HCL AppScan vs OpenText Core Application Security comparison

HCL AppScan vs. OpenText Core Application Security

Download the complete report

Helped 884,873 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

ROI

Sentiment score

1.7

HCL AppScan enhances architecture with fewer errors and improved security, achieving 50% return and 20% cost savings.

Sentiment score

3.7

OpenText Core Application Security enhances security by reducing bugs and attacks, offering cost-effective protection and improved efficiency.

No quotes available

For more quotes and insights, download the HCL AppScan report

There is definitive ROI if OpenText Core Application Security is deployed properly; it substantially reduces efforts in securing the solution while averting various application-related risks.

For more quotes and insights, download the OpenText Core Application Security report

Co-Founder at Insecsys Technologies Private Limited

Customer Service

Sentiment score

5.6

HCL AppScan's support is responsive with mixed reviews, facing regional challenges and lagging behind competitors like Veracode.

Sentiment score

7.0

Customer service excels overall, but technical support is mixed, with room for improvement and a need for developer access.

Veracode provides excellent assistance and regularly scheduled calls to address customer concerns and updates.

MukeshSaha

Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech

There is still room for improvement when it comes to the speed of response.

For more quotes and insights, download the HCL AppScan report

Founder Director at Techsa Services

I had direct interaction with them, which facilitated how we onboarded Fortify.

Lead Cybersecurity at TBO

Support tickets often stay open for one month to three months, which leads to customer frustration.

Diego Caicedo Lescano

Chief Innovation Officer at SAGGA

The technical support from OpenText is very good.

For more quotes and insights, download the OpenText Core Application Security report

Co-Founder at Insecsys Technologies Private Limited

Scalability Issues

Sentiment score

3.9

HCL AppScan is scalable yet varies by license, integration issues, infrastructure compatibility, and CI/CD pipeline design effectiveness.

Sentiment score

7.2

OpenText Core Application Security is scalable, integrates well, and efficiently handles diverse workloads, though pricing may be a concern.

No quotes available

For more quotes and insights, download the HCL AppScan report

OpenText Core Application Security is highly scalable; it is running on the cloud, and elasticity is one of the best points of a cloud environment.

Wagner Azevedo

Cloud Security Manager at T-Systems International GmbH

If a customer wants to know the tools and the technology used for their application to scan their application, they provide less information on that.

Lead Cybersecurity at TBO

Fortify is superior to many solutions because of its scalability and that it does not require massive compute capabilities for its SAST and sandboxing features.

For more quotes and insights, download the OpenText Core Application Security report

Co-Founder at Insecsys Technologies Private Limited

Stability Issues

Sentiment score

7.2

HCL AppScan is stable and reliable, with minor hardware issues, improved by recent upgrades enhancing performance and stability.

Sentiment score

8.7

OpenText Core Application Security is generally stable and reliable, with occasional memory and scanning issues noticed by users.

Since we've been using HCL AppScan for about three months, we really have not encountered a false positive.

For more quotes and insights, download the HCL AppScan report

Founder Director at Techsa Services

OpenText Core Application Security is stable and has minimal downtime, benefitting from AWS cloud availability.

For more quotes and insights, download the OpenText Core Application Security report

Co-Founder at Insecsys Technologies Private Limited

Room For Improvement

HCL AppScan requires improvements in vulnerability detection, usability, integration, performance, support, pricing, and language/codebase compatibility to stay competitive.

OpenText Core Application Security needs better integration, user-friendliness, automation, and clearer pricing, while reducing false positives and scan times.

Currently, you can find out the components belonging to a specific software, but if detailed reporting became available, you would be in a better position to identify vulnerabilities.

For more quotes and insights, download the HCL AppScan report

Founder Director at Techsa Services

I would say OpenText Core Application Security is not very user-friendly in terms of price; it is quite high.

Co-Founder at Insecsys Technologies Private Limited

It would be beneficial if Fortify could check for CVEs (Common Vulnerabilities and Exposures) in third-party libraries, which I currently use a separate dependency checker tool for.

reviewer2646048

Lead Developer at a legal firm with 1,001-5,000 employees

One thing I would highlight is if Fortify can focus more on the centralized dashboard of the tools because nowadays, tools such as SentinelOne also exist for identifying security issues, but they have a centralized dashboard that merges their cloud solution and application security side solution together.

For more quotes and insights, download the OpenText Core Application Security report

Lead Cybersecurity at TBO

Setup Cost

HCL AppScan is considered expensive but cost-effective, with varied pricing opinions influenced by its premium features and discounts.

OpenText Core Application Security is seen as expensive with per-scan fees, user-based licensing, and no setup cost.

Companies often choose based on budget constraints, with Veracode being on the higher end cost-wise.

MukeshSaha

Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech

For more quotes and insights, download the HCL AppScan report

No quotes available

For more quotes and insights, download the OpenText Core Application Security report

Valuable Features

HCL AppScan detects vulnerabilities, integrates with agile processes, offers scalability, user-friendly features, and AI-enhanced rapid scanning for security.

OpenText Core Application Security provides efficient vulnerability management and testing with seamless integration into DevOps pipelines and user-friendly features.

We were able to identify security issues such as certificate-related issues, authentication-related issues, and weak encryption-related issues.

For more quotes and insights, download the HCL AppScan report

Founder Director at Techsa Services

AppScan's most valuable features include its ability to identify vulnerabilities accurately, provide detailed remediation steps, and the newly introduced AI-powered features that enhance its functionality further.

MukeshSaha

Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech

Additionally, you can integrate Fortify in CICD pipeline, so you get real-time updates about the security issues in your pipeline.

For more quotes and insights, download the OpenText Core Application Security report

Lead Cybersecurity at TBO

On demand you have two levels of reports: the first from the tool, which is the same as we can get from Fortify on-premises, and a next level reporting made by experts from OpenText, leading to a more condensed and precise report as level three.

Diego Caicedo Lescano

Chief Innovation Officer at SAGGA

The integration of OpenText Core Application Security with existing systems for security operations benefits us by providing vulnerability management and quality gates; without both, we will always have vulnerable applications running for our customers.

Wagner Azevedo

Cloud Security Manager at T-Systems International GmbH

Categories and Ranking

HCL AppScan

Ranking in Application Security Tools

19th

Ranking in Static Application Security Testing (SAST)

17th

Average Rating

7.6

Reviews Sentiment

5.9

Number of Reviews

Ranking in other categories

Dynamic Application Security Testing (DAST) (6th)

OpenText Core Application S...

Ranking in Application Security Tools

13th

Ranking in Static Application Security Testing (SAST)

12th

Average Rating

8.0

Reviews Sentiment

7.0

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of March 2026, in the Application Security Tools category, the mindshare of HCL AppScan is 2.1%, down from 2.6% compared to the previous year. The mindshare of OpenText Core Application Security is 3.2%, down from 4.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools Mindshare Distribution
Product	Mindshare (%)
OpenText Core Application Security	3.2%
HCL AppScan	2.1%
Other	94.7%

Application Security Tools

Featured Reviews

Has improved identification of encryption and authentication issues across cloud and on-prem applications

Founder Director at Techsa Services

During the learning curve of onboarding HCL AppScan, we learned that HCL has altered the portfolio and now offers HCL AppScan 360, which has a much better look and feel with an improved user interface. However, there is one feature called SCA, which stands for Software Composition Analysis, that could be improved. When I'm doing an application scan, HCL AppScan has the ability to generate information about what components are in use. For example, if I'm scanning a web application, it shows me the various components being used. It tells me whether I have Java libraries, .NET frameworks, or other log management libraries such as Log4j, and what versions of those specific components are present. I would like to see more detailed reports from the tool. Currently, you can find out the components belonging to a specific software, but if detailed reporting became available, you would be in a better position to identify vulnerabilities. For instance, I could identify that I had the Log4j vulnerability and know that I need to fix my application accordingly. If they add the features I'm describing, I would consider giving them a higher rating. However, I've only been experienced with the product for three months.

Read full review

Supports secure development pipelines and improves issue detection but limits internal visibility and needs broader dashboard integration

Lead Cybersecurity at TBO

If you have an internal team and you want your internal team to validate false positives, basically to determine whether it's a valid issue or an invalid issue, then I wouldn't recommend it much. That was the only reason we migrated from Fortify on Demand to another solution. Fortify has another tool which is Fortify WebInspect. On Demand is the outsourcing solution, and WebInspect you can use with your in-house team, which is basically the product developed by the Fortify team. For automated scanning, Fortify helps a lot. Regarding the visibility for the internal team, everyone is moving toward the DevSecOps side, and Fortify team has made good progress that you can integrate into your CICD pipeline. One thing I would highlight is if Fortify can focus more on the centralized dashboard of the tools because nowadays, tools such as SentinelOne also exist for identifying security issues, but they have a centralized dashboard that merges their cloud solution and application security side solution together. If you have one tool that works for different solutions, it helps a lot. They are doing good, but they should invest more on the AI side as well because AI security is evolving these days. On the cloud side, they have already made good progress, but I believe they should explore the new area related to AI security as well.

Read full review

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

884,873 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

11%

Financial Services Firm

11%

Government

10%

Manufacturing Company

10%

Financial Services Firm

15%

Manufacturing Company

14%

Government

Computer Software Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	14
Midsize Enterprise	6
Large Enterprise	31

By reviewers
Company Size	Count
Small Business	18
Midsize Enterprise	8
Large Enterprise	45

Questions from the Community

What do you like most about HCL AppScan?

The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase.

What needs improvement with HCL AppScan?

What is your primary use case for HCL AppScan?

I'm currently working with BigFix and HCL AppScan. At least three people in my company are using HCL AppScan. Since we are a reseller, we run it in both lab environments and live production applica...

What do you like most about Micro Focus Fortify on Demand?

It helps deploy and track changes easily as per time-to-time market upgrades.

What is your experience regarding pricing and costs for Micro Focus Fortify on Demand?

In comparison with other tools, they're competitive. It is not more expensive than other solutions, but their pricing is competitive. The licenses for Fortify On Demand are generally bought in unit...

What needs improvement with Micro Focus Fortify on Demand?

PortSwigger Burp Suite Professional vs HCL AppScan

Comparisons

Veracode vs HCL AppScan

Compared 9% of the time

SonarQube vs HCL AppScan

Compared 8% of the time

Compared 7% of the time

Checkmarx One vs HCL AppScan

Compared 7% of the time

Snyk vs HCL AppScan

Compared 4% of the time

More HCL AppScan Competitors

SonarQube vs OpenText Core Application Security

Compared 20% of the time

Checkmarx One vs OpenText Core Application Security

Compared 10% of the time

Veracode vs OpenText Core Application Security

Compared 5% of the time

Coverity Static vs OpenText Core Application Security

Compared 5% of the time

PortSwigger Burp Suite Professional vs OpenText Core Application Security

Compared 3% of the time

More OpenText Core Application Security Competitors

Product Reports

HCL AppScan

Download HCL AppScan product report

OpenText Core Application Security

Download OpenText Core Application Security product report

OpenText Core Application Security report

Also Known As

IBM Security AppScan, Rational AppScan, AppScan

Micro Focus Fortify on Demand

Overview

IBM Security AppScan enhances web application security and mobile application security, improves application security program management and strengthens regulatory compliance. By scanning your web and mobile applications prior to deployment, AppScan enables you to identify security vulnerabilities and generate reports and fix recommendations.

HCLSoftware

OpenText Core Application Security offers robust features like static and dynamic scanning, real-time vulnerability tracking, and seamless integration with development platforms, designed to enhance code security and reduce operational costs.

OpenText Core Application Security is a cloud-based, on-demand service providing accurate and deep scanning capabilities with detailed reporting. Its integrations with development platforms ensure an enhanced security layer in the development lifecycle, benefiting users by lowering operational costs and facilitating efficient remediation. The platform addresses needs for intuitive interfaces, API support, and comprehensive vulnerability assessments, helping improve code security and accelerate time-to-market. Despite its strengths, challenges exist around false positives, report clarity, and language support, alongside confusing pricing and package options. Enhancements are sought in areas like CI/CD pipeline configuration, report visualization, scan times, and integration with third-party tools such as GitLab, container scanning, and software composition analysis.

What features define OpenText Core Application Security?

Static and Dynamic Scanning: Offers thorough analysis to identify vulnerabilities during development.
Real-time Vulnerability Tracking: Continuously updates and monitors potential security threats.
Seamless Development Platform Integration: Enhances security processes without disrupting workflows.
Cloud-Based Service: Provides flexible, on-demand security capabilities with accurate results.
API Support: Allows smooth integration and automation within existing systems.

What benefits should users look for in reviews?

Reduced Operational Costs: Optimizes resources by lowering costs associated with security management.
Efficient Remediation: Speeds up the process of identifying and resolving vulnerabilities.
Enhanced Code Security: Strengthens overall application security during the development lifecycle.
Accelerated Time-to-Market: Streamlines development stages by integrating essential security tools.

Industries like mobile applications, e-commerce, and banking leverage OpenText Core Application Security for its ability to identify vulnerabilities such as SQL injections. Integrating seamlessly with DevSecOps and security auditing processes, this tool supports developers in writing safer code, ensuring secure application deployment and enhancing software assurance.

OpenText

Sample Customers

Essex Technology Group Inc., Cisco, West Virginia University, APIS IT

SAP, Aaron's, British Gas, FICO, Cox Automative, Callcredit Information Group, Vital and more.

HCL AppScan vs. OpenText Core Application Security