G2

Gaurav S.

Security Engineer

Mid-Market (51-1000 emp.)

10/25/2026

"AppScan’s Strong DAST Heritage and Full AppSec Coverage in One Platform"

5/5

What do you like best about HCL AppScan?

Long DAST heritage: AppScan began as a dynamic scanner, and its web and API scanning is often viewed as one of its strongest areas. By contrast, some competitors started with SAST and only added DAST later.

Full testing coverage in one family: SAST, DAST, IAST, and SCA are available from a single vendor, whereas some rivals are notably stronger in only one or two of these areas.

Flexible deployment: It supports on-premises, cloud, and hybrid deployments. Some competitors are primarily SaaS, which can be a deciding factor for regulated or air-gapped environments.

AI-assisted triage: AppScan has introduced capabilities aimed at reducing false positives and helping prioritize findings. Others offer similar functionality as well, so this is more of a competitive requirement than a clear differentiator.

Mature enterprise reporting: Its compliance mapping and reporting features fit large organizations with audit and governance needs.

Legacy and mixed-language support: Because of its long history, it tends to cover a wide range of older technologies and mixed enterprise stacks. Review collected by and hosted on G2.com.

What do you dislike about HCL AppScan?

False positives: Like most scanners, it can flag issues that aren’t actually real, which means teams end up spending extra time on triage and tuning. Users often mention that this tends to be worse in SAST than in DAST.

Learning curve and setup: Getting scans configured properly—especially authenticated scans, complex login flows, and custom scan policies—can take time and usually requires some security expertise.

Scan speed: Deep scans on large applications can be slow. In a fast CI/CD pipeline, that can become a bottleneck unless you tune the scope and rely on incremental scans where possible. Review collected by and hosted on G2.com.

What problems is HCL AppScan solving and how is that benefiting you?

HCL AppScan is an application security testing suite from HCLSoftware (part of HCL Technologies). It helps identify security vulnerabilities in web apps, mobile apps, APIs, and source code, so teams can address issues before attackers exploit them.

Background: AppScan originally began at Watchfire, was acquired by IBM in 2007 (as IBM Rational AppScan), and has been owned and developed by HCL since 2019.

What it does: It brings together several testing approaches:

SAST (static analysis): scans source code for flaws without running the app.

DAST (dynamic analysis): tests a running application from the outside, similar to how an attacker would.

IAST (interactive testing): monitors the app from the inside while tests run, which can reduce false positives.

SCA (software composition analysis): checks open-source libraries and dependencies for known vulnerabilities and license risks.

How it’s delivered: It’s available as on-premises tools, a cloud-based service, and IDE and CI/CD integrations. This allows scans to run on a developer’s machine, in a build pipeline, or on a schedule. Product names and packaging have changed over the years, so it’s worth checking HCL’s site for the current lineup.

The on-premises option is especially useful for banks and the finance industry, where tighter control and governance are often required. Review collected by and hosted on G2.com.