help ensure issues are resolved. This practical side is more beneficial than simply having a large number of findings, as it allows us to focus on actionable items. I appreciate that it fits well with the way our ICT team works through application changes. Review collected by and hosted on G2.com.

The part that still takes care is turning the findings into a sensible work list. We need to review them in the context of the application rather than treat every warning as equally urgent. From an admin's perspective, I would like a clearer route from the initial results to what needs attention first, with less effort spent explaining the priorities to different people. It is useful as part of our security checks, but it still needs someone technical to interpret the results and follow through with the developers. A clearer summary of why a finding matters, what to check before assigning it and what a successful fix should look like would help. I would also like it to be easier to distinguish work needing immediate attention from items that can be planned into a later release. The aim would be to spend less time sorting the results and more time getting the right issues fixed. Review collected by and hosted on G2.com.

What I like most about HCL AppScan is its deep scanning capabilities across both DAST and SAST, making it easy to spot critical vulnerabilities like SQL injection, XSS, and misconfigurations early in the development lifecycle. The actionable remediation guidance saves our team a ton of research time by pointing directly to the affected code lines and suggesting exact fixes. On top of that, its seamless integration into CI/CD pipelines allows us to automate security checks without slowing down deployment speeds. Review collected by and hosted on G2.com.

What I dislike most about HCL AppScan is that the user interface can feel dated and clunky, requiring a bit of a learning curve for team members who are new to the platform. Deep, comprehensive scans can also take a significant amount of time to complete and occasionally consume heavy system resources. Additionally, filtering out false positives still takes a noticeable amount of manual triage effort before passing actionable reports over to the engineering team. Review collected by and hosted on G2.com.

It provides end-to-end coverage in a single platform. Rather than using separate tools for SAST, DAST, IAST, SCA, and API testing, HCL AppScan brings these capabilities together in one dashboard. Review collected by and hosted on G2.com.

My biggest practical dislikes are the false positives, performance on large targets, the cost, and the amount of effort required to get the most out of it. I also run into occasional bugs and incomplete functionality. On top of that, there are gaps in the documentation and troubleshooting guidance, and I have some concerns about scalability. Review collected by and hosted on G2.com.