Try our new research platform with insights from 80,000+ expert users

HCL AppScan vs OpenText Dynamic Application Security Testing comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 21, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

HCL AppScan
Ranking in Dynamic Application Security Testing (DAST)
1st
Average Rating
7.8
Reviews Sentiment
5.9
Number of Reviews
43
Ranking in other categories
Application Security Tools (15th), Static Application Security Testing (SAST) (14th)
OpenText Dynamic Applicatio...
Ranking in Dynamic Application Security Testing (DAST)
3rd
Average Rating
7.2
Reviews Sentiment
6.1
Number of Reviews
22
Ranking in other categories
DevSecOps (9th)
 

Mindshare comparison

As of October 2025, in the Dynamic Application Security Testing (DAST) category, the mindshare of HCL AppScan is 14.0%, down from 22.6% compared to the previous year. The mindshare of OpenText Dynamic Application Security Testing is 17.7%, down from 21.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Dynamic Application Security Testing (DAST) Market Share Distribution
ProductMarket Share (%)
HCL AppScan14.0%
OpenText Dynamic Application Security Testing17.7%
Other68.3%
Dynamic Application Security Testing (DAST)
 

Featured Reviews

AnshulTomar - PeerSpot reviewer
Scalable platform with efficient static and dynamic testing features
We use the product for Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST). By integrating AppScan into our CI/CD pipelines, aligned with Agile methodologies, we ensure that security testing becomes an integral part of the software development lifecycle The…
Navin N - PeerSpot reviewer
Effective scanning of diverse file extensions with fast reporting and issue resolution
We develop software packages for clients, and these clients are mostly in the BFSI sector. The packages need to be scanned, and we engage Fortify WebInspect for this.  Customers typically perform their own application pen tests, but in some cases, we have engagements where customers want us to scan…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution is cheap."
"The solution is easy to install. I would rate the product's setup between six to seven out of ten. The deployment time depends on the applications that need to be scanned. We have a development and operations team to take care of the product's maintenance."
"It provides a better integration for our ecosystem."
"The static scans are good, and the SaaS as well."
"The platform has valuable security features, helping us identify sensitive code issues and the possibility of internal applications' exposure to external threats."
"This solution saves us time due to the low number of false positives detected."
"It has certainly helped us find vulnerabilities in our software, so this is priceless in the end."
"The UI was very intuitive."
"The transaction recorder within WebInspect is easy to use, which is valuable for our team."
"Reporting, centralized dashboard, and bird's eye view of all vulnerabilities are the most valuable features."
"Fortify WebInspect is a scalable solution, it is good for a lot of applications."
"I'm sorry, but there is no review content provided to extract a quote from."
"The solution's technical support was very helpful."
"The feature that has been most influential in identifying vulnerabilities is its ability to crawl the website, understand the structure, and analyze the network packets sent and received."
"Good at scanning and finding vulnerabilities."
"Technical support has been good."
 

Cons

"It has crashed at times."
"Visibility is an issue for us. Our partners do not know we have integrations with some of IBM products."
"They could add a software component analysis tool."
"The tool should improve its output. Scanning is not a challenge anymore since there are many such tools available in the market. The product needs to focus on how its output is being used by end users. It should be also more user-friendly. One of the major challenges is in the tool's integration with applications that need to be scanned. Sometimes, the scanning is not proper."
"There are so many lines of code with so many different categories that I am likely to get lost. ​"
"The solution often has a high number of false positives. It's an aspect they really need to improve upon."
"Sometimes it doesn't work so well."
"I would like to see the roadmap for this product. We are still waiting to see it as we have only so many resources."
"Fortify WebInspect's shortcoming stems from the fact that it is a very expensive product in Korea, which makes it difficult for its potential customers to introduce the product in their IT environment."
"Lately, we've seen more false negatives."
"The installation could be a bit easier. Usually it's simple to use, but the installation is painful and a bit laborious and complex."
"Not sufficiently compatible with some of our systems."
"The initial setup was complex."
"I'm not sure licensing, but on the pricing, it's a bit costly. It's a bit overpriced. Though it is an enterprise tool, there are other tools also with similar functionalities."
"The scanner could be better."
"It requires improvement in terms of scanning. The application scan heavily utilizes the resources of an on-premise server. 32 GB RAM is very high for an enterprise web application."
 

Pricing and Cost Advice

"The product is moderately priced, though it's an investment due to extensive code analysis needs."
"The solution is moderately priced."
"The price is very expensive."
"HCL AppScan is expensive."
"The solution is cheap."
"The tool was expensive."
"Pricing was the main reason that we went ahead with this solution as they were the lowest in the market."
"AppScan is a little bit expensive. IBM needs to work a little bit on the pricing model, decreasing the license cost."
"Fortify WebInspect is a very expensive product."
"The price is okay."
"The pricing is not clear and while it is not high, it is difficult to understand."
"It’s a fair price for the solution."
"Our licensing is such that you can only run one scan at a time, which is inconvenient."
"This solution is very expensive."
"Its price is almost similar to the price of AppScan. Both of them are very costly. Its price could be reduced because it can be very costly for unlimited IT scans, etc. I'm not sure, but it can go up to $40,000 to $50,000 or more than that."
report
Use our free recommendation engine to learn which Dynamic Application Security Testing (DAST) solutions are best for your needs.
871,358 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
15%
Financial Services Firm
12%
Government
10%
Manufacturing Company
9%
Financial Services Firm
16%
Government
15%
Manufacturing Company
12%
Computer Software Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business13
Midsize Enterprise6
Large Enterprise31
By reviewers
Company SizeCount
Small Business7
Midsize Enterprise1
Large Enterprise15
 

Questions from the Community

What do you like most about HCL AppScan?
The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase.
What needs improvement with HCL AppScan?
AppScan needs to improve its handling of false positives. It also requires enhancements in customer support, similar to what Veracode provides. Regularly scheduling calls with clients to discuss fe...
What is your primary use case for HCL AppScan?
The primary use case for AppScan is for security purposes. I compare AppScan with other tools such as Veracode. We use AppScan for vulnerability detection and auto-remediation of vulnerabilities wi...
What is your experience regarding pricing and costs for Fortify WebInspect?
While I am not directly involved with licensing, I can share that our project's license for 1-9 applications costs between $15,000 to $19,000. In comparison, Burp Suite costs approximately $500 to ...
What needs improvement with Fortify WebInspect?
WebInspect works efficiently with Java-based or .NET based applications. However, it struggles with Salesforce applications, where it requires approximately 20-24 hours to crawl and audit but produ...
What is your primary use case for Fortify WebInspect?
I am currently working with several tools. For Fortify, I use SCA and WebInspect. Apart from that, I use Burp Suite from PortSwigger. For API testing, I use Postman with Burp Suite or WebInspect fo...
 

Also Known As

IBM Security AppScan, Rational AppScan, AppScan
Micro Focus WebInspect, WebInspect
 

Overview

 

Sample Customers

Essex Technology Group Inc., Cisco, West Virginia University, APIS IT
Aaron's
Find out what your peers are saying about HCL AppScan vs. OpenText Dynamic Application Security Testing and other solutions. Updated: September 2025.
871,358 professionals have used our research since 2012.