G2

Hussain N.

Senior Information Security Engineer

Enterprise (> 1000 emp.)

8/27/2026

"Deep DAST/SAST Scanning with Actionable Fix Guidance and Smooth CI/CD Integration"

4.5/5

What do you like best about HCL AppScan?

What I like most about HCL AppScan is its deep scanning capabilities across both DAST and SAST, making it easy to spot critical vulnerabilities like SQL injection, XSS, and misconfigurations early in the development lifecycle. The actionable remediation guidance saves our team a ton of research time by pointing directly to the affected code lines and suggesting exact fixes. On top of that, its seamless integration into CI/CD pipelines allows us to automate security checks without slowing down deployment speeds. Review collected by and hosted on G2.com.

What do you dislike about HCL AppScan?

What I dislike most about HCL AppScan is that the user interface can feel dated and clunky, requiring a bit of a learning curve for team members who are new to the platform. Deep, comprehensive scans can also take a significant amount of time to complete and occasionally consume heavy system resources. Additionally, filtering out false positives still takes a noticeable amount of manual triage effort before passing actionable reports over to the engineering team. Review collected by and hosted on G2.com.

What problems is HCL AppScan solving and how is that benefiting you?

HCL AppScan helps us solve the challenge of catching security vulnerabilities early in the software development lifecycle before code reaches production. Before using AppScan, manual security reviews were time-consuming and often bottlenecked our deployments right before launch. By automating automated SAST and DAST scans directly within our integration pipeline, we can catch and fix vulnerabilities like SQLi and XSS during development, significantly reducing security exposure and cutting down remediation time for developer teams. Review collected by and hosted on G2.com.