Try our new research platform with insights from 80,000+ expert users

Fortify Application Defender vs HCL AppScan comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Fortify Application Defender
Ranking in Application Security Tools
28th
Average Rating
7.8
Reviews Sentiment
6.6
Number of Reviews
11
Ranking in other categories
No ranking in other categories
HCL AppScan
Ranking in Application Security Tools
15th
Average Rating
7.8
Reviews Sentiment
6.1
Number of Reviews
43
Ranking in other categories
Static Application Security Testing (SAST) (15th), Dynamic Application Security Testing (DAST) (1st)
 

Mindshare comparison

As of June 2025, in the Application Security Tools category, the mindshare of Fortify Application Defender is 0.7%, down from 0.8% compared to the previous year. The mindshare of HCL AppScan is 2.7%, up from 2.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools
 

Featured Reviews

Saroj-Patnaik - PeerSpot reviewer
Reliable solution with excellent machine learning algorithms but expensive and lacking support
I primarily use Fortify Application Defender to assess whether our products can defend against applications Fortify Application Defender's most valuable features are machine learning algorithms, real-time remediation, and automatic vulnerability notifications. Fortify Application Defender gives…
Sthembiso Zondi - PeerSpot reviewer
Has a straightforward setup process and valuable security features
We use AppScan primarily for security testing and performance monitoring across our systems The product's features for comprehensive code analysis (static) and live environment testing (dynamic) have significantly enhanced our ability to identify and address vulnerabilities, improving overall…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution helped us to improve the code quality of our organization."
"The product saves us cost and time."
"The most valuable feature is the ability to automatically feed it rules what it's coupled with the WebInspect dynamic application scanning technology."
"I find the configuration of rules in Fortify Application Defender useful. Its integration is also easy."
"The information from Fortify Application Defender on how to fix and solve issues is very good compared to other solutions."
"Its ability to find security defects is valuable."
"Fortify Application Defender's most valuable features are machine learning algorithms, real-time remediation, and automatic vulnerability notifications."
"The most valuable feature is that it analyzes data in real-time."
"It comes with all of the templates that we need. For example, we are a company that is regulated by PCI. In order to be PCI compliant, we have a lot of checks and procedures to which we have to comply."
"It's generally a very user-friendly tool. Anyone can easily learn how to scan"
"IBM AppScan has made our work easy, as we can do four to five scans of websites at a time, which saves time when it comes to vulnerability."
"The most valuable feature of the solution is Postman."
"AppScan's most valuable features include its ability to identify vulnerabilities accurately, provide detailed remediation steps, and the newly introduced AI-powered features that enhance its functionality further."
"The HCL AppScan turnaround time for Burp Suite or any new feature request is pretty good, and that is why we are sticking with the HCL."
"It is easy it is to use. It is quick to find things, because of the code scanning tools. It's quite simple to use and it is very good the way it reports the findings."
"It has certainly helped us find vulnerabilities in our software, so this is priceless in the end."
 

Cons

"Fortify Application Defender could improve by supporting more code languages, such as GRAAS and Groovy."
"The biggest complaint that I have heard concerns additional platform support because right now, it only supports applications that are written in .NET and Java."
"The product should integrate industry-standard code review tools internally with its system. This would streamline the coding process, as developers wouldn't need multiple tools for code review and security checks. Many independent and open-source tools are available, from Apache to various libraries. Using multiple DevOps pipeline tools can slow the turnaround time."
"The false positive rate should be lower."
"The workbench is a little bit complex when you first start using it."
"The solution is quite expensive."
"The licensing can be a little complex."
"Fortify Application Defender gives a lot of false positives."
"They could incorporate AI to enhance vulnerability detection and improve the product's reporting capabilities."
"Improvement can be done as per customer requirements."
"If HCL AppScan is able to alert the clients over email once the scan is complete, it would be great. Right now, HCL AppScan doesn't let me know if the scanning part is finished or not, because of which I have to come back and check mostly."
"They could add a software component analysis tool."
"It's a little bit basic when you talk about the Web Services. If AppScan improved its maturity on Web Services testing, that would be good."
"We have experienced challenges when trying to integrate this solution with other products. When you compare it with the other SecOps products, the quality of the output is too low. It is not a new-age product. It is very outdated."
"Many silly false positives are produced."
"There is not a central management for static and dynamic."
 

Pricing and Cost Advice

"The base licensing costs for the SaaS platform is about $900 USD per application, per year."
"The product’s price is much higher than other tools."
"Fortify Application Defender is very expensive."
"The licensing is very complex, it's project based and can range from $10,000 to $200,000+ depending on the project type and size."
"I rate the solution's pricing a five out of ten. It comes as an annual cloud subscription. The tool's pricing is around 50 lakhs."
"The price of this solution could be less expensive."
"Pricing was the main reason that we went ahead with this solution as they were the lowest in the market."
"The price is very expensive."
"The solution is moderately priced."
"The product has premium pricing and could be more competitive."
"Our clients are willing to pay the extra money. It is expensive."
"AppScan is a little bit expensive. IBM needs to work a little bit on the pricing model, decreasing the license cost."
"The product is moderately priced, though it's an investment due to extensive code analysis needs."
"I would rate the product's pricing a nine out of ten. The product's pricing is expensive compared to the features that they offer."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
857,162 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
20%
Manufacturing Company
14%
Computer Software Company
13%
Government
9%
Computer Software Company
18%
Financial Services Firm
14%
Government
12%
Manufacturing Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Fortify Application Defender?
I find the configuration of rules in Fortify Application Defender useful. Its integration is also easy.
What needs improvement with Fortify Application Defender?
The product should integrate industry-standard code review tools internally with its system. This would streamline the coding process, as developers wouldn't need multiple tools for code review and...
What is your primary use case for Fortify Application Defender?
We use the solution for fast code review. It is integrated into our DevOps pipeline.
What do you like most about HCL AppScan?
The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase.
What needs improvement with HCL AppScan?
AppScan needs to improve its handling of false positives. It also requires enhancements in customer support, similar to what Veracode provides. Regularly scheduling calls with clients to discuss fe...
What is your primary use case for HCL AppScan?
The primary use case for AppScan is for security purposes. I compare AppScan with other tools such as Veracode. We use AppScan for vulnerability detection and auto-remediation of vulnerabilities wi...
 

Also Known As

HPE Fortify Application Defender, Micro Focus Fortify Application Defender
IBM Security AppScan, Rational AppScan, AppScan
 

Overview

 

Sample Customers

ServiceMaster, Saltworks, SAP
Essex Technology Group Inc., Cisco, West Virginia University, APIS IT
Find out what your peers are saying about Fortify Application Defender vs. HCL AppScan and other solutions. Updated: June 2025.
857,162 professionals have used our research since 2012.