Coverity vs HCL AppScan comparison

Black Duck and HCLSoftware are both solutions in the Static Application Security Testing (SAST) category. Black Duck is ranked #4 with an average rating of 8.0, while HCLSoftware is ranked #12 with an average rating of 8.0. Black Duck holds a 7.5% mindshare in SAST, compared to HCLSoftware ’s 2.6% mindshare. Additionally, 88% of Black Duck users are willing to recommend the solution, compared to 83% of HCLSoftware users who would recommend it.

Coverity

Read 42 Coverity reviews

11,994 Views
8,326 Comparison Views

88% willing to recommend

HCL AppScan

Read 43 HCL AppScan reviews

4,025 Views
3,065 Comparison Views

83% willing to recommend

Coverity

HCL AppScan

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 8, 2024

HCL AppScan and Coverity compete in the application security space. User feedback suggests HCL AppScan often holds an advantage in comprehensive reporting and flexibility, while Coverity is preferred for its deep static analysis capabilities. HCL AppScan may offer better pricing options and quicker setup, but Coverity's robust feature set validates its higher cost.

Features: HCL AppScan is noted for customizable scanning capabilities, making it versatile. It provides flexibility for various environments and comprehensive reporting. Coverity is recognized for detailed code analysis, seamless workflow integration, and a focus on accuracy, benefiting those prioritizing code quality.

Room for Improvement: Users recommend HCL AppScan improve scan speed, real-time protection, and performance enhancements. Coverity could enhance reporting features, configuration controls, and accessibility.

Ease of Deployment and Customer Service: HCL AppScan is praised for straightforward deployment and helpful customer support. Coverity, while efficient after deployment, requires a longer initial setup. Both offer adequate customer service, though Coverity customers prefer a quicker initial rollout.

Pricing and ROI: HCL AppScan provides attractive setup costs and a quicker ROI with competitive pricing. Coverity, despite its higher initial cost, offers significant long-term value through accuracy and reduced maintenance demands, appealing to organizations focused on precision.

To learn more, read our detailed Coverity vs. HCL AppScan Report (Updated: April 2025).

Buyer's Guide

Coverity vs. HCL AppScan

April 2025

Download the complete report

Helped 851,604 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Coverity

Ranking in Static Application Security Testing (SAST)

4th

Average Rating

7.8

Reviews Sentiment

6.5

Number of Reviews

Ranking in other categories

No ranking in other categories

HCL AppScan

Ranking in Static Application Security Testing (SAST)

12th

Average Rating

7.8

Reviews Sentiment

6.1

Number of Reviews

Ranking in other categories

Application Security Tools (14th), Dynamic Application Security Testing (DAST) (1st)

Mindshare comparison

As of May 2025, in the Static Application Security Testing (SAST) category, the mindshare of Coverity is 7.5%, up from 6.6% compared to the previous year. The mindshare of HCL AppScan is 2.6%, up from 2.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST)

Featured Reviews

Md. Shahriar Hussain

Information Security Analyst at Banglalink

Offers impressive reporting features with user-friendliness and high scalability

The solution can be easily setup but requires heavy integration due to the multiple types of port and programming languages involved. Comparing the resource requirements of the solution I would say it can be installed effortlessly. I would rate the initial setup an eight out of ten. A professional needs some pre-acquired knowledge to manage Coverity's deployment process, but the local solution partners provide support well enough for trouble-free deployment. The overall deployment process of Coverity took around two and a half hours in our organization. The deployment duration depends upon the operating system and resources including high-end RAM and CPU processors.

Read full review

Rishi Anupam

Senior Manager at Airtel

A stable and scalable scanning solution with good reporting feature

The solution is used for the vulnerabilities scan on the network side The reporting part is the most valuable feature. The penetration testing feature should be included. I have been using the solution for four years. It is a stable solution. I rate it seven out of ten. It is a scalable…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It's pretty stable. I rate the stability of Coverity nine out of ten."

"The product has deeper scanning capabilities."

"It has the lowest false positives."

"In my opinion, the most effective Coverity feature for identifying critical vulnerabilities is the extra checks, which offers deep analysis."

"It's very stable."

"It help us identify the latest security vulnerabilities."

"We were very comfortable with the initial setup."

"It provides reports about a lot of potential defects."

More Coverity pros

"IBM AppScan has made our work easy, as we can do four to five scans of websites at a time, which saves time when it comes to vulnerability."

"AppScan's most valuable features include its ability to identify vulnerabilities accurately, provide detailed remediation steps, and the newly introduced AI-powered features that enhance its functionality further."

"The reporting part is the most valuable feature."

"The product is useful, particularly in its sensitivity and scanning capabilities."

"The platform has valuable security features, helping us identify sensitive code issues and the possibility of internal applications' exposure to external threats."

"It has certainly helped us find vulnerabilities in our software, so this is priceless in the end."

"The static scans are good, and the SaaS as well."

"Usually when we deploy the application, there is a process for ethical hacking. The main benefit is that, the ethical hacking is almost clean, every time. So it's less cost, less effort, less time to production."

More HCL AppScan pros

Cons

"The level of vulnerability that this solution covers could be improved compared to other open source tools."

"Its price can be improved. Price is always an issue with Synopsys."

"Reporting engine needs to be more robust."

"The product could be enhanced by providing video troubleshooting guides, making issue resolution more accessible. Troubleshooting without visual guides can be time-consuming."

"Coverity takes a lot of time to dereference null pointers."

"We use GitHub and Gitflow, and Coverity does not fit with Gitflow. I have to create a screen for our branches, and it's a pain for developers. It has been difficult to integrate Coverity with our system."

"The product could be enhanced by providing video troubleshooting guides, making issue resolution more accessible. Troubleshooting without visual guides can be time-consuming."

"The solution is a bit complex to use in comparison to other products that have many plugins."

More Coverity cons

"We would like to integrate with some of the other reporting tools that we're planning to use in the future."

"Scans become slow on large websites."

"If HCL AppScan is able to alert the clients over email once the scan is complete, it would be great. Right now, HCL AppScan doesn't let me know if the scanning part is finished or not, because of which I have to come back and check mostly."

"They could incorporate AI to enhance vulnerability detection and improve the product's reporting capabilities."

"There is not a central management for static and dynamic."

"Visibility is an issue for us. Our partners do not know we have integrations with some of IBM products."

"The product has some technical limitations."

"AppScan is too complicated and should be made more user-friendly."

More HCL AppScan cons

Pricing and Cost Advice

"The tool's price is somewhere in the middle. It's neither cheap nor expensive. I would rate the pricing a five out of ten."

"Coverity’s price is on the higher side. It should be lower."

"The price is competitive with other solutions."

"This is a pretty expensive solution. The overall value of the solution could be improved if the price was reduced. Licensing is done on an annual basis."

"It is expensive."

"I would rate the tool's pricing a one out of ten."

"Offers varying prices for different companies"

"The solution's pricing is comparable to other products."

More Coverity pricing and cost advice

"The price of HCL AppScan is okay, in my opinion. You just buy HCL AppScan and don't pay anything anymore, meaning it is just a one-time purchase."

"With the features, that they offer, and the support, they offer, AppScan pricing is on a higher level."

"I rate the product's price a seven on a scale of one to ten, where one is low, and ten is high. HCL AppScan is an expensive tool."

"The product is moderately priced, though it's an investment due to extensive code analysis needs."

"The solution is cheap."

"The price is very expensive."

"HCL AppScan is expensive."

"The tool was expensive."

More HCL AppScan pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

851,604 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

33%

Computer Software Company

14%

Financial Services Firm

Government

Computer Software Company

18%

Financial Services Firm

14%

Government

12%

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...

See all answers

What do you like most about Coverity?

The solution has improved our code quality and security very well.

See all answers

What is your experience regarding pricing and costs for Coverity?

I do not know about the pricing.

See all answers

What do you like most about HCL AppScan?

The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase.

See all answers

What needs improvement with HCL AppScan?

AppScan needs to improve its handling of false positives. It also requires enhancements in customer support, similar to what Veracode provides. Regularly scheduling calls with clients to discuss fe...

See all answers

What is your primary use case for HCL AppScan?

The primary use case for AppScan is for security purposes. I compare AppScan with other tools such as Veracode. We use AppScan for vulnerability detection and auto-remediation of vulnerabilities wi...

See all answers

Comparisons

SonarQube Server (formerly SonarQube) vs Coverity

Compared 49% of the time

Klocwork vs Coverity

Compared 7% of the time

Fortify on Demand vs Coverity

Compared 6% of the time

Veracode vs Coverity

Compared 5% of the time

Polyspace Code Prover vs Coverity

Compared 5% of the time

More Coverity Competitors

Acunetix vs HCL AppScan

Compared 16% of the time

SonarQube Server (formerly SonarQube) vs HCL AppScan

Compared 12% of the time

Veracode vs HCL AppScan

Compared 10% of the time

Fortify on Demand vs HCL AppScan

Compared 7% of the time

OWASP Zap vs HCL AppScan

Compared 7% of the time

More HCL AppScan Competitors

Product Reports

Buyer's Guide

Coverity

May 2025

Download Coverity product report

Buyer's Guide

HCL AppScan

May 2025

Download HCL AppScan product report

Also Known As

Synopsys Static Analysis

IBM Security AppScan, Rational AppScan, AppScan

Overview

Coverity gives you the speed, ease of use, accuracy, industry standards compliance, and scalability that you need to develop high-quality, secure applications. Coverity identifies critical software quality defects and security vulnerabilities in code as it’s written, early in the development process, when it’s least costly and easiest to fix. With the Code Sight integrated development environment (IDE) plugin, developers get accurate analysis in seconds in their IDE as they code. Precise actionable remediation advice and context-specific eLearning help your developers understand how to fix their prioritized issues quickly, without having to become security experts.

Coverity seamlessly integrates automated security testing into your CI/CD pipelines and supports your existing development tools and workflows. Choose where and how to do your development: on-premises or in the cloud with the Polaris Software Integrity Platform (SaaS), a highly scalable, cloud-based application security platform. Coverity supports more than 20 languages and 200 frameworks and templates.

Black Duck

IBM Security AppScan enhances web application security and mobile application security, improves application security program management and strengthens regulatory compliance. By scanning your web and mobile applications prior to deployment, AppScan enables you to identify security vulnerabilities and generate reports and fix recommendations.

HCLSoftware

Sample Customers

SAP, Mega International, Thales Alenia Space

Essex Technology Group Inc., Cisco, West Virginia University, APIS IT

Buyer's Guide

Coverity vs. HCL AppScan

April 2025

Free Report: Coverity vs. HCL AppScan

Find out what your peers are saying about Coverity vs. HCL AppScan and other solutions. Updated: April 2025.

DOWNLOAD NOW

851,604 professionals have used our research since 2012.

See our Coverity vs. HCL AppScan report.

See our list of best Static Application Security Testing (SAST) vendors.

We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.