No more typing reviews! Try our Samantha, our new voice AI agent.

Defensics Protocol Fuzzing vs HCL AppScan comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Defensics Protocol Fuzzing
Average Rating
8.6
Number of Reviews
4
Ranking in other categories
Fuzz Testing Tools (4th)
HCL AppScan
Average Rating
7.6
Reviews Sentiment
5.9
Number of Reviews
44
Ranking in other categories
Application Security Tools (21st), Static Application Security Testing (SAST) (16th), Dynamic Application Security Testing (DAST) (6th)
 

Mindshare comparison

While both are Quality Assurance solutions, they serve different purposes. Defensics Protocol Fuzzing is designed for Fuzz Testing Tools and holds a mindshare of 15.2%, down 23.1% compared to last year.
HCL AppScan, on the other hand, focuses on Application Security Tools, holds 2.3% mindshare, down 2.7% since last year.
Fuzz Testing Tools Mindshare Distribution
ProductMindshare (%)
Defensics Protocol Fuzzing15.2%
PortSwigger Burp Suite Professional33.6%
GitLab30.1%
Other21.099999999999994%
Fuzz Testing Tools
Application Security Tools Mindshare Distribution
ProductMindshare (%)
HCL AppScan2.3%
SonarQube12.7%
Checkmarx One8.3%
Other76.7%
Application Security Tools
 

Featured Reviews

SK
Senior Technical Lead at HCL Technologies
Product security tests for switches and router sections
Codenomicon Defensics should be more advanced for the testing sector. It should be somewhat easy and flexible to install. What I see in the documentation isn't that. Even if something doesn't malfunction, sometimes it is hard to install and execute. The product needs video documentation. This would help a lot more.
Ravi Khanchandani - PeerSpot reviewer
Founder Director at Techsa Services
Has improved identification of encryption and authentication issues across cloud and on-prem applications
During the learning curve of onboarding HCL AppScan, we learned that HCL has altered the portfolio and now offers HCL AppScan 360, which has a much better look and feel with an improved user interface. However, there is one feature called SCA, which stands for Software Composition Analysis, that could be improved. When I'm doing an application scan, HCL AppScan has the ability to generate information about what components are in use. For example, if I'm scanning a web application, it shows me the various components being used. It tells me whether I have Java libraries, .NET frameworks, or other log management libraries such as Log4j, and what versions of those specific components are present. I would like to see more detailed reports from the tool. Currently, you can find out the components belonging to a specific software, but if detailed reporting became available, you would be in a better position to identify vulnerabilities. For instance, I could identify that I had the Log4j vulnerability and know that I need to fix my application accordingly. If they add the features I'm describing, I would consider giving them a higher rating. However, I've only been experienced with the product for three months.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Simple and straightforward GUI."
"ROI was 100%. Since there are no product suites available that provide the level of testing available with Codenomicon, the development, quality and security assurance departments know that the investment was correct."
"We have found multiple issues in our embedded system network protocols, related to buffer overflow. We have reduced some of these issues."
"The product is related to US usage with TLS contact fees, i.e. how more data center connections will help lower networking costs."
"Whatever the test suit they give, it is intelligent; it will understand the protocol and it will generate the test cases based on the protocol: protocol, message sequence, protocol, message structure, and because of that, we can eliminate a lot of unwanted test cases so we can execute the tests and complete them very quickly."
"The stability of this product is great; we tested it under multiple constraints and even on cloud services it is absolutely stable."
"Usually when we deploy the application, there is a process for ethical hacking. The main benefit is that, the ethical hacking is almost clean, every time. So it's less cost, less effort, less time to production."
"The support I have received has been good."
"HCL AppScan has helped us improve our security posture, as we've been able to identify quite a few issues."
"It is a stable solution...It is a scalable solution...The initial setup or installation of HCL AppScan is easy."
"There's extensive functionality with custom rules and a custom knowledge base."
"You can easily find particular features and functions through the UI."
"I mainly use AppScan for vulnerability scanning and database bridging."
"It is easy it is to use. It is quick to find things, because of the code scanning tools. It's quite simple to use and it is very good the way it reports the findings."
 

Cons

"Sometimes, when we are testing embedded devices, when we trigger the test cases, the target will crash immediately. It is very difficult for us to identify the root cause of the crash because they do not provide sophisticated tools on the target side. They cover only the client-side application... They do not have diagnostic tools for the target side. Rather, they have them but they are very minimal and not very helpful."
"It does not support the complete protocol stack. There are some IoT protocols that are not supported and new protocols that are not supported."
"You can't implement proprietary ciphering algorithms, nor can you modify protocol models if you need to test customized public protocols."
"It requires understanding the Defensics protocol."
"Codenomicon Defensics should be more advanced for the testing sector. It should be somewhat easy and flexible to install."
"It has crashed at times."
"There is one feature called SCA, which stands for Software Composition Analysis, that could be improved."
"IBM Security AppScan needs to add performance optimization for quickly scanning the target web applications."
"We would like to see a check in the specific vulnerabilities in mobile applications or rooted devices, such as jailbreaking devices."
"We would like to integrate with some of the other reporting tools that we're planning to use in the future."
"The depth was low, but the part that the user could miss was also diagnosed."
"There is not a central management for static and dynamic."
"The solution often has a high number of false positives. It's an aspect they really need to improve upon."
 

Pricing and Cost Advice

"Licensing is a bit expensive."
"I rate the product's price a seven on a scale of one to ten, where one is low, and ten is high. HCL AppScan is an expensive tool."
"The product has premium pricing and could be more competitive."
"The product is moderately priced, though it's an investment due to extensive code analysis needs."
"The solution is moderately priced."
"Our clients are willing to pay the extra money. It is expensive."
"The price is very expensive."
"With the features, that they offer, and the support, they offer, AppScan pricing is on a higher level."
"The tool was expensive."
report
Use our free recommendation engine to learn which Fuzz Testing Tools solutions are best for your needs.
900,747 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
14%
Financial Services Firm
10%
Manufacturing Company
10%
Comms Service Provider
7%
Financial Services Firm
11%
Manufacturing Company
9%
Government
9%
Computer Software Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise6
Large Enterprise31
 

Questions from the Community

Ask a question
Earn 20 points
What needs improvement with HCL AppScan?
During the learning curve of onboarding HCL AppScan, we learned that HCL has altered the portfolio and now offers HCL AppScan 360, which has a much better look and feel with an improved user interf...
What is your primary use case for HCL AppScan?
I'm currently working with BigFix and HCL AppScan. At least three people in my company are using HCL AppScan. Since we are a reseller, we run it in both lab environments and live production applica...
What is your experience regarding pricing and costs for HCL AppScan?
AppScan is considered more cost-effective than Veracode, although I have not updated the exact pricing details. Companies often choose based on budget constraints, with Veracode being on the higher...
 

Also Known As

Codenomicon Defensics
IBM Security AppScan, Rational AppScan, AppScan
 

Overview

 

Sample Customers

Coriant, CERT-FI, Next Generation Networks
Essex Technology Group Inc., Cisco, West Virginia University, APIS IT
Find out what your peers are saying about Defensics Protocol Fuzzing vs. PortSwigger Burp Suite Professional and other solutions. Updated: June 2026.
900,747 professionals have used our research since 2012.