No more typing reviews! Try our Samantha, our new voice AI agent.

CAST Highlight vs HCL AppScan comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
9.4
CAST Highlight users saved time and costs significantly, boosting productivity by doubling report output without extra resources.
Sentiment score
1.7
HCL AppScan enhances architecture with fewer errors and improved security, achieving 50% return and 20% cost savings.
Money saved is equal to approximately one FTE worth of manual research time per quarter.
Senior Data Engineer at LTM
 

Customer Service

Sentiment score
7.8
CAST Highlight's customer service receives mixed reviews, with effective technical support but issues in problem resolution and knowledge gaps.
Sentiment score
5.6
HCL AppScan's support is responsive with mixed reviews, facing regional challenges and lagging behind competitors like Veracode.
Some support team members are helpful, and others lack in-depth knowledge of the tool, which might cause challenges.
Technical Associate Manager at Accenture
I interacted with customer support regarding one of my project results related to vulnerabilities and license risks, and they explained everything clearly, leaving me very satisfied.
Senior Data Engineer at LTM
Veracode provides excellent assistance and regularly scheduled calls to address customer concerns and updates.
Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech
There is still room for improvement when it comes to the speed of response.
Founder Director at Techsa Services
 

Scalability Issues

Sentiment score
7.3
CAST Highlight efficiently handles large codebases, supports many users, and seamlessly manages complex tasks across different environments.
Sentiment score
3.9
HCL AppScan is scalable yet varies by license, integration issues, infrastructure compatibility, and CI/CD pipeline design effectiveness.
The processing time per new report stays consistent, experiencing no slowdowns even when we had over 200 new reports dropped in a week.
Senior Data Engineer at LTM
 

Stability Issues

Sentiment score
8.0
CAST Highlight is reliable with minor bugs, facing challenges in data transfer and complex .NET framework compatibility.
Sentiment score
7.2
HCL AppScan is stable and reliable, with minor hardware issues, improved by recent upgrades enhancing performance and stability.
CAST Highlight proves reliable in nature.
Senior Data Engineer at LTM
Since we've been using HCL AppScan for about three months, we really have not encountered a false positive.
Founder Director at Techsa Services
 

Room For Improvement

CAST Highlight users seek better configuration, support, reporting, and integration while desiring enhanced abstraction, descriptions, and language insights.
HCL AppScan requires improvements in vulnerability detection, usability, integration, performance, support, pricing, and language/codebase compatibility to stay competitive.
Understanding only the OS-specific blockers means I would avoid resolving irrelevant issues, thus saving time.
Technical Associate Manager at Accenture
For example, showing all security quotes from healthcare companies with more than 1,000 employees over the last 90 days would enable better filtering, and exportable dashboards would streamline quarterly reviews.
Senior Data Engineer at LTM
Currently, you can find out the components belonging to a specific software, but if detailed reporting became available, you would be in a better position to identify vulnerabilities.
Founder Director at Techsa Services
 

Setup Cost

CAST Highlight charges by scan number with optional support upgrades; costs vary in perception and are often compared to CAST AIP.
HCL AppScan is considered expensive but cost-effective, with varied pricing opinions influenced by its premium features and discounts.
Companies often choose based on budget constraints, with Veracode being on the higher end cost-wise.
Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech
 

Valuable Features

CAST Highlight excels in user-friendliness, integration, fast automation, and insightful code analysis, enhancing productivity with intuitive tools.
HCL AppScan detects vulnerabilities, integrates with agile processes, offers scalability, user-friendly features, and AI-enhanced rapid scanning for security.
It gives fresh review alerts, pinging us when new reviews come in with strong, castable quotes, so we do not miss new proof points for trending topics.
Senior Data Engineer at LTM
In cloud migration, I use CAST highlight to identify blockers, which are the negative road patterns, and also the boosters, which are positive code patterns.
Technical Associate Manager at Accenture
We were able to identify security issues such as certificate-related issues, authentication-related issues, and weak encryption-related issues.
Founder Director at Techsa Services
AppScan's most valuable features include its ability to identify vulnerabilities accurately, provide detailed remediation steps, and the newly introduced AI-powered features that enhance its functionality further.
Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech
 

Categories and Ranking

CAST Highlight
Average Rating
7.8
Reviews Sentiment
7.3
Number of Reviews
8
Ranking in other categories
Software Composition Analysis (SCA) (16th)
HCL AppScan
Average Rating
7.6
Reviews Sentiment
5.9
Number of Reviews
44
Ranking in other categories
Application Security Tools (23rd), Static Application Security Testing (SAST) (18th), Dynamic Application Security Testing (DAST) (7th)
 

Mindshare comparison

CAST Highlight and HCL AppScan aren’t in the same category and serve different purposes. CAST Highlight is designed for Software Composition Analysis (SCA) and holds a mindshare of 1.3%, up 1.0% compared to last year.
HCL AppScan, on the other hand, focuses on Application Security Tools, holds 2.3% mindshare, down 2.6% since last year.
Software Composition Analysis (SCA) Mindshare Distribution
ProductMindshare (%)
CAST Highlight1.3%
Snyk11.3%
Black Duck SCA9.0%
Other78.4%
Software Composition Analysis (SCA)
Application Security Tools Mindshare Distribution
ProductMindshare (%)
HCL AppScan2.3%
SonarQube11.7%
Checkmarx One7.9%
Other78.1%
Application Security Tools
 

Featured Reviews

Nishant Chauhan - PeerSpot reviewer
Senior Data Engineer at LTM
Automated code insights have improved security checks and made review workflows more consistent
If I talk about improvements for CAST Highlight, I would suggest three things. The first is better understanding or niche understanding. Right now, the intent matching is strong for general topics such as ease of use, but for niche B2B terms such as HIPAA compliance or multi-tenant architecture, it sometimes misses context. Improving the domain-specific models would make highlights more accurate for these verticals. The second improvement is more control over the deduplication logic. CAST Highlight's deduplication is great for avoiding spam, but sometimes we want two similar quotes if they are from very different company sizes, such as SMB versus enterprise perspectives on pricing. A slider to adjust deduplication strictness would help. The third suggestion I would like to give is deeper sentiment and outcome tagging. While it has core sentiment capabilities, it does not tag outcomes automatically. For instance, if a quote mentions saved $50,000 per year, tagging that as cost savings $50,000 would let us build ROI charts instantly instead of reading each quote manually. Regarding user experience, integrations, and reporting, I think there is room to enhance those aspects. Regarding user experience, I would suggest improving user actions in terms of bulk actions and keyboard shortcuts. Day-to-day analysts review 50-plus suggested quotes, and currently it is mostly clicking to approve one by one. Adding bulk approve or reject options and keyboard shortcuts would significantly reduce the time taken. A small UX change can lead to a big speed boost. The second point is integrations when pushing to the CMS and Slack alerts. Right now, we export approved highlights manually from CAST Highlight. If CAST Highlight could push directly to our CMS or send Slack alerts for high-strength quotes that hit trending topics, it would close the loop faster, reducing copy-pasting. The third improvement relates to reporting, specifically custom insight dashboards. The tool displays which topics have the most highlights, but we cannot build custom dashboards yet. For example, showing all security quotes from healthcare companies with more than 1,000 employees over the last 90 days would enable better filtering, and exportable dashboards would streamline quarterly reviews.
Ravi Khanchandani - PeerSpot reviewer
Founder Director at Techsa Services
Has improved identification of encryption and authentication issues across cloud and on-prem applications
During the learning curve of onboarding HCL AppScan, we learned that HCL has altered the portfolio and now offers HCL AppScan 360, which has a much better look and feel with an improved user interface. However, there is one feature called SCA, which stands for Software Composition Analysis, that could be improved. When I'm doing an application scan, HCL AppScan has the ability to generate information about what components are in use. For example, if I'm scanning a web application, it shows me the various components being used. It tells me whether I have Java libraries, .NET frameworks, or other log management libraries such as Log4j, and what versions of those specific components are present. I would like to see more detailed reports from the tool. Currently, you can find out the components belonging to a specific software, but if detailed reporting became available, you would be in a better position to identify vulnerabilities. For instance, I could identify that I had the Log4j vulnerability and know that I need to fix my application accordingly. If they add the features I'm describing, I would consider giving them a higher rating. However, I've only been experienced with the product for three months.
report
Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.
909,647 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Outsourcing Company
14%
Financial Services Firm
14%
Government
8%
Educational Organization
6%
Financial Services Firm
10%
Manufacturing Company
9%
Government
8%
Construction Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise1
Large Enterprise6
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise6
Large Enterprise31
 

Questions from the Community

What is your experience regarding pricing and costs for CAST Highlight?
The pricing of CAST Highlight was not considered expensive or cheap, and no specific comment was made about the setup cost.
What needs improvement with CAST Highlight?
If I talk about improvements for CAST Highlight, I would suggest three things. The first is better understanding or niche understanding. Right now, the intent matching is strong for general topics ...
What is your primary use case for CAST Highlight?
I have been using CAST Highlight for the last four years. In my company, we use CAST Highlight to perform testing for our code to find vulnerabilities and license risks. We also use CAST Highlight ...
What needs improvement with HCL AppScan?
During the learning curve of onboarding HCL AppScan, we learned that HCL has altered the portfolio and now offers HCL AppScan 360, which has a much better look and feel with an improved user interf...
What is your primary use case for HCL AppScan?
I'm currently working with BigFix and HCL AppScan. At least three people in my company are using HCL AppScan. Since we are a reseller, we run it in both lab environments and live production applica...
What is your experience regarding pricing and costs for HCL AppScan?
AppScan is considered more cost-effective than Veracode, although I have not updated the exact pricing details. Companies often choose based on budget constraints, with Veracode being on the higher...
 

Comparisons

 

Also Known As

No data available
IBM Security AppScan, Rational AppScan, AppScan
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Liberty Mutual, Barclays, Microsoft, Amazon, IBM, US Army, US Air Force, US Navy, Marsh & McLennan, Ernst & Young, PwC, Boston Consulting Group, Telefonica, Total Energies France, SNCF, Broadridge, Sirius XM
Essex Technology Group Inc., Cisco, West Virginia University, APIS IT
Find out what your peers are saying about Snyk, Veracode, Black Duck and others in Software Composition Analysis (SCA). Updated: August 2026.
909,647 professionals have used our research since 2012.