Checkmarx One vs HCL AppScan vs Veracode comparison

Read 208 Veracode reviews

19,227 Views
11,536 Comparison Views

89% willing to recommend

Checkmarx One

HCL AppScan

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx One, HCL AppScan, and Veracode based on real PeerSpot user reviews.

Find out what your peers are saying about SonarSource Sàrl, Checkmarx, Veracode and others in Application Security Tools.

To learn more, read our detailed Application Security Tools Report (Updated: February 2026).

Application Security Tools

February 2026

Download the complete report

Helped 885,444 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

ROI

Sentiment score

5.6

Checkmarx One enhances security by automating vulnerability detection, reducing costs, and improving development efficiency through CI/CD integration.

Sentiment score

1.7

HCL AppScan enhances architecture with fewer errors and improved security, achieving 50% return and 20% cost savings.

Sentiment score

6.5

Veracode optimizes development by automating vulnerability detection, reducing costs, improving security, compliance, and enhancing software reliability.

Overall, between the fast scanning, automation, automatic reporting, and easy detection, it has reduced manual effort enough that we did not need an extra reviewer, even as our codebase or team size grew.

Swetha Dhanasekar

Senior GenAI Engineer at a tech vendor with 10,001+ employees

Based on my interactions with the clients, I can tell that there is a return on investment because if something is not profitable and it's not helping to save costs or vulnerabilities, clients wouldn't come back to renew their license year after year.

Gideon Anichi

Chief Technology Officer at 3CS Aquarah Limited

For more quotes and insights, download the Checkmarx One report

No quotes available

For more quotes and insights, download the HCL AppScan report

The scanners of Veracode bring status of the weaknesses in the current infrastructure. It scans and provides reports regarding the servers, the network, and the applications running on those servers.

AlejandroMosso

Senior Solutions Architect at IDS Comercial

Regarding price, the evaluation should focus on how efficiently they will recover their investment, considering the time saved through the use of Veracode Fix, for example, and the ability to fix code at dev time compared to the problems faced when fixing after the product is already deployed.

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

We did see a return on investment with Veracode, as we segregated our remediation efforts, which reduced our time to delivery as well as the number of engineers needed to help us in delivering a secure solution.

reviewer2774562

DevSecOps Engineer at a tech services company with 11-50 employees

For more quotes and insights, download the Veracode report

Customer Service

Sentiment score

7.0

Checkmarx One support is praised for quick responses and knowledgeable staff, despite some reporting delays in technical support.

Sentiment score

5.6

HCL AppScan's support is responsive with mixed reviews, facing regional challenges and lagging behind competitors like Veracode.

Sentiment score

7.2

Veracode's support is praised for responsiveness and expertise, though some experience delays with complex issues.

If you raise a support case with Checkmarx, it is handled smoothly.

RiteshWalia

ML Engineer - Specialist at a tech vendor with 10,001+ employees

The customer support team is amazing and they provide on-phone call, email support, and on-website support.

For more quotes and insights, download the Checkmarx One report

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

I have relied on Checkmarx One customer support hundreds of times for several things, and Checkmarx One support is very proactive and very responsive.

Gideon Anichi

Chief Technology Officer at 3CS Aquarah Limited

Veracode provides excellent assistance and regularly scheduled calls to address customer concerns and updates.

MukeshSaha

Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech

There is still room for improvement when it comes to the speed of response.

For more quotes and insights, download the HCL AppScan report

Founder Director at Techsa Services

Access to the engineering team is crucial for faster feedback on the product fix process.

SrikanthRaghavan

Principal Architect at a consultancy with 11-50 employees

I have communicated with the technical support of Veracode a couple of times, and this was a really great experience because these professionals know their material.

Andrei Kriukov

Application Security Specialist at Herrenknecht

They share detailed information via email, including screenshots or further clarification about the issue.

reviewer2753535

DevSecOps Engineer at a tech services company with 1,001-5,000 employees

For more quotes and insights, download the Veracode report

Scalability Issues

Sentiment score

7.0

Checkmarx One is scalable for large workloads, but some users report challenges with configurations and licensing requirements.

Sentiment score

3.9

HCL AppScan is scalable yet varies by license, integration issues, infrastructure compatibility, and CI/CD pipeline design effectiveness.

Sentiment score

7.4

Veracode offers efficient scalability with cloud architecture, supporting diverse applications and user roles across industries despite minor scan delays.

Approximately four billion lines of code are being scanned monthly.

Ricardo Sousa da Silva

Cyber Security Expert at Nestle

Since it is cloud-based, the infrastructure and PaaS, IaaS, and SaaS are taken care of by the cloud marketplace.

For more quotes and insights, download the Checkmarx One report

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Checkmarx One's scalability has changed my organization because the strong collaboration between the development and security team helps us to do things much faster.

Swetha Dhanasekar

Senior GenAI Engineer at a tech vendor with 10,001+ employees

No quotes available

For more quotes and insights, download the HCL AppScan report

Cloud solutions are easier to scale than on-premise solutions.

AlejandroMosso

Senior Solutions Architect at IDS Comercial

It has a good capacity to scale effectively.

Brintha Prabakar

Lead Automation Quality Engineer in Leading UK Bank at a consultancy with 10,001+ employees

Implementing these features into our normal CI/CD was good, so I can say that scalability is really good.

Andrei Kriukov

Application Security Specialist at Herrenknecht

For more quotes and insights, download the Veracode report

Stability Issues

Sentiment score

7.3

Checkmarx One is generally stable but faces issues with large codebases, memory use, and session inconsistencies.

Sentiment score

7.2

HCL AppScan is stable and reliable, with minor hardware issues, improved by recent upgrades enhancing performance and stability.

Sentiment score

7.8

Veracode is praised for stability and performance despite minor glitches, with continuous improvements ensuring reliability and minimal downtime.

I would rate the stability of this solution a nine on a scale of 1 to 10 where one is low stability and 10 is high.

Syed Hasan

Specialist Leader at Deloitte

Checkmarx One is often down when the cloud provider experiences issues.

Ricardo Sousa da Silva

Cyber Security Expert at Nestle

For more quotes and insights, download the Checkmarx One report

Since we've been using HCL AppScan for about three months, we really have not encountered a false positive.

For more quotes and insights, download the HCL AppScan report

Founder Director at Techsa Services

If the Veracode server is down, we experience many issues during the scan.

Brintha Prabakar

Lead Automation Quality Engineer in Leading UK Bank at a consultancy with 10,001+ employees

I have observed that it is not that reliable in terms of security because Veracode was not able to find some security threats in our application that existed since the product was developed.

Yash Shende

Software Development Engineer II at Rocket Software

It's not that easy to onboard, but once they have been onboarded on the platform, and the pipeline configured alongside the product configured, it works effectively.

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

For more quotes and insights, download the Veracode report

Room For Improvement

Checkmarx One needs enhancements in accuracy, speed, integration, UI, support, pricing, and features for enterprise usability.

HCL AppScan requires improvements in vulnerability detection, usability, integration, performance, support, pricing, and language/codebase compatibility to stay competitive.

Veracode requires improvements in reducing false positives, enhancing speed, improving integration, flexibility, support, UI, and customer service.

Integration into the IDE being used would be beneficial so that code does not need to be uploaded to the website and an IDE-friendly report could be generated.

reviewer2783283

Senior Software Engineer at a financial services firm with 10,001+ employees

It could suggest how the code base is written and automatically populate the source code with three different solution options to choose from.

Syed Hasan

Specialist Leader at Deloitte

If you can improve the speed optimization, it takes around 30 to 40 minutes for checking a build. If you can make it within five minutes or 10 minutes, that would be great.

Rohit Kaushish

Senior Software Engineer at a tech vendor with 10,001+ employees

For more quotes and insights, download the Checkmarx One report

If I'm scanning a web application, it shows me the various components being used. It tells me whether I have Java libraries, .NET frameworks, or other log management libraries such as Log4j, and what versions of those specific components are present.

For more quotes and insights, download the HCL AppScan report

Founder Director at Techsa Services

If it could be integrated directly with code repositories such as Bitbucket or GitHub, without the need to create a pipeline to upload and decode code, it would simplify the code scan process significantly.

Himadri Subudhi

Works

We had issues with scanning large applications. Scanning took a lot of time, so we kept it outside the DevOps pipeline to avoid delaying deployments.

Brintha Prabakar

Lead Automation Quality Engineer in Leading UK Bank at a consultancy with 10,001+ employees

A nice addition would be if it could be extended for scenarios with custom cleansers.

reviewer2700198

IT App Security Senior Analyst at a transportation company with 10,001+ employees

For more quotes and insights, download the Veracode report

Setup Cost

Checkmarx One is often costly but provides quality and security, with costs varying by team size and selected modules.

HCL AppScan is considered expensive but cost-effective, with varied pricing opinions influenced by its premium features and discounts.

Veracode's higher pricing offers comprehensive security for enterprises, posing challenges for smaller businesses, with negotiable licensing options.

For a small team under 50 developers, normal expenses come under 30 to 60K.

For more quotes and insights, download the Checkmarx One report

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Due to the number of years I've implemented Checkmarx One, there are rebates and discounts from the OEM which makes it a lot more profitable.

Gideon Anichi

Chief Technology Officer at 3CS Aquarah Limited

The pricing should be reasonable, matching what we are paying for.

Swetha Dhanasekar

Senior GenAI Engineer at a tech vendor with 10,001+ employees

Companies often choose based on budget constraints, with Veracode being on the higher end cost-wise.

MukeshSaha

Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech

For more quotes and insights, download the HCL AppScan report

It's not the most expensive solution.

AlejandroMosso

Senior Solutions Architect at IDS Comercial

Overall, Veracode's pricing is lower and more scalable than many alternatives in the market.

reviewer2753535

DevSecOps Engineer at a tech services company with 1,001-5,000 employees

If there's a security gap, you'll never know the cost or effect.

Himadri Subudhi

Works

For more quotes and insights, download the Veracode report

Valuable Features

Checkmarx One offers comprehensive vulnerability scanning, seamless CI/CD integration, and enhances productivity with ease of use and automation.

HCL AppScan detects vulnerabilities, integrates with agile processes, offers scalability, user-friendly features, and AI-enhanced rapid scanning for security.

Veracode offers comprehensive code analysis, seamless integration, and efficient vulnerability detection, improving security and development speed with minimal manual effort.

Since replacing the previous tool, SAST and SCA scans are conducted in a couple of minutes instead of hours or days.

Ricardo Sousa da Silva

Cyber Security Expert at Nestle

The best features Checkmarx One offers, over the past years, include broad language and technical support that Checkmarx provides, covering most languages.

RiteshWalia

ML Engineer - Specialist at a tech vendor with 10,001+ employees

Checkmarx One has positively impacted our organization as we tend to find vulnerabilities very early in the development cycle.

Adarkum Kumar

Product security engineer at a tech vendor with 10,001+ employees

For more quotes and insights, download the Checkmarx One report

AppScan's most valuable features include its ability to identify vulnerabilities accurately, provide detailed remediation steps, and the newly introduced AI-powered features that enhance its functionality further.

MukeshSaha

Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech

I have utilized its interactive application security testing, as well as both static application security testing, dynamic application security testing, and IAST.

For more quotes and insights, download the HCL AppScan report

Founder Director at Techsa Services

It offers confidence by preventing exposure to vulnerabilities and helps ensure that we are not deploying vulnerable code into production.

Kv Rao

Site Leader (India) at Industrial Scientific

The best features in Veracode include static analysis and the early detection of vulnerable libraries; it integrates with tools such as Jenkins.

Himadri Subudhi

Works

It fixes issues directly in the IDE while you're doing it.

reviewer2700198

IT App Security Senior Analyst at a transportation company with 10,001+ employees

For more quotes and insights, download the Veracode report

Mindshare comparison

As of April 2026, in the Application Security Tools category, the mindshare of Checkmarx One is 9.9%, down from 11.0% compared to the previous year. The mindshare of HCL AppScan is 2.1%, down from 2.6% compared to the previous year. The mindshare of Veracode is 4.6%, down from 10.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools Mindshare Distribution
Product	Mindshare (%)
Checkmarx One	9.9%
Veracode	4.6%
HCL AppScan	2.1%
Other	83.4%

Application Security Tools

Featured Reviews

Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Read full review

Has improved identification of encryption and authentication issues across cloud and on-prem applications

Founder Director at Techsa Services

During the learning curve of onboarding HCL AppScan, we learned that HCL has altered the portfolio and now offers HCL AppScan 360, which has a much better look and feel with an improved user interface. However, there is one feature called SCA, which stands for Software Composition Analysis, that could be improved. When I'm doing an application scan, HCL AppScan has the ability to generate information about what components are in use. For example, if I'm scanning a web application, it shows me the various components being used. It tells me whether I have Java libraries, .NET frameworks, or other log management libraries such as Log4j, and what versions of those specific components are present. I would like to see more detailed reports from the tool. Currently, you can find out the components belonging to a specific software, but if detailed reporting became available, you would be in a better position to identify vulnerabilities. For instance, I could identify that I had the Log4j vulnerability and know that I need to fix my application accordingly. If they add the features I'm describing, I would consider giving them a higher rating. However, I've only been experienced with the product for three months.

Read full review

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

Onboarding developers successfully while improving code security through IDE integration

Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.

Read full review

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

885,444 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

17%

Manufacturing Company

10%

Computer Software Company

Government

Computer Software Company

11%

Financial Services Firm

10%

Government

10%

Manufacturing Company

10%

Financial Services Firm

15%

Computer Software Company

12%

Manufacturing Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	32
Midsize Enterprise	9
Large Enterprise	46

By reviewers
Company Size	Count
Small Business	14
Midsize Enterprise	6
Large Enterprise	31

By reviewers
Company Size	Count
Small Business	69
Midsize Enterprise	45
Large Enterprise	114

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...

What is your experience regarding pricing and costs for Checkmarx?

Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additi...

What needs improvement with Checkmarx?

One way Checkmarx One could be improved is if it could automatically run scans every month after implementation. If i...

What do you like most about HCL AppScan?

The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase.

What needs improvement with HCL AppScan?

During the learning curve of onboarding HCL AppScan, we learned that HCL has altered the portfolio and now offers HCL...

What is your primary use case for HCL AppScan?

I'm currently working with BigFix and HCL AppScan. At least three people in my company are using HCL AppScan. Since w...

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...

What do you like most about Veracode Static Analysis?

I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabil...

What is your experience regarding pricing and costs for Veracode Static Analysis?

My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.

SonarQube vs Checkmarx One

Comparisons

Compared 43% of the time

Checkmarx SAST vs Checkmarx One

Compared 3% of the time

OpenText Core Application Security vs Checkmarx One

Compared 2% of the time

Fortify Software Security Center vs Checkmarx One

Compared 2% of the time

OpenText Dynamic Application Security Testing vs Checkmarx One

Compared 1% of the time

More Checkmarx One Competitors

SonarQube vs HCL AppScan

Compared 7% of the time

PortSwigger Burp Suite Professional vs HCL AppScan

Compared 7% of the time

Acunetix vs HCL AppScan

Compared 5% of the time

OpenText Core Application Security vs HCL AppScan

Compared 5% of the time

OWASP Zap vs HCL AppScan

Compared 5% of the time

More HCL AppScan Competitors

SonarQube vs Veracode

Compared 8% of the time

GitHub Advanced Security vs Veracode

Compared 3% of the time

Coverity Static vs Veracode

Compared 3% of the time

OWASP Zap vs Veracode

Compared 3% of the time

Mend.io vs Veracode

Compared 3% of the time

More Veracode Competitors

Product Reports

Download Checkmarx One product report

Checkmarx One

March 2026

Download HCL AppScan product report

HCL AppScan

March 2026

Download Veracode product report

March 2026

Also Known As

No data available

IBM Security AppScan, Rational AppScan, AppScan

Crashtest Security , Veracode Detect

Overview

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

IBM Security AppScan enhances web application security and mobile application security, improves application security program management and strengthens regulatory compliance. By scanning your web and mobile applications prior to deployment, AppScan enables you to identify security vulnerabilities and generate reports and fix recommendations.

HCLSoftware

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

Essex Technology Group Inc., Cisco, West Virginia University, APIS IT

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.