

Find out what your peers are saying about Snyk, Veracode, Black Duck and others in Software Composition Analysis (SCA).
Money saved is equal to approximately one FTE worth of manual research time per quarter.
Some support team members are helpful, and others lack in-depth knowledge of the tool, which might cause challenges.
I interacted with customer support regarding one of my project results related to vulnerabilities and license risks, and they explained everything clearly, leaving me very satisfied.
Veracode provides excellent assistance and regularly scheduled calls to address customer concerns and updates.
There is still room for improvement when it comes to the speed of response.
The processing time per new report stays consistent, experiencing no slowdowns even when we had over 200 new reports dropped in a week.
CAST Highlight proves reliable in nature.
Since we've been using HCL AppScan for about three months, we really have not encountered a false positive.
Understanding only the OS-specific blockers means I would avoid resolving irrelevant issues, thus saving time.
For example, showing all security quotes from healthcare companies with more than 1,000 employees over the last 90 days would enable better filtering, and exportable dashboards would streamline quarterly reviews.
Currently, you can find out the components belonging to a specific software, but if detailed reporting became available, you would be in a better position to identify vulnerabilities.
Companies often choose based on budget constraints, with Veracode being on the higher end cost-wise.
It gives fresh review alerts, pinging us when new reviews come in with strong, castable quotes, so we do not miss new proof points for trending topics.
In cloud migration, I use CAST highlight to identify blockers, which are the negative road patterns, and also the boosters, which are positive code patterns.
We were able to identify security issues such as certificate-related issues, authentication-related issues, and weak encryption-related issues.
AppScan's most valuable features include its ability to identify vulnerabilities accurately, provide detailed remediation steps, and the newly introduced AI-powered features that enhance its functionality further.
| Product | Mindshare (%) |
|---|---|
| CAST Highlight | 1.3% |
| Snyk | 11.3% |
| Black Duck SCA | 9.0% |
| Other | 78.4% |
| Product | Mindshare (%) |
|---|---|
| HCL AppScan | 2.3% |
| SonarQube | 11.7% |
| Checkmarx One | 7.9% |
| Other | 78.1% |


| Company Size | Count |
|---|---|
| Small Business | 2 |
| Midsize Enterprise | 1 |
| Large Enterprise | 6 |
| Company Size | Count |
|---|---|
| Small Business | 14 |
| Midsize Enterprise | 6 |
| Large Enterprise | 31 |
CAST Highlight is a SaaS software intelligence technology that delivers rapid, fact-based insights across your entire application portfolio. By automatically analyzing the source code of hundreds or thousands of applications, CAST Highlight helps organizations assess cloud maturity, AI & Agentic readiness, software health, open source risk, resiliency, technical debt, and sustainability from a single lightweight scan.
CAST Highlight is designed for CIOs, CTOs, enterprise architects, cloud leaders, application owners, security teams, and modernization teams that need a fact-based way to prioritize modernization, cloud, and AI adoption decisions at scale. It helps teams identify which applications are ready to move quickly, which require remediation, and where hidden software risks may affect transformation cost, timelines, security, resilience, or business outcomes.
Unlike traditional manual or survey-based assessments, CAST Highlight analyzes application source code directly to rapidly segment portfolios, prioritize modernization paths, and uncover risks before they impact transformation programs.
HCL AppScan offers quick vulnerability detection with effective SDLC integration and is known for its user-friendly interface and seamless security integration.
HCL AppScan provides dynamic and static scanning to identify vulnerabilities like XSS and SQL injection. It integrates well into CI/CD pipelines, supports multiple languages, and offers web and dynamic scanning, helping businesses ensure security across development lifecycles. Users benefit from API coverage, Postman integration, and its ability to function in cloud and on-premise environments, facilitating a shift from DevOps to DevSecOps practices.
What features define HCL AppScan?HCL AppScan is leveraged in sectors requiring rigorous security checks, such as finance and healthcare, where it conducts comprehensive scans and offers insights into potential vulnerabilities. Its robust scanning capabilities aid companies in maintaining compliance and security standards.
We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.