Try our new research platform with insights from 80,000+ expert users

Checkmarx SAST vs HCL AppScan comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Checkmarx SAST
Ranking in Static Application Security Testing (SAST)
22nd
Average Rating
9.6
Reviews Sentiment
6.9
Number of Reviews
3
Ranking in other categories
No ranking in other categories
HCL AppScan
Ranking in Static Application Security Testing (SAST)
14th
Average Rating
7.8
Reviews Sentiment
5.9
Number of Reviews
43
Ranking in other categories
Application Security Tools (15th), Dynamic Application Security Testing (DAST) (1st)
 

Mindshare comparison

As of October 2025, in the Static Application Security Testing (SAST) category, the mindshare of Checkmarx SAST is 1.4%, up from 0.1% compared to the previous year. The mindshare of HCL AppScan is 2.5%, down from 2.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Static Application Security Testing (SAST) Market Share Distribution
ProductMarket Share (%)
HCL AppScan2.5%
Checkmarx SAST1.4%
Other96.1%
Static Application Security Testing (SAST)
 

Featured Reviews

Cuneyt KALPAKOGLU Phd. - PeerSpot reviewer
Identifying code vulnerabilities swiftly with no need to complete the coding and offers good security
The primary use case of Checkmarx SAST is application security, specifically static application security testing. It is essential and the root of this concept I did not find measurable information about the financial benefits or return on investment. The most important competitive advantage and…
Gladwin Christian - PeerSpot reviewer
A useful tool to scan applications that can be easily installed
Given that we have been using HCL AppScan for many years, I think the setup process is not difficult at all. Sometimes, some issues stop or prevent my company from moving forward with the product's setup phase. We have to call HCL's support team and engage in long discussions to smoothly carry out the setup phase. In general, the product's setup phase is not difficult in our company. The solution is deployed on an on-premises model. The licenses for the solution are available only on cloud deployments nowadays. The solution is already installed in our environment. Every time a new release or software comes out from HCL, our company does a scan, which takes maybe a day or two.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most important competitive advantage and benefit is the ability to identify vulnerabilities in the source code immediately without needing to complete the coding."
"The CX1 is a unified platform that covers all components such as SAST, SCA, DAST, container scanning, and infrastructure code, which is quite beneficial because some clients need one-stop solutions for all their needs."
"The most important feature is that Checkmarx protects our company against attacks."
"The most important feature is that Checkmarx protects our company against attacks."
"The product is useful, particularly in its sensitivity and scanning capabilities."
"We leverage it as a quality check against code."
"This is a stable solution."
"For me, as a manager, it was the ease of use. Inserting security into the development process is not normally an easy project to do. The ability for the developer to actually use it and get results and focuses, that's what counted."
"AppScan's most valuable features include its ability to identify vulnerabilities accurately, provide detailed remediation steps, and the newly introduced AI-powered features that enhance its functionality further."
"It was easy to set up."
"IBM AppScan has made our work easy, as we can do four to five scans of websites at a time, which saves time when it comes to vulnerability."
"The most valuable feature of HCL AppScan is scanning QR codes."
 

Cons

"The main challenge with Checkmarx SAST is the price. The price is a challenge because Checkmarx SAST is a very big brand, and many mid-sized companies cannot afford it as they are very price-conscious."
"We had some issues where Checkmarx did not recognize a vulnerability. We had to talk with the vendor, and they had to include an improvement in the tool to resolve this issue."
"We had some issues where Checkmarx did not recognize a vulnerability."
"The on-premises version is more expensive compared to the cloud version."
"The solution needs to improve in some areas. The tool needs to add more languages. It also needs to improve its speed."
"IBM Security AppScan needs to add performance optimization for quickly scanning the target web applications."
"We would like to see a check in the specific vulnerabilities in mobile applications or rooted devices, such as jailbreaking devices."
"HCL AppScan needs to improve security."
"AppScan needs to improve its handling of false positives."
"AppScan needs to improve its handling of false positives."
"The dashboard, for AppScan or the Fortified fast tool, which we use needs to be improved."
"They have to improve support."
 

Pricing and Cost Advice

Information not available
"Our clients are willing to pay the extra money. It is expensive."
"The product is moderately priced, though it's an investment due to extensive code analysis needs."
"I would rate the product's pricing a nine out of ten. The product's pricing is expensive compared to the features that they offer."
"AppScan is a little bit expensive. IBM needs to work a little bit on the pricing model, decreasing the license cost."
"The price is very expensive."
"Pricing was the main reason that we went ahead with this solution as they were the lowest in the market."
"The product has premium pricing and could be more competitive."
"The price of HCL AppScan is okay, in my opinion. You just buy HCL AppScan and don't pay anything anymore, meaning it is just a one-time purchase."
report
Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
869,566 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
24%
Computer Software Company
13%
Manufacturing Company
10%
Insurance Company
6%
Computer Software Company
15%
Financial Services Firm
12%
Government
10%
Manufacturing Company
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business13
Midsize Enterprise6
Large Enterprise31
 

Questions from the Community

What is your experience regarding pricing and costs for Checkmarx SAST?
We were users in a small country, and we paid one consolidated bill for all the tools, so I don't know the specific amount for Checkmarx.
What needs improvement with Checkmarx SAST?
The main challenge with Checkmarx SAST is the price. The price is a challenge because Checkmarx SAST is a very big brand, and many mid-sized companies cannot afford it as they are very price-consci...
What is your primary use case for Checkmarx SAST?
I am currently working with Checkmarx SAST as technical partners. Our customers are from insurance and depository backgrounds. Checkmarx SAST is one of the branded solutions, and according to the M...
What do you like most about HCL AppScan?
The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase.
What needs improvement with HCL AppScan?
AppScan needs to improve its handling of false positives. It also requires enhancements in customer support, similar to what Veracode provides. Regularly scheduling calls with clients to discuss fe...
What is your primary use case for HCL AppScan?
The primary use case for AppScan is for security purposes. I compare AppScan with other tools such as Veracode. We use AppScan for vulnerability detection and auto-remediation of vulnerabilities wi...
 

Also Known As

SAST
IBM Security AppScan, Rational AppScan, AppScan
 

Overview

 

Sample Customers

Information Not Available
Essex Technology Group Inc., Cisco, West Virginia University, APIS IT
Find out what your peers are saying about Checkmarx SAST vs. HCL AppScan and other solutions. Updated: September 2025.
869,566 professionals have used our research since 2012.