HCL AppScan vs OpenText Core Application Security comparison

HCLSoftware and OpenText are both solutions in the Application Security Tools category. HCLSoftware is ranked #15 with an average rating of 8.3, while OpenText is ranked #14 with an average rating of 8.0. HCLSoftware holds a 2.5% mindshare in AS, compared to OpenText’s 3.9% mindshare. Additionally, 84% of HCLSoftware users are willing to recommend the solution, compared to 89% of OpenText users who would recommend it.

HCL AppScan

Read 43 HCL AppScan reviews

4,377 Views
3,108 Comparison Views

84% willing to recommend

OpenText Core Application S...

Read 60 OpenText Core Application Security reviews

6,920 Views
5,121 Comparison Views

89% willing to recommend

HCL AppScan

OpenText Core Application S...

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 21, 2025

HCL AppScan and OpenText Core Application Security compete in the application security category. HCL AppScan seems to have an edge due to its advanced vulnerability detection and seamless integration with agile development methodologies.

Features: HCL AppScan offers advanced vulnerability detection, API integration, and low false-positive rates. It supports multiple languages and integrates seamlessly into agile development methodologies. OpenText Core Application Security focuses on comprehensive security threat detection, supporting dynamic and static analysis and easy integration with DevOps processes while providing a straightforward interface.

Room for Improvement: HCL AppScan users suggest improvements in usability, integration with certain CI/CD pipelines, and false-positive handling. It also needs better customer support and a more streamlined interface. OpenText could reduce false positives, improve integration with various platforms, and enhance support and container scanning speed.

Ease of Deployment and Customer Service: HCL AppScan provides versatile deployment options, including on-premises and public cloud. Its technical support has mixed reviews, with some challenges post-IBM transition. OpenText supports public and hybrid cloud environments, receiving praise for responsive customer service, though some regions report insufficient support resources.

Pricing and ROI: HCL AppScan is considered expensive but worthwhile for its features, leading to significant ROI in vulnerability reduction. OpenText offers flexible pricing with scalable licensing options, considered more affordable yet occasionally criticized for high costs in specific scenarios. Both solutions effectively integrate with existing infrastructures to enhance application security.

To learn more, read our detailed HCL AppScan vs. OpenText Core Application Security Report (Updated: September 2025).

Buyer's Guide

HCL AppScan vs. OpenText Core Application Security

September 2025

Download the complete report

Helped 868,706 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

HCL AppScan

Ranking in Application Security Tools

15th

Ranking in Static Application Security Testing (SAST)

14th

Average Rating

7.8

Reviews Sentiment

5.9

Number of Reviews

Ranking in other categories

Dynamic Application Security Testing (DAST) (1st)

OpenText Core Application S...

Ranking in Application Security Tools

14th

Ranking in Static Application Security Testing (SAST)

13th

Average Rating

8.0

Reviews Sentiment

7.8

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of October 2025, in the Application Security Tools category, the mindshare of HCL AppScan is 2.5%, down from 2.6% compared to the previous year. The mindshare of OpenText Core Application Security is 3.9%, down from 5.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools Market Share Distribution
Product	Market Share (%)
OpenText Core Application Security	3.9%
HCL AppScan	2.5%
Other	93.6%

Application Security Tools

Featured Reviews

Gladwin Christian

QA manager at SmartStream Technologies ltd.

A useful tool to scan applications that can be easily installed

Given that we have been using HCL AppScan for many years, I think the setup process is not difficult at all. Sometimes, some issues stop or prevent my company from moving forward with the product's setup phase. We have to call HCL's support team and engage in long discussions to smoothly carry out the setup phase. In general, the product's setup phase is not difficult in our company. The solution is deployed on an on-premises model. The licenses for the solution are available only on cloud deployments nowadays. The solution is already installed in our environment. Every time a new release or software comes out from HCL, our company does a scan, which takes maybe a day or two.

Read full review

Jonathan Steyn

Principal Technical Consultant at EOH

Source code analyzer, FPR file generation, reduction of false positives and generates compliance reports, for in-depth analysis

Not challenges with the product itself. The product is very reliable. It does have a steep learning curve. But, again, one thing that Fortify or OpenText does very well is training. There are a lot of free resources and training in the community forums, free training as well as commercial training where users can train on how to use the back-end systems and the scanning engines and how to use command-line arguments because some of the procedures or some of the tools do require a bit of a learning curve. That's the only challenge I've really seen for customers because you have to learn how to use the tool effectively. But Fortify has, in fact, improved its user interface and the way users engage the dashboards and the interfaces. It is intuitive. It's easy to understand. But in some regards, the cybersecurity specialist or AppSec would need a bit of training to engage the user interface and to understand how it functions. But from the point of the reliability index and how powerful the tool is, there's no challenge there. But it's just from a learning perspective; users might need a bit more skill to use the tool. The user interface isn't that tedious. It's not that difficult to understand. When I initially learned how to use the interfaces, I was able to master it within a week and was able to use it quite effectively. So training is required. All skills are needed to learn how to use the tool. I would like to see more enhancements in the dashboards. Dashboards are available. They do need some configuration and settings. But I would like to see more business intelligence capabilities within the tool. It's not particularly a cybersecurity function, but, for instance, business impact analysis or other features where you can actually use business intelligence capabilities within your security tool. That would be remarkable because not only do you have a cybersecurity tool, but you also have a tool that can give you business impact analysis and some other measurements. A bit more intelligence in terms of that from a cybersecurity perspective would be remarkable.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The UI was very intuitive."

"You can easily find particular features and functions through the UI."

"There's extensive functionality with custom rules and a custom knowledge base."

"The solution is easy to install. I would rate the product's setup between six to seven out of ten. The deployment time depends on the applications that need to be scanned. We have a development and operations team to take care of the product's maintenance."

"The platform has valuable security features, helping us identify sensitive code issues and the possibility of internal applications' exposure to external threats."

"Technical support is helpful."

"This solution saves us time due to the low number of false positives detected."

"It comes with all of the templates that we need. For example, we are a company that is regulated by PCI. In order to be PCI compliant, we have a lot of checks and procedures to which we have to comply."

More HCL AppScan pros

"We identified a lot of security vulnerability much earlier in the development and could fix this well before the product was rolled out to a huge number of clients."

"Being able to reduce risk overall is a very valuable feature for us."

"It's a stable and scalable solution."

"Each bank may have its own core banking applications with proprietary support for different programming languages. This makes Fortify particularly relevant and advantageous in those cases."

"The user interface is good."

"I use the solution in my company for security code scans."

"The licensing was good."

"Its ability to perform different types of scans, keep everything in one place, and track the triage process in Fortify SSC stands out."

More OpenText Core Application Security pros

Cons

"The solution could improve by having a mobile version."

"Improving usability could enhance the overall experience with AppScan. It would be beneficial to make the solution more user-friendly, ensuring that everyone can easily navigate and utilize its features."

"I think being able to search across more containers, especially some of the docker elements. We need a little tighter integration there. That's the only thing I can see at this point."

"One thing which I think can be improved is the CI/CD Integration"

"I would love to see more containers. Many of the tools are great, they require an amount of configuration, setup and infrastructure. If most the applications were in a container, I think everything would be a little bit faster, because all our clients are now using containers."

"The solution's scalability can be a matter of concern because one license runs on one machine only."

"AppScan needs to improve its handling of false positives."

"The penetration testing feature should be included."

More HCL AppScan cons

"There are frequent complaints about false positives from Fortify."

"Not fully integrated with CIT processes."

"In terms of communication, they can integrate a few more third-party tools. It would be great if we can have more options for microservice communication. They can also improve the securability a bit more because security is one of the biggest aspects these days when you are using the cloud. Some more security features would be really helpful."

"It could have a little bit more streamlined installation procedure. Based on the things that I've done, it could also be a bit more automated. It is kind of taking a bunch of different scanners, and SSC is just kind of managing the results. The scanning doesn't really seem to be fully integrated into the SSC platform. More automation and any kind of integration in the SSC platform would definitely be good. There could be a way to initiate scans from SSC and more functionality on the server-side to initiate desk scans if it is not already available."

"The solution has some issues with latency. Sometimes it takes a while to respond. This issue should be addressed."

"The technical support is actually a problem that needs to be addressed. Since the acquisition and merger with Hewlett Packard, it has been really hard to know who the technical or salesperson to talk to."

".NET code scanning is still dependent on building the code base before running any scan. Also, it's dependent on an IDE such as Visual Studio."

"There are frequent complaints about false positives from Fortify. One day it may pass a scan with no issues, and the next day, without any code changes, it will report vulnerabilities such as password exposure."

More OpenText Core Application Security cons

Pricing and Cost Advice

"The solution is moderately priced."

"I rate the product's price a seven on a scale of one to ten, where one is low, and ten is high. HCL AppScan is an expensive tool."

"HCL AppScan is expensive."

"The tool was expensive."

"The product is moderately priced, though it's an investment due to extensive code analysis needs."

"AppScan is a little bit expensive. IBM needs to work a little bit on the pricing model, decreasing the license cost."

"With the features, that they offer, and the support, they offer, AppScan pricing is on a higher level."

"Pricing was the main reason that we went ahead with this solution as they were the lowest in the market."

More HCL AppScan pricing and cost advice

"It is cost-effective."

"It is not more expensive than other solutions, but the pricing is competitive."

"Micro Focus Fortify on Demand licenses are managed by our IT team and the license model is user-based."

"The pricing model it's based on how many applications you wish to scan."

"It is quite expensive. Pricing and the licensing model could be improved."

"We are still using the trial version at this point but I can already see from the trial version alone that it is a good product. For others, I would say that Fortify on Demand might look expensive at the beginning, but it is very powerful and so you shouldn't be put off by the price."

"Fortify on Demand is moderately priced, but its pricing could be more flexible."

"We used the one-time application, Security Scan Dynamic. I believe the original fee was $8,000."

More OpenText Core Application Security pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

868,706 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

15%

Financial Services Firm

12%

Government

10%

Manufacturing Company

10%

Financial Services Firm

19%

Manufacturing Company

15%

Computer Software Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	13
Midsize Enterprise	6
Large Enterprise	31

By reviewers
Company Size	Count
Small Business	16
Midsize Enterprise	8
Large Enterprise	43

Questions from the Community

What do you like most about HCL AppScan?

The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase.

See all answers

What needs improvement with HCL AppScan?

AppScan needs to improve its handling of false positives. It also requires enhancements in customer support, similar to what Veracode provides. Regularly scheduling calls with clients to discuss fe...

See all answers

What is your primary use case for HCL AppScan?

The primary use case for AppScan is for security purposes. I compare AppScan with other tools such as Veracode. We use AppScan for vulnerability detection and auto-remediation of vulnerabilities wi...

See all answers

What do you like most about Micro Focus Fortify on Demand?

It helps deploy and track changes easily as per time-to-time market upgrades.

See all answers

What is your experience regarding pricing and costs for Micro Focus Fortify on Demand?

In comparison with other tools, they're competitive. It is not more expensive than other solutions, but their pricing is competitive. The licenses for Fortify On Demand are generally bought in unit...

See all answers

What needs improvement with Micro Focus Fortify on Demand?

There are frequent complaints about false positives from Fortify. One day it may pass a scan with no issues, and the next day, without any code changes, it will report vulnerabilities such as passw...

See all answers

Comparisons

SonarQube Server (formerly SonarQube) vs HCL AppScan

Compared 12% of the time

Acunetix vs HCL AppScan

Compared 11% of the time

Veracode vs HCL AppScan

Compared 11% of the time

OWASP Zap vs HCL AppScan

Compared 8% of the time

Qualys Web Application Scanning vs HCL AppScan

Compared 5% of the time

More HCL AppScan Competitors

SonarQube Server (formerly SonarQube) vs OpenText Core Application Security

Compared 16% of the time

Checkmarx One vs OpenText Core Application Security

Compared 13% of the time

Coverity Static vs OpenText Core Application Security

Compared 9% of the time

Veracode vs OpenText Core Application Security

Compared 9% of the time

OpenText Dynamic Application Security Testing vs OpenText Core Application Security

Compared 3% of the time

More OpenText Core Application Security Competitors

Product Reports

Buyer's Guide

HCL AppScan

September 2025

Download HCL AppScan product report

Buyer's Guide

OpenText Core Application Security

September 2025

OpenText Core Application Security report

Download OpenText Core Application Security product report

Also Known As

IBM Security AppScan, Rational AppScan, AppScan

Micro Focus Fortify on Demand

Overview

IBM Security AppScan enhances web application security and mobile application security, improves application security program management and strengthens regulatory compliance. By scanning your web and mobile applications prior to deployment, AppScan enables you to identify security vulnerabilities and generate reports and fix recommendations.

HCLSoftware

OpenText Core Application Security offers robust features like static and dynamic scanning, real-time vulnerability tracking, and seamless integration with development platforms, designed to enhance code security and reduce operational costs.

OpenText Core Application Security is a cloud-based, on-demand service providing accurate and deep scanning capabilities with detailed reporting. Its integrations with development platforms ensure an enhanced security layer in the development lifecycle, benefiting users by lowering operational costs and facilitating efficient remediation. The platform addresses needs for intuitive interfaces, API support, and comprehensive vulnerability assessments, helping improve code security and accelerate time-to-market. Despite its strengths, challenges exist around false positives, report clarity, and language support, alongside confusing pricing and package options. Enhancements are sought in areas like CI/CD pipeline configuration, report visualization, scan times, and integration with third-party tools such as GitLab, container scanning, and software composition analysis.

What features define OpenText Core Application Security?

Static and Dynamic Scanning: Offers thorough analysis to identify vulnerabilities during development.
Real-time Vulnerability Tracking: Continuously updates and monitors potential security threats.
Seamless Development Platform Integration: Enhances security processes without disrupting workflows.
Cloud-Based Service: Provides flexible, on-demand security capabilities with accurate results.
API Support: Allows smooth integration and automation within existing systems.

What benefits should users look for in reviews?

Reduced Operational Costs: Optimizes resources by lowering costs associated with security management.
Efficient Remediation: Speeds up the process of identifying and resolving vulnerabilities.
Enhanced Code Security: Strengthens overall application security during the development lifecycle.
Accelerated Time-to-Market: Streamlines development stages by integrating essential security tools.

Industries like mobile applications, e-commerce, and banking leverage OpenText Core Application Security for its ability to identify vulnerabilities such as SQL injections. Integrating seamlessly with DevSecOps and security auditing processes, this tool supports developers in writing safer code, ensuring secure application deployment and enhancing software assurance.

OpenText

Sample Customers

Essex Technology Group Inc., Cisco, West Virginia University, APIS IT

SAP, Aaron's, British Gas, FICO, Cox Automative, Callcredit Information Group, Vital and more.

Buyer's Guide

HCL AppScan vs. OpenText Core Application Security

September 2025

Free Report: HCL AppScan vs. OpenText Core Application Security

Find out what your peers are saying about HCL AppScan vs. OpenText Core Application Security and other solutions. Updated: September 2025.

DOWNLOAD NOW

868,706 professionals have used our research since 2012.

See our HCL AppScan vs. OpenText Core Application Security report.

See our list of best Application Security Tools vendors and best Static Application Security Testing (SAST) vendors.

We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.