Coverity vs HCL AppScan comparison

Black Duck and HCLSoftware are both solutions in the Static Application Security Testing (SAST) category. Black Duck is ranked #4 with an average rating of 8.0, while HCLSoftware is ranked #10 with an average rating of 7.9. Black Duck holds a 8.0% mindshare in SAST, compared to HCLSoftware ’s 2.7% mindshare. Additionally, 88% of Black Duck users are willing to recommend the solution, compared to 83% of HCLSoftware users who would recommend it.

Coverity

Read 42 Coverity reviews

11,969 Views
8,281 Comparison Views

88% willing to recommend

HCL AppScan

Read 43 HCL AppScan reviews

3,999 Views
3,020 Comparison Views

83% willing to recommend

Coverity

HCL AppScan

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 8, 2024

HCL AppScan and Coverity compete in the application security space. User feedback suggests HCL AppScan often holds an advantage in comprehensive reporting and flexibility, while Coverity is preferred for its deep static analysis capabilities. HCL AppScan may offer better pricing options and quicker setup, but Coverity's robust feature set validates its higher cost.

Features: HCL AppScan is noted for customizable scanning capabilities, making it versatile. It provides flexibility for various environments and comprehensive reporting. Coverity is recognized for detailed code analysis, seamless workflow integration, and a focus on accuracy, benefiting those prioritizing code quality.

Room for Improvement: Users recommend HCL AppScan improve scan speed, real-time protection, and performance enhancements. Coverity could enhance reporting features, configuration controls, and accessibility.

Ease of Deployment and Customer Service: HCL AppScan is praised for straightforward deployment and helpful customer support. Coverity, while efficient after deployment, requires a longer initial setup. Both offer adequate customer service, though Coverity customers prefer a quicker initial rollout.

Pricing and ROI: HCL AppScan provides attractive setup costs and a quicker ROI with competitive pricing. Coverity, despite its higher initial cost, offers significant long-term value through accuracy and reduced maintenance demands, appealing to organizations focused on precision.

To learn more, read our detailed Coverity vs. HCL AppScan Report (Updated: March 2025).

Buyer's Guide

Coverity vs. HCL AppScan

March 2025

Download the complete report

Helped 845,406 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Coverity

Ranking in Static Application Security Testing (SAST)

4th

Average Rating

7.8

Reviews Sentiment

6.5

Number of Reviews

Ranking in other categories

No ranking in other categories

HCL AppScan

Ranking in Static Application Security Testing (SAST)

10th

Average Rating

7.8

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

Application Security Tools (14th), Dynamic Application Security Testing (DAST) (1st)

Mindshare comparison

As of April 2025, in the Static Application Security Testing (SAST) category, the mindshare of Coverity is 8.0%, up from 7.0% compared to the previous year. The mindshare of HCL AppScan is 2.7%, up from 2.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST)

Featured Reviews

Md. Shahriar Hussain

Information Security Analyst at Banglalink

Offers impressive reporting features with user-friendliness and high scalability

The solution can be easily setup but requires heavy integration due to the multiple types of port and programming languages involved. Comparing the resource requirements of the solution I would say it can be installed effortlessly. I would rate the initial setup an eight out of ten. A professional needs some pre-acquired knowledge to manage Coverity's deployment process, but the local solution partners provide support well enough for trouble-free deployment. The overall deployment process of Coverity took around two and a half hours in our organization. The deployment duration depends upon the operating system and resources including high-end RAM and CPU processors.

Read full review

Rishi Anupam

Senior Manager at Airtel

A stable and scalable scanning solution with good reporting feature

The solution is used for the vulnerabilities scan on the network side The reporting part is the most valuable feature. The penetration testing feature should be included. I have been using the solution for four years. It is a stable solution. I rate it seven out of ten. It is a scalable…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"What I find most effective about Coverity is its low rate of false positives. I've seen other platforms with many false positives, but with Coverity, most vulnerabilities it identifies are genuine. This allows me to focus on real issues."

"It has the lowest false positives."

"We were very comfortable with the initial setup."

"The product has been beneficial in logging functionality, allowing me to categorize vulnerabilities based on severity. This aids in providing updated reports on subsequent scans."

"In my opinion, the most effective Coverity feature for identifying critical vulnerabilities is the extra checks, which offers deep analysis."

"Coverity is scalable."

"Coverity is easy to use and easy to integrate with CI."

"The most valuable feature of Coverity is the wrapper. We use the wrapper to build the C++ component, then we use the other code analysis to analyze the code to the build object, and then send back the result to the SonarQube server. Additionally, it is a powerful capabilities solution."

More Coverity pros

"The static scans are good, and the SaaS as well."

"This solution saves us time due to the low number of false positives detected."

"The most valuable feature of the solution is Postman."

"AppScan's most valuable features include its ability to identify vulnerabilities accurately, provide detailed remediation steps, and the newly introduced AI-powered features that enhance its functionality further."

"You can easily find particular features and functions through the UI."

"The platform has valuable security features, helping us identify sensitive code issues and the possibility of internal applications' exposure to external threats."

"It comes with all of the templates that we need. For example, we are a company that is regulated by PCI. In order to be PCI compliant, we have a lot of checks and procedures to which we have to comply."

"The HCL AppScan turnaround time for Burp Suite or any new feature request is pretty good, and that is why we are sticking with the HCL."

More HCL AppScan pros

Cons

"There is an extra step in my organization that involves uploading to servers, which adds overhead."

"The product lacks sufficient customization options."

"We use GitHub and Gitflow, and Coverity does not fit with Gitflow. I have to create a screen for our branches, and it's a pain for developers. It has been difficult to integrate Coverity with our system."

"Its price can be improved. Price is always an issue with Synopsys."

"Coverity concerns its dashboards and reporting."

"Coverity could improve the ease of use. Sometimes things become difficult and you need to follow the guides from the website but the guides could be better."

"The tool needs to improve its reporting."

"We actually specified several checkers, but we found some checkers had a higher false positive rate. I think this is a problem. Because we have to waste some time is really the issue because the issue is not an issue. I mean, the tool pauses or an issue, but the same issue is the filter now.Some check checkers cannot find some issues, but sometimes they find issues that are not relevant, right, that are not really issues. Some customisation mechanism can be added in the next release so that we can define our Checker. The Modelling feature provided by Coverity helps in finding more information for potential issues but it is not mature enough, it should be mature. The fast testing feature for security testing campaign can be added as well. So if you correctly integrate it with the training team, maybe you can help us to find more potential issues."

More Coverity cons

"They have to improve support."

"I would love to see more containers. Many of the tools are great, they require an amount of configuration, setup and infrastructure. If most the applications were in a container, I think everything would be a little bit faster, because all our clients are now using containers."

"The solution's scalability can be a matter of concern because one license runs on one machine only."

"We would like to see a check in the specific vulnerabilities in mobile applications or rooted devices, such as jailbreaking devices."

"We have experienced challenges when trying to integrate this solution with other products. When you compare it with the other SecOps products, the quality of the output is too low. It is not a new-age product. It is very outdated."

"There is room for improvement in the pricing model."

"I would like to see the roadmap for this product. We are still waiting to see it as we have only so many resources."

"There is not a central management for static and dynamic."

More HCL AppScan cons

Pricing and Cost Advice

"The licensing fees are based on the number of lines of code."

"Coverity is very expensive."

"I would rate the pricing a six out of ten, where one is low, and ten is high price."

"The tool's price is somewhere in the middle. It's neither cheap nor expensive. I would rate the pricing a five out of ten."

"It is expensive."

"The pricing is on the expensive side, and we are paying for a couple of items."

"Depending on the usage types, one has to opt for different types of licenses from Coverity, especially to be able to use areas like report viewing or report generation."

"The solution's pricing is comparable to other products."

More Coverity pricing and cost advice

"Our clients are willing to pay the extra money. It is expensive."

"I rate the product's price a seven on a scale of one to ten, where one is low, and ten is high. HCL AppScan is an expensive tool."

"I would rate the product's pricing a nine out of ten. The product's pricing is expensive compared to the features that they offer."

"The product has premium pricing and could be more competitive."

"The product is moderately priced, though it's an investment due to extensive code analysis needs."

"Pricing was the main reason that we went ahead with this solution as they were the lowest in the market."

"The price of HCL AppScan is okay, in my opinion. You just buy HCL AppScan and don't pay anything anymore, meaning it is just a one-time purchase."

"The solution is moderately priced."

More HCL AppScan pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

845,406 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

33%

Computer Software Company

14%

Financial Services Firm

Government

Computer Software Company

19%

Financial Services Firm

14%

Government

11%

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...

See all answers

What do you like most about Coverity?

The solution has improved our code quality and security very well.

See all answers

What is your experience regarding pricing and costs for Coverity?

I do not know about the pricing.

See all answers

What do you like most about HCL AppScan?

The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase.

See all answers

What needs improvement with HCL AppScan?

AppScan needs to improve its handling of false positives. It also requires enhancements in customer support, similar to what Veracode provides. Regularly scheduling calls with clients to discuss fe...

See all answers

What is your primary use case for HCL AppScan?

The primary use case for AppScan is for security purposes. I compare AppScan with other tools such as Veracode. We use AppScan for vulnerability detection and auto-remediation of vulnerabilities wi...

See all answers

Comparisons

SonarQube Server (formerly SonarQube) vs Coverity

Compared 50% of the time

Fortify on Demand vs Coverity

Compared 6% of the time

Klocwork vs Coverity

Compared 6% of the time

Polyspace Code Prover vs Coverity

Compared 5% of the time

Veracode vs Coverity

Compared 5% of the time

More Coverity Competitors

Acunetix vs HCL AppScan

Compared 15% of the time

SonarQube Server (formerly SonarQube) vs HCL AppScan

Compared 12% of the time

Veracode vs HCL AppScan

Compared 10% of the time

Fortify on Demand vs HCL AppScan

Compared 8% of the time

OWASP Zap vs HCL AppScan

Compared 8% of the time

More HCL AppScan Competitors

Product Reports

Buyer's Guide

Coverity

March 2025

Download Coverity product report

Buyer's Guide

HCL AppScan

March 2025

Download HCL AppScan product report

Also Known As

Synopsys Static Analysis

IBM Security AppScan, Rational AppScan, AppScan

Overview

Coverity gives you the speed, ease of use, accuracy, industry standards compliance, and scalability that you need to develop high-quality, secure applications. Coverity identifies critical software quality defects and security vulnerabilities in code as it’s written, early in the development process, when it’s least costly and easiest to fix. With the Code Sight integrated development environment (IDE) plugin, developers get accurate analysis in seconds in their IDE as they code. Precise actionable remediation advice and context-specific eLearning help your developers understand how to fix their prioritized issues quickly, without having to become security experts.

Coverity seamlessly integrates automated security testing into your CI/CD pipelines and supports your existing development tools and workflows. Choose where and how to do your development: on-premises or in the cloud with the Polaris Software Integrity Platform (SaaS), a highly scalable, cloud-based application security platform. Coverity supports more than 20 languages and 200 frameworks and templates.

Black Duck

IBM Security AppScan enhances web application security and mobile application security, improves application security program management and strengthens regulatory compliance. By scanning your web and mobile applications prior to deployment, AppScan enables you to identify security vulnerabilities and generate reports and fix recommendations.

HCLSoftware

Sample Customers

SAP, Mega International, Thales Alenia Space

Essex Technology Group Inc., Cisco, West Virginia University, APIS IT

Buyer's Guide

Coverity vs. HCL AppScan

March 2025

Free Report: Coverity vs. HCL AppScan

Find out what your peers are saying about Coverity vs. HCL AppScan and other solutions. Updated: March 2025.

DOWNLOAD NOW

845,406 professionals have used our research since 2012.

See our Coverity vs. HCL AppScan report.

See our list of best Static Application Security Testing (SAST) vendors.

We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.