Try our new research platform with insights from 80,000+ expert users

Apache JMeter vs HCL AppScan comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Apache JMeter
Average Rating
7.8
Reviews Sentiment
7.1
Number of Reviews
93
Ranking in other categories
Performance Testing Tools (1st), Load Testing Tools (1st), API Testing Tools (3rd)
HCL AppScan
Average Rating
7.8
Reviews Sentiment
6.9
Number of Reviews
43
Ranking in other categories
Application Security Tools (14th), Static Application Security Testing (SAST) (12th), Dynamic Application Security Testing (DAST) (1st)
 

Mindshare comparison

While both are Quality Assurance solutions, they serve different purposes. Apache JMeter is designed for Performance Testing Tools and holds a mindshare of 22.8%, down 24.5% compared to last year.
HCL AppScan, on the other hand, focuses on Application Security Tools, holds 2.7% mindshare, up 2.6% since last year.
Performance Testing Tools
Application Security Tools
 

Featured Reviews

Sreenivasula Mukkamalla - PeerSpot reviewer
Leveraging cost-effective customization with powerful plugins but complexity reduction needed
Apache JMeter offers plugins for reporting and preparing test scenarios. It allows recording to customization, letting you download plugins to connect with databases or external systems. Despite being open source, it offers features comparable to paid tools, and its ability to customize and expand is particularly useful. Additionally, its open-source nature makes it cost-effective.
Rishi Anupam - PeerSpot reviewer
A stable and scalable scanning solution with good reporting feature
The solution is used for the vulnerabilities scan on the network side The reporting part is the most valuable feature. The penetration testing feature should be included. I have been using the solution for four years. It is a stable solution. I rate it seven out of ten. It is a scalable…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We appreciate that the solution is free to use, as an open-source tool."
"We find the ease of use and the reports and graphs available valuable."
"The most valuable features are the ability to capture the entire traffic of particular pages and the proper readability of entire pages and entire APIs."
"The thread groups, samplers, and listeners, which are all determined by the script's requirements, are the most valuable features of this solution."
"The most valuable feature of Apache JMeter is its popularity. It is the best open-source tool with all the features needed."
"This solution is easier to use than any other tool in the market; there is not even a requirement to learn a lot of scripting in order to use it."
"It's a powerful tool that is open source."
"It's very easy to install, and it's very easy to code and develop the script."
"The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase."
"It identifies all the URLs and domains on its own and then performs tests and provides the results."
"The solution is cheap."
"Usually when we deploy the application, there is a process for ethical hacking. The main benefit is that, the ethical hacking is almost clean, every time. So it's less cost, less effort, less time to production."
"This solution saves us time due to the low number of false positives detected."
"It is easy it is to use. It is quick to find things, because of the code scanning tools. It's quite simple to use and it is very good the way it reports the findings."
"For me, as a manager, it was the ease of use. Inserting security into the development process is not normally an easy project to do. The ability for the developer to actually use it and get results and focuses, that's what counted."
"The solution is easy to use."
 

Cons

"Apache should have a graphic interface."
"The solution could use some sort of educational features to offer tips and hints to help users navigate it better. They should improve the manuals and help files."
"Its reporting could be improved. There should be a better visual representation. That would be helpful for easy consumption of the reports."
"The UI of the solution needs to be better. The UI takes up a lot of our bandwidth."
"Because so much is being done these days with authentication processes, a better system for either getting bearer tokens or some kind of token-based authentication prior to executing APIs would benefit the product. It is there, and you can do things. It is just not real clean at this point. There should be a better authentication process for JMeter or some automation or better guidelines for gaining and utilizing tokens on the fly."
"JMeter's reporting is extremely rudimentary. The fundamental reporting mechanisms need to be drastically improved. It doesn't utilize an automatic session management mechanism or methods other tools use like parsing cookies and variables. Everything needs to be done manually. There's no automation."
"The installation needs some work. It could be simplified."
"The UI could be better."
"The penetration testing feature should be included."
"The solution often has a high number of false positives. It's an aspect they really need to improve upon."
"We have experienced challenges when trying to integrate this solution with other products. When you compare it with the other SecOps products, the quality of the output is too low. It is not a new-age product. It is very outdated."
"We would like to see a check in the specific vulnerabilities in mobile applications or rooted devices, such as jailbreaking devices."
"The solution needs to improve in some areas. The tool needs to add more languages. It also needs to improve its speed."
"They have to improve support."
"There is not a central management for static and dynamic."
"In future releases, I would like to see more aggressive reports. I would also like to see less false positives."
 

Pricing and Cost Advice

"I haven't looked into it. Most of our projects are nonprofit or grant-based. Everything is public commons, so we don't really have to worry about that so much."
"Since it's free, there's no need for extensive support or improvements in pricing."
"This is an open-source solution, and there are no fees."
"This is an open-source solution, so there are no licensing costs associated with it."
"The product has reasonable pricing."
"Apache JMeter is a free, open-source solution."
"This is an open-source solution, so there are no licensing costs involved."
"Free"
"The price is very expensive."
"With the features, that they offer, and the support, they offer, AppScan pricing is on a higher level."
"I would rate the product's pricing a nine out of ten. The product's pricing is expensive compared to the features that they offer."
"The price of HCL AppScan is okay, in my opinion. You just buy HCL AppScan and don't pay anything anymore, meaning it is just a one-time purchase."
"The solution is moderately priced."
"AppScan is a little bit expensive. IBM needs to work a little bit on the pricing model, decreasing the license cost."
"HCL AppScan is expensive."
"Pricing was the main reason that we went ahead with this solution as they were the lowest in the market."
report
Use our free recommendation engine to learn which Performance Testing Tools solutions are best for your needs.
850,671 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
20%
Computer Software Company
16%
Manufacturing Company
7%
Government
7%
Computer Software Company
19%
Financial Services Firm
14%
Government
11%
Manufacturing Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

How does Postman compare with Apache JMeter?
Postman lets you easily define variables, which then get updated automatically. This is a huge time-saver and makes processes very efficient. We can also export the test cases we create and share t...
How does BlazeMeter compare with Apache JMeter?
Blazemeter is a continuous testing platform that provides scriptless test automation. It unifies functional and performance testing, enabling users to monitor and test public and private APIs. We ...
What do you like most about Apache JMeter?
I appreciate JMeter's simplicity and power for performance testing.
What do you like most about HCL AppScan?
The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase.
What needs improvement with HCL AppScan?
AppScan needs to improve its handling of false positives. It also requires enhancements in customer support, similar to what Veracode provides. Regularly scheduling calls with clients to discuss fe...
What is your primary use case for HCL AppScan?
The primary use case for AppScan is for security purposes. I compare AppScan with other tools such as Veracode. We use AppScan for vulnerability detection and auto-remediation of vulnerabilities wi...
 

Also Known As

JMeter
IBM Security AppScan, Rational AppScan, AppScan
 

Overview

 

Sample Customers

AOL, Orbitz, Innopath Software, PrepMe, Sapient, Corporate Express Australia, CSIRO, Ephibian, Talis, DATACOM, ALALOOP, eFusion, Panter, Sourcepole, University of Western Cape
Essex Technology Group Inc., Cisco, West Virginia University, APIS IT
Find out what your peers are saying about Apache, Tricentis, Perforce and others in Performance Testing Tools. Updated: April 2025.
850,671 professionals have used our research since 2012.