

HCL AppScan and GitHub compete in the cybersecurity and software development domains. Based on the comparison, GitHub appears to have the upper hand due to its affordability and comprehensive feature set.
Features: HCL AppScan offers dynamic and static scanning functionalities to identify vulnerabilities like XSS and SQL injections, supports agile processes, and provides templates for regulatory compliance. GitHub excels in source code management, version control, and provides Git hooks along with top-notch security mechanisms, making it a favorite among open-source projects.
Room for Improvement: HCL AppScan could improve false positive detection, expand language support, and better integrate with CI/CD processes. It also needs more extensive mobile features and enhanced customer support. GitHub could benefit from better integration with other tools, improved search and security capabilities, and streamlined handling of large files and collaborative tasks.
Ease of Deployment and Customer Service: HCL AppScan offers on-premises deployment, suitable for organizations with specific security requirements, though technical support quality varies. GitHub is primarily cloud-based, offering flexibility across various cloud environments and generally responsive technical support, despite some licensing management challenges.
Pricing and ROI: HCL AppScan is perceived as expensive but a valuable long-term investment due to its comprehensive security features. GitHub is available as a free or paid solution with pricing based on user seats, deemed affordable for small businesses, leading to a favorable ROI in its market segment.
The technical support from GitHub is generally good, and they communicate effectively.
Some forums help you get answers faster since you just type in your concern and see resolutions from other engineers.
I have not used GitHub's technical support extensively because there are many resources and a robust knowledge base available due to the large user community.
Veracode provides excellent assistance and regularly scheduled calls to address customer concerns and updates.
There is still room for improvement when it comes to the speed of response.
We have never had a problem with scalability, so I would rate it at least eight to nine.
GitHub is more scalable than on-prem solutions, allowing for cloud-based scaling which is beneficial for processing large workloads efficiently.
If a skilled developer uses it, it is ten out of ten for stability.
It provides a reliable environment for code management.
GitHub is mostly stable, but there can be occasional hiccups.
Since we've been using HCL AppScan for about three months, we really have not encountered a false positive.
When working with the CI/CD pipeline and somebody is writing the workflow file, it would be best to include the AI feature so if they write incorrect code, it will notify me about it in the same dashboard, eliminating the need to use third-party tools to review the file.
I am providing this feedback for Copilot because it seems more widespread and more companies allow it rather than Amp, and it would be beneficial if they catch up with Amp on this capability.
Security could make GitHub better. OWASP Top Ten security advisors could be integrated on GitHub, and it could provide checks and advice.
If I'm scanning a web application, it shows me the various components being used. It tells me whether I have Java libraries, .NET frameworks, or other log management libraries such as Log4j, and what versions of those specific components are present.
Normally, GitHub is not expensive, but it would be welcome if it reduces costs for developing countries.
The pricing of GitHub is reasonable, with the cost being around seven dollars per user per month for private repositories.
The pricing of GitHub depends on the choice of solutions, such as building one's own GitHub Runners to save money or using GitHub's Runners with extra costs.
Companies often choose based on budget constraints, with Veracode being on the higher end cost-wise.
The pull request facility for code review.
GitHub Actions allow for creating multiple jobs that run in different stages such as build, test, and deploy, which enable better visibility and control over the deployment pipeline.
For branching, it works well, especially in an agile environment.
AppScan's most valuable features include its ability to identify vulnerabilities accurately, provide detailed remediation steps, and the newly introduced AI-powered features that enhance its functionality further.
I have utilized its interactive application security testing, as well as both static application security testing, dynamic application security testing, and IAST.
| Product | Market Share (%) |
|---|---|
| GitHub | 1.1% |
| HCL AppScan | 2.3% |
| Other | 96.6% |


| Company Size | Count |
|---|---|
| Small Business | 42 |
| Midsize Enterprise | 13 |
| Large Enterprise | 49 |
| Company Size | Count |
|---|---|
| Small Business | 14 |
| Midsize Enterprise | 6 |
| Large Enterprise | 31 |
GitHub is a web-based Git repository hosting service. It offers all of the distributed revision control and source code management (SCM) functionality of Git as well as adding its own features. Unlike Git, which is strictly a command-line tool, GitHub provides a Web-based graphical interface and desktop as well as mobile integration. It also provides access control and several collaboration features such as bug tracking, feature requests, task management, and wikis for every project.
IBM Security AppScan enhances web application security and mobile application security, improves application security program management and strengthens regulatory compliance. By scanning your web and mobile applications prior to deployment, AppScan enables you to identify security vulnerabilities and generate reports and fix recommendations.
We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.