No more typing reviews! Try our Samantha, our new voice AI agent.

CAST Highlight vs Qualys Web Application Scanning comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
9.4
CAST Highlight users saved time and costs significantly, boosting productivity by doubling report output without extra resources.
Sentiment score
2.5
Qualys Web Application Scanning delivers positive ROI, competitive licensing, scalability, and reduces failure rates with 70% time-saving automation.
In terms of time saved, it went from approximately 3.5 hours per insight report to around 40 minutes, which is 80% faster.
Senior Data Engineer at LTM
 

Customer Service

Sentiment score
7.8
CAST Highlight's customer service receives mixed reviews, with effective technical support but issues in problem resolution and knowledge gaps.
Sentiment score
3.8
Customer service is generally positive but inconsistent, with some noting efficiency while others suggest improvements in speed and engagement.
Some support team members are helpful, and others lack in-depth knowledge of the tool, which might cause challenges.
Technical Associate Manager at Accenture
I interacted with customer support regarding one of my project results related to vulnerabilities and license risks, and they explained everything clearly, leaving me very satisfied.
Senior Data Engineer at LTM
They have various options in the vulnerability management process, and when we initially bought our license, we didn't realize we needed PCI for better results, which isn't included in the default configurations.
Security Officer at a tech vendor with 10,001+ employees
Once we purchase the license, we have access to top-notch support.
Team Lead, Cyber Security at Uridium Technologies
I have dealt with Qualys's technical support, and any enhancements are challenging.
Senior Security Engineer at Charter Communications
 

Scalability Issues

Sentiment score
7.3
CAST Highlight efficiently handles large codebases, supports many users, and seamlessly manages complex tasks across different environments.
Sentiment score
7.2
Qualys Web Application Scanning offers scalable cloud integration but faces challenges with concurrent scan limits and report limitations.
The processing time per new report stays consistent, experiencing no slowdowns even when we had over 200 new reports dropped in a week.
Senior Data Engineer at LTM
My concern remains the lack of deep dive analysis and that it produces similar vulnerability results as other tools such as Nessus based on version checks instead of real impact checks.
Security Officer at a tech vendor with 10,001+ employees
It is licensed for assets, so we just contact the team for additional licenses if needed.
Team Lead, Cyber Security at Uridium Technologies
At one point, there was a limitation on reporting for 100,000 assets at a time.
Senior Security Engineer at Charter Communications
 

Stability Issues

Sentiment score
8.0
CAST Highlight is reliable with minor bugs, facing challenges in data transfer and complex .NET framework compatibility.
Sentiment score
7.9
Users praise Qualys Web Application Scanning for its stability, reliability, minimal bugs, and consistently high-performance ratings.
 

Room For Improvement

CAST Highlight users seek better configuration, support, reporting, and integration while desiring enhanced abstraction, descriptions, and language insights.
Qualys Web Application Scanning needs improvements in detection, usability, integration, performance, pricing, and feature set to compete effectively.
Understanding only the OS-specific blockers means I would avoid resolving irrelevant issues, thus saving time.
Technical Associate Manager at Accenture
CAST Highlight's deduplication is great for avoiding spam, but sometimes we want two similar quotes if they are from very different company sizes, such as SMB versus enterprise perspectives on pricing.
Senior Data Engineer at LTM
With the growing reliance on AI, Qualys Web Application Scanning should be updated to handle AI-based applications and LLM-based attacks.
Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech
Qualys Web Application Scanning does IP-level testing, requiring direct input of credentials, and can only scan a few pages to provide known generic vulnerabilities.
Security Officer at a tech vendor with 10,001+ employees
I would like it to be cheaper because it is a bit expensive compared to competitors like Tenable Nessus.
Team Lead, Cyber Security at Uridium Technologies
 

Setup Cost

CAST Highlight charges by scan number with optional support upgrades; costs vary in perception and are often compared to CAST AIP.
Qualys Web Application Scanning offers flexible, negotiable pricing, deemed cost-effective but pricey, with discounts for bulk orders.
They offer discounts on bulk licenses, making it cheaper compared to competitors like Veracode DAST.
Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech
I find it a bit expensive compared to other competitors.
Team Lead, Cyber Security at Uridium Technologies
Regarding pricing, I think for personal use, it is costly, but if organizations are ready to pay, then it is fine as they are using it.
Security Officer at a tech vendor with 10,001+ employees
 

Valuable Features

CAST Highlight excels in user-friendliness, integration, fast automation, and insightful code analysis, enhancing productivity with intuitive tools.
Qualys Web Application Scanning offers efficient vulnerability management with Selenium IDE integration, real-time monitoring, and comprehensive security features.
Smart deduplication groups similar quotes and picks the strongest and most significant one. It stops insights from showing eight variations of great UI, giving diverse voices instead of repetition.
Senior Data Engineer at LTM
In cloud migration, I use CAST highlight to identify blockers, which are the negative road patterns, and also the boosters, which are positive code patterns.
Technical Associate Manager at Accenture
It effectively detects vulnerabilities like the OWASP Top 10 without any issues in reporting.
Senior Security Engineer at Charter Communications
Credential scanning is very effective because it goes in-depth into the system, crawling the pages, and reporting on vulnerabilities.
Team Lead, Cyber Security at Uridium Technologies
Qualys Web Application Scanning is accurate and provides minimal false positives.
Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech
 

Categories and Ranking

CAST Highlight
Average Rating
7.8
Reviews Sentiment
7.3
Number of Reviews
8
Ranking in other categories
Software Composition Analysis (SCA) (19th)
Qualys Web Application Scan...
Average Rating
7.6
Reviews Sentiment
6.3
Number of Reviews
40
Ranking in other categories
Application Security Tools (15th), Static Application Security Testing (SAST) (11th)
 

Mindshare comparison

CAST Highlight and Qualys Web Application Scanning aren’t in the same category and serve different purposes. CAST Highlight is designed for Software Composition Analysis (SCA) and holds a mindshare of 1.2%, up 0.9% compared to last year.
Qualys Web Application Scanning, on the other hand, focuses on Application Security Tools, holds 1.7% mindshare, down 2.1% since last year.
Software Composition Analysis (SCA) Mindshare Distribution
ProductMindshare (%)
CAST Highlight1.2%
Snyk11.1%
Black Duck SCA9.2%
Other78.5%
Software Composition Analysis (SCA)
Application Security Tools Mindshare Distribution
ProductMindshare (%)
Qualys Web Application Scanning1.7%
SonarQube12.7%
Checkmarx One8.3%
Other77.3%
Application Security Tools
 

Featured Reviews

Nishant Chauhan - PeerSpot reviewer
Senior Data Engineer at LTM
Automated code insights have improved security checks and made review workflows more consistent
If I talk about improvements for CAST Highlight, I would suggest three things. The first is better understanding or niche understanding. Right now, the intent matching is strong for general topics such as ease of use, but for niche B2B terms such as HIPAA compliance or multi-tenant architecture, it sometimes misses context. Improving the domain-specific models would make highlights more accurate for these verticals. The second improvement is more control over the deduplication logic. CAST Highlight's deduplication is great for avoiding spam, but sometimes we want two similar quotes if they are from very different company sizes, such as SMB versus enterprise perspectives on pricing. A slider to adjust deduplication strictness would help. The third suggestion I would like to give is deeper sentiment and outcome tagging. While it has core sentiment capabilities, it does not tag outcomes automatically. For instance, if a quote mentions saved $50,000 per year, tagging that as cost savings $50,000 would let us build ROI charts instantly instead of reading each quote manually. Regarding user experience, integrations, and reporting, I think there is room to enhance those aspects. Regarding user experience, I would suggest improving user actions in terms of bulk actions and keyboard shortcuts. Day-to-day analysts review 50-plus suggested quotes, and currently it is mostly clicking to approve one by one. Adding bulk approve or reject options and keyboard shortcuts would significantly reduce the time taken. A small UX change can lead to a big speed boost. The second point is integrations when pushing to the CMS and Slack alerts. Right now, we export approved highlights manually from CAST Highlight. If CAST Highlight could push directly to our CMS or send Slack alerts for high-strength quotes that hit trending topics, it would close the loop faster, reducing copy-pasting. The third improvement relates to reporting, specifically custom insight dashboards. The tool displays which topics have the most highlights, but we cannot build custom dashboards yet. For example, showing all security quotes from healthcare companies with more than 1,000 employees over the last 90 days would enable better filtering, and exportable dashboards would streamline quarterly reviews.
AnkitSharma13 - PeerSpot reviewer
Security Officer at a tech vendor with 10,001+ employees
Web scanning needs improvement but offers good vulnerability detection
The downside of Qualys Web Application Scanning is that it cannot crawl automatically. If I provide an IP address and a login form, it does basic testing, but it doesn't go deep as IBM AppScan does. If Qualys Web Application Scanning could improve its crawling capability, it would be more user-friendly. Qualys Web Application Scanning does IP-level testing, requiring direct input of credentials, and can only scan a few pages to provide known generic vulnerabilities, which isn't as beneficial from my point of view. The Vulnerability Management also relies heavily on version numbers and will flag vulnerabilities based on the component version, but it doesn't check if a real fix exists, leading to flags on components that actually have workarounds available.
report
Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.
902,417 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Outsourcing Company
8%
Government
8%
Computer Software Company
8%
Financial Services Firm
14%
Manufacturing Company
12%
Computer Software Company
8%
Construction Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise1
Large Enterprise6
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise6
Large Enterprise27
 

Questions from the Community

What is your experience regarding pricing and costs for CAST Highlight?
The pricing of CAST Highlight was not considered expensive or cheap, and no specific comment was made about the setup cost.
What needs improvement with CAST Highlight?
The solution provides agnostic blockers for platforms as well as for containerization. Within that containerization, it offers generic blockers. However, my project might require it to provide Wind...
What is your primary use case for CAST Highlight?
For CAST, I use it in cloud migration roadmap and in open source safety issues. These are my two main use cases.
What is your experience regarding pricing and costs for Qualys Web Application Scanning?
Regarding pricing, I think for personal use, it is costly, but if organizations are ready to pay, then it is fine as they are using it.
What needs improvement with Qualys Web Application Scanning?
The downside of Qualys Web Application Scanning is that it cannot crawl automatically. If I provide an IP address and a login form, it does basic testing, but it doesn't go deep as IBM AppScan does...
What is your primary use case for Qualys Web Application Scanning?
I use Qualys Web Application Scanning, and we are using Vulnerability Management. By Vulnerability Management, I mean not TotalCloud; they have some on-premises solutions also. Patch Management and...
 

Also Known As

No data available
Qualys WAS
 

Overview

 

Sample Customers

Wells Fargo, Bank of NY Mellon, Northern Trust, Microsoft, Amazon, IBM, BMW, AT&T, US Army, US Air Force, US Navy, John Hancock, Marsh & McLennan, Ernst & Young, PwC, Volkswagen, Boston Consulting Group, London Stock Exchange, Telefonica, Saur France, Total Energies France, SNCF
BskyB, Cartagena, ClearPoint Learning Systems, Connect Group, du, Fortrex Technologies, HBOR, HDI, Highlights for Children, The Lithuanian State Enterprise Centre of Registers, City of Miami Beach, Microsoft, MidlandHR, MSCI Inc., Northern Arizona University, Ofgem, Olympus Europa, PhoneFactor, RTL Nederland, ThousandEyes, VGZ Organisatie B.V.
Find out what your peers are saying about Snyk, Veracode, Black Duck and others in Software Composition Analysis (SCA). Updated: May 2026.
902,417 professionals have used our research since 2012.