HCL AppScan and Coverity Static are both competitive tools in the application security sector. HCL AppScan potentially holds an advantage in dynamic scanning and SDLC integration, while Coverity Static is notable for its low false positive rates and code complexity handling.
Features: HCL AppScan is strong in identifying XSS vulnerabilities, offers seamless SDLC integration, and provides robust dynamic and API scanning capabilities. It supports dynamic application security testing (DAST) and interactive application security testing (IAST), improving on-premises and cloud security posture. Coverity Static is highly regarded for its low false positive rate, deep scanning of complex code, and effective memory leak detection. Its security advisor and detailed reporting enhance root cause analysis, allowing for efficient bug identification in codebases.
Room for Improvement: HCL AppScan could benefit from reducing false positives and enhancing customer support. Users also suggest improved integration with CI/CD tools and faster technical support response times. Coverity Static may need to focus on a more user-friendly interface and better IDE integration. Its high cost and complex manual configuration process are significant drawbacks. Speed improvements and reduced false positives would further enhance its usability.
Ease of Deployment and Customer Service: HCL AppScan is available in on-premises and public cloud models, benefiting from fast technical transition support, though response times could be quicker. Coverity Static, being primarily on-premises or hybrid cloud-based, requires more technical resources for deployment. Both products receive commendations for responsive technical support, although Coverity's support structure is cited as less accessible compared to AppScan's.
Pricing and ROI: While users find HCL AppScan expensive, it provides a significant ROI by reducing vulnerabilities and long-term costs. Despite high pricing, it is considered more affordable than competitors like Veracode. In contrast, Coverity Static is very expensive, with a costly per-user license model, though its per-line-of-code pricing can help manage costs for large projects.
| Product | Market Share (%) |
|---|---|
| Coverity Static | 4.7% |
| HCL AppScan | 2.3% |
| Other | 93.0% |
| Company Size | Count |
|---|---|
| Small Business | 8 |
| Midsize Enterprise | 6 |
| Large Enterprise | 31 |
| Company Size | Count |
|---|---|
| Small Business | 14 |
| Midsize Enterprise | 6 |
| Large Enterprise | 31 |
Coverity gives you the speed, ease of use, accuracy, industry standards compliance, and scalability that you need to develop high-quality, secure applications. Coverity identifies critical software quality defects and security vulnerabilities in code as it’s written, early in the development process, when it’s least costly and easiest to fix. With the Code Sight integrated development environment (IDE) plugin, developers get accurate analysis in seconds in their IDE as they code. Precise actionable remediation advice and context-specific eLearning help your developers understand how to fix their prioritized issues quickly, without having to become security experts.
Coverity seamlessly integrates automated security testing into your CI/CD pipelines and supports your existing development tools and workflows. Choose where and how to do your development: on-premises or in the cloud with the Polaris Software Integrity Platform (SaaS), a highly scalable, cloud-based application security platform. Coverity supports more than 20 languages and 200 frameworks and templates.
IBM Security AppScan enhances web application security and mobile application security, improves application security program management and strengthens regulatory compliance. By scanning your web and mobile applications prior to deployment, AppScan enables you to identify security vulnerabilities and generate reports and fix recommendations.
We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
