HCL AppScan Reviews

It depends on the application, but it's generally a very user-friendly tool. Anyone can easily learn how to scan and boost their security.  

It's very accurate, although there might be a few false positives, but you can configure those out.

In future releases, I would like to see more aggressive reports. I would also like to see less false positives. 

There is room for improvement in pricing as well. 

Also, support for mobile apps would be better. Right now, we're only using it for web applications.

I've used AppScan for four years now.

I would rate the stability an eight out of ten. 

It is a scalable product. I would rate the scalability an eight out of ten. 

The customer service and support are very user-friendly. They'll send meetings whenever we need them, respecting our valuable time. They'll do their best to resolve our problems.

I used Fortify WebInspect in my previous company. They were more manual and time-consuming, and we often got more false positives. The result was very vast, and we needed to find everything and check over and over. We didn't find it very user-friendly.  

Fortify WebInspect was okay, but not as good. If we get the same result, it takes more time to understand the output and how to remediate it. It leaks more time. We need to reduce time nowadays and get things done.

AppScan is much faster and more reliable.  

We also used Burp Suite before, which was also user-friendly and allowed for manual testing. It's good for auto-mesh, but it takes longer and doesn't offer as much satisfactory results.

It is easy to implement and set up for users.

The pricing is good. We had two licenses, and we were offered good discounts. 

It's user-friendly and easy to install and analyze results. The solution also provides clear explanations and recommendations in the output, which is very helpful. I highly recommend it.

Overall, I would rate the solution a nine out of ten. 

I use HCL AppScan in my company for application security scanning.

The most valuable feature of the solution stems from the fact that it is good to run the scan faster. You can basically run the scan and take a break at work since the tool will compute the results, which makes the product quite intuitive. HCL AppScan doesn't require constant monitoring.

Maybe having some APIs could be helpful. If HCL AppScan is able to alert the clients over email once the scan is complete, it would be great. Right now, HCL AppScan doesn't let me know if the scanning part is finished or not, because of which I have to come back and check mostly. It would be helpful if the tool had some API gateway that would allow me to run some custom queries.

I have been using HCL AppScan for around four months. My company is a customer of HCL AppScan.

It is a stable solution.

It is a scalable solution.

Around 20 people in my company use HCL AppScan.

The solution's technical support is good. I rate the technical support an eight out of ten.

Positive

The initial setup or installation of HCL AppScan is easy.

Maybe two or three hours are required to deploy, install, and configure the product.

About seven or eight engineers and architects may be required to deploy the product.

The solution is deployed on the cloud.

The price of HCL AppScan is okay, in my opinion. You just buy HCL AppScan and don't pay anything anymore, meaning it is just a one-time purchase.

Once we get the updates for HCL AppScan, another team in my company takes care of the installation of the new updates, which takes about half a day.

I would tell those who plan to use HCL AppScan that it is a helpful and beginner-friendly product.

I rate the overall product a ten out of ten.

I use the tool to find system information for penetration testing and ethical hacking.

The solution is easy to use. It is useful for finding basic information about systems.

The product has some technical limitations. Finding critical things with the solution is difficult because most organizations update their systems. We find the product vulnerabilities manually.

I have been using the solution for four years.

I rate the stability an eight out of ten.

I rate the scalability a five out of ten. The solution is not enough for our needs. We are testing more than 50 companies with the solution. The largest company has more than 10,000 employees. We are planning to increase the number of users of the solution.

The initial setup is not difficult. I rate the ease of setup a seven out of ten.

It took us five minutes to install the solution. We need four engineers to maintain the solution.

I rate the solution’s pricing a five out of ten.

I am using the latest version of the solution. We usually perform ethical hacking using Burp Suite. The solution will be more advanced if it can be developed using ChatGPT. I would recommend the solution to others because it is the most famous web scanner. Overall, I rate the solution a five out of ten.

We use it for evaluating the application's code on web pages and previously published applications to identify vulnerabilities. It helps us to see how the code is written and how hard it is to find vulnerabilities. It's a useful tool for our purposes.

The product is useful, particularly in its sensitivity and scanning capabilities. Additionally, it allows for investigation while the developer is writing the code. It is a more efficient process compared to other tools like App Scan.

There is room for improvement in the pricing model. The price is very expensive.

I have been using HCL AppScan since 2011. It's the standard version, as we use it for evaluating applications and identifying vulnerabilities.

The stability is good. It's not just about the number of users because it's in use during development and while the application is running. So we have concurrent sessions, and it depends on the type of code being written at the moment.

It is a very scalable solution. The scalability is good.

The initial setup is very straightforward. Moreover, it's actually a quite nice solution because we don't require a lot of technical staff for deployment and maintenance.

The deployment process is good and included in the package, but it still needs to be installed before it can be used.

The pricing model is expensive. 

I would recommend the solution. Overall, I would rate the solution an eight out of ten. 

This is a primarily application security testing solution.

SAST is the only feature that works using the on-prem version. It's becoming very difficult for us to integrate it with the other SecOps solutions. It is a very good solution but only when using the standard version.

We have experienced challenges when trying to integrate this solution with other products. When you compare it with the other SecOps products, the quality of the output is too low. It is not a new-age product. It is very outdated.

The weaknesses of this solution include integration ability, the interface and the quality of the output. It lacks a lot of features if you compare it with Fortify, Veracode or Coverity. It is not possible to integrate with the CI/CD pipeline as cloud-native functionalities are not supported. 

We have been using this solution for one year. 

This is a stable solution. 

This solution is not scalable due to its inability to integrate with other solutions. 

Initially, we had a lot of hiccups and we logged a lot of cases with them. The support we received was okay.

Neutral

We are evaluating other options like Fortify and Checkmarx. We have worked with Fortify before. The advantage of this solution over HCL is its cloud setup. It is a solution that integrates well with other products. It also provides less false positives. Our main use case is that it should easily integrate with the CI/CD pipeline. The second requirements is that it should be easily integrate with the developer environment. These were the two main things which HCL AppScan does not provide.

The initial setup is not straightforward. It involved a couple of tweaks and changes within the environment itself. A couple of reinstallations were also required for us to get it working. It was not a click-and-run kind of a product.

Pricing was the main reason that we went ahead with this solution as they were the lowest in the market.

Overall performance of this solution is not terrible but it does not offer new age features. If you want to integrate with other solutions or complete testing in the cloud, this is not the right solution. I would advise others considering this solution to complete a proper proof of concept or to run a pilot before implementing it.

I would rate this solution a three out of ten. 

I used the solution to find vulnerabilities in our website and system. I did some regular checkups.

The UI was very intuitive. It was very easy to understand. It was very easy to scan the websites, see the results, and deliver them to higher management.

It would have been better if we could use it on our desktop. A desktop version should be added.

I had used the solution for one month.

The tool was very stable. I rate the tool’s stability a seven or eight out of ten. Very few people were using the tool in our organization. The stability could have been affected if there were more users.

We had a few users.

We have used solutions like Acunetix. HCL was better. The UI was pretty good. It was intuitive, easy to understand, and reliable.

The installation was easy for me. It took a few hours. A senior employee helped me deploy the tool. The solution was deployed on the cloud.

The tool was expensive. We paid a monthly license fee. There were no additional costs associated with the product.

Someone who wants to use the solution must know why they need the solution. It is quite expensive. We must not spend much on something we do not need. If we have a need and can afford the solution, HCL is a good solution. It is very easy to understand. It has a lot of features. The reporting system is good. Overall, I rate the product a seven out of ten.

The tool should improve its output. Scanning is not a challenge anymore since there are many such tools available in the market. The product needs to focus on how its output is being used by end users. It should be also more user-friendly. One of the major challenges is in the tool's integration with applications that need to be scanned. Sometimes, the scanning is not proper. 

I have been working with the solution for more than five years. 

I would rate the tool's stability a seven out of ten. The product's stability is fine if you have admin access. However, you may face issues during intense scanning. 

The product's technical support is not good. 

Neutral

The solution is easy to install. I would rate the product's setup between six to seven out of ten. The deployment time depends on the applications that need to be scanned. We have a development and operations team to take care of the product's maintenance. 

We did  the product's deployment in-house. 

I would rate the product's pricing a nine out of ten. The product's pricing is expensive compared to the features that they offer. 

I would rate the product a three out of ten. We use the solution only for quarterly scanning. There are better tools in the market at the same price. These tools can integrate more with applications. The tool's providers don't invest in making a good product. Hence, it is better to use a different tool. 

We use the solution to test our web applications and services.

The security and the dashboard are the most valuable features.

The pricing has room for improvement.

I have been using the solution for eight years.

I give the stability a seven out of ten.

I give the scalability an eight out of ten.

The support is fine.

Neutral

I give the initial setup a seven out of ten. The implementation took a few weeks.

The implementation was completed in-house.

We have seen around a 50 percent return on investment.

HCL AppScan is expensive.

I give the solution an eight out of ten.

I recommend the solution to others.

We have around 4,000 end users.