

Find out what your peers are saying about Snyk, Veracode, Black Duck and others in Software Composition Analysis (SCA).
Money saved is equal to approximately one FTE worth of manual research time per quarter.
For one of the clients, they actually improved their security a lot based on the CAST Highlight results.
Some support team members are helpful, and others lack in-depth knowledge of the tool, which might cause challenges.
I interacted with customer support regarding one of my project results related to vulnerabilities and license risks, and they explained everything clearly, leaving me very satisfied.
When I get one of the supporters from India, they actually fix whatever is wrong.
Veracode provides excellent assistance and regularly scheduled calls to address customer concerns and updates.
There is still room for improvement when it comes to the speed of response.
The processing time per new report stays consistent, experiencing no slowdowns even when we had over 200 new reports dropped in a week.
The analysis is performed next to the source code, which means the performance, if you increase the number of applications, will not be affected that much.
CAST Highlight is not that stable because it has a lot of downtime.
CAST Highlight proves reliable in nature.
Since we've been using HCL AppScan for about three months, we really have not encountered a false positive.
Understanding only the OS-specific blockers means I would avoid resolving irrelevant issues, thus saving time.
It would be nice if it were easier to actually drill down and figure out how the score was calculated and what the exact thing was that violated a rule.
For example, showing all security quotes from healthcare companies with more than 1,000 employees over the last 90 days would enable better filtering, and exportable dashboards would streamline quarterly reviews.
Currently, you can find out the components belonging to a specific software, but if detailed reporting became available, you would be in a better position to identify vulnerabilities.
The price was relatively low, which means it was easy to convince the customers.
Companies often choose based on budget constraints, with Veracode being on the higher end cost-wise.
Smart deduplication groups similar quotes and picks the strongest and most significant one. It stops insights from showing eight variations of great UI, giving diverse voices instead of repetition.
The user interface made the setup process smooth for me, but it was actually the CLI that stood out, as it was so easy to configure the scans that within an hour or two, I had the results to show.
In cloud migration, I use CAST highlight to identify blockers, which are the negative road patterns, and also the boosters, which are positive code patterns.
We were able to identify security issues such as certificate-related issues, authentication-related issues, and weak encryption-related issues.
AppScan's most valuable features include its ability to identify vulnerabilities accurately, provide detailed remediation steps, and the newly introduced AI-powered features that enhance its functionality further.
| Product | Mindshare (%) |
|---|---|
| CAST Highlight | 1.4% |
| Snyk | 11.1% |
| Black Duck SCA | 8.7% |
| Other | 78.8% |
| Product | Mindshare (%) |
|---|---|
| HCL AppScan | 2.4% |
| SonarQube | 10.2% |
| Checkmarx One | 6.8% |
| Other | 80.6% |


| Company Size | Count |
|---|---|
| Small Business | 3 |
| Midsize Enterprise | 1 |
| Large Enterprise | 6 |
| Company Size | Count |
|---|---|
| Small Business | 14 |
| Midsize Enterprise | 6 |
| Large Enterprise | 31 |
CAST Highlight is a SaaS software intelligence technology that delivers rapid, fact-based insights across your entire application portfolio. By automatically analyzing the source code of hundreds or thousands of applications, CAST Highlight helps organizations assess cloud maturity, AI & Agentic readiness, software health, open source risk, resiliency, technical debt, and sustainability from a single lightweight scan.
CAST Highlight is designed for CIOs, CTOs, enterprise architects, cloud leaders, application owners, security teams, and modernization teams that need a fact-based way to prioritize modernization, cloud, and AI adoption decisions at scale. It helps teams identify which applications are ready to move quickly, which require remediation, and where hidden software risks may affect transformation cost, timelines, security, resilience, or business outcomes.
Unlike traditional manual or survey-based assessments, CAST Highlight analyzes application source code directly to rapidly segment portfolios, prioritize modernization paths, and uncover risks before they impact transformation programs.
HCL AppScan offers quick vulnerability detection with effective SDLC integration and is known for its user-friendly interface and seamless security integration.
HCL AppScan provides dynamic and static scanning to identify vulnerabilities like XSS and SQL injection. It integrates well into CI/CD pipelines, supports multiple languages, and offers web and dynamic scanning, helping businesses ensure security across development lifecycles. Users benefit from API coverage, Postman integration, and its ability to function in cloud and on-premise environments, facilitating a shift from DevOps to DevSecOps practices.
What features define HCL AppScan?HCL AppScan is leveraged in sectors requiring rigorous security checks, such as finance and healthcare, where it conducts comprehensive scans and offers insights into potential vulnerabilities. Its robust scanning capabilities aid companies in maintaining compliance and security standards.
We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.