HCL AppScan vs OpenText Core Application Security comparison

HCLSoftware and OpenText are both solutions in the Application Security Tools category. HCLSoftware is ranked #15 with an average rating of 8.3, while OpenText is ranked #14 with an average rating of 8.0. HCLSoftware holds a 2.5% mindshare in AS, compared to OpenText’s 4.0% mindshare. Additionally, 84% of HCLSoftware users are willing to recommend the solution, compared to 89% of OpenText users who would recommend it.

HCL AppScan

Read 43 HCL AppScan reviews

4,583 Views
3,300 Comparison Views

84% willing to recommend

OpenText Core Application S...

Read 60 OpenText Core Application Security reviews

7,407 Views
5,481 Comparison Views

89% willing to recommend

HCL AppScan

OpenText Core Application S...

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 21, 2025

HCL AppScan and OpenText Core Application Security compete in the application security category. HCL AppScan seems to have an edge due to its advanced vulnerability detection and seamless integration with agile development methodologies.

Features: HCL AppScan offers advanced vulnerability detection, API integration, and low false-positive rates. It supports multiple languages and integrates seamlessly into agile development methodologies. OpenText Core Application Security focuses on comprehensive security threat detection, supporting dynamic and static analysis and easy integration with DevOps processes while providing a straightforward interface.

Room for Improvement: HCL AppScan users suggest improvements in usability, integration with certain CI/CD pipelines, and false-positive handling. It also needs better customer support and a more streamlined interface. OpenText could reduce false positives, improve integration with various platforms, and enhance support and container scanning speed.

Ease of Deployment and Customer Service: HCL AppScan provides versatile deployment options, including on-premises and public cloud. Its technical support has mixed reviews, with some challenges post-IBM transition. OpenText supports public and hybrid cloud environments, receiving praise for responsive customer service, though some regions report insufficient support resources.

Pricing and ROI: HCL AppScan is considered expensive but worthwhile for its features, leading to significant ROI in vulnerability reduction. OpenText offers flexible pricing with scalable licensing options, considered more affordable yet occasionally criticized for high costs in specific scenarios. Both solutions effectively integrate with existing infrastructures to enhance application security.

To learn more, read our detailed HCL AppScan vs. OpenText Core Application Security Report (Updated: September 2025).

Buyer's Guide

HCL AppScan vs. OpenText Core Application Security

September 2025

Download the complete report

Helped 867,826 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

HCL AppScan

Ranking in Application Security Tools

15th

Ranking in Static Application Security Testing (SAST)

15th

Average Rating

7.8

Reviews Sentiment

5.9

Number of Reviews

Ranking in other categories

Dynamic Application Security Testing (DAST) (1st)

OpenText Core Application S...

Ranking in Application Security Tools

14th

Ranking in Static Application Security Testing (SAST)

13th

Average Rating

8.0

Reviews Sentiment

7.8

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of September 2025, in the Application Security Tools category, the mindshare of HCL AppScan is 2.5%, down from 2.6% compared to the previous year. The mindshare of OpenText Core Application Security is 4.0%, down from 5.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools Market Share Distribution
Product	Market Share (%)
OpenText Core Application Security	4.0%
HCL AppScan	2.5%
Other	93.5%

Application Security Tools

Featured Reviews

Gladwin Christian

QA manager at SmartStream Technologies ltd.

A useful tool to scan applications that can be easily installed

Given that we have been using HCL AppScan for many years, I think the setup process is not difficult at all. Sometimes, some issues stop or prevent my company from moving forward with the product's setup phase. We have to call HCL's support team and engage in long discussions to smoothly carry out the setup phase. In general, the product's setup phase is not difficult in our company. The solution is deployed on an on-premises model. The licenses for the solution are available only on cloud deployments nowadays. The solution is already installed in our environment. Every time a new release or software comes out from HCL, our company does a scan, which takes maybe a day or two.

Read full review

Jonathan Steyn

Principal Technical Consultant at EOH

Source code analyzer, FPR file generation, reduction of false positives and generates compliance reports, for in-depth analysis

Not challenges with the product itself. The product is very reliable. It does have a steep learning curve. But, again, one thing that Fortify or OpenText does very well is training. There are a lot of free resources and training in the community forums, free training as well as commercial training where users can train on how to use the back-end systems and the scanning engines and how to use command-line arguments because some of the procedures or some of the tools do require a bit of a learning curve. That's the only challenge I've really seen for customers because you have to learn how to use the tool effectively. But Fortify has, in fact, improved its user interface and the way users engage the dashboards and the interfaces. It is intuitive. It's easy to understand. But in some regards, the cybersecurity specialist or AppSec would need a bit of training to engage the user interface and to understand how it functions. But from the point of the reliability index and how powerful the tool is, there's no challenge there. But it's just from a learning perspective; users might need a bit more skill to use the tool. The user interface isn't that tedious. It's not that difficult to understand. When I initially learned how to use the interfaces, I was able to master it within a week and was able to use it quite effectively. So training is required. All skills are needed to learn how to use the tool. I would like to see more enhancements in the dashboards. Dashboards are available. They do need some configuration and settings. But I would like to see more business intelligence capabilities within the tool. It's not particularly a cybersecurity function, but, for instance, business impact analysis or other features where you can actually use business intelligence capabilities within your security tool. That would be remarkable because not only do you have a cybersecurity tool, but you also have a tool that can give you business impact analysis and some other measurements. A bit more intelligence in terms of that from a cybersecurity perspective would be remarkable.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"AppScan's most valuable features include its ability to identify vulnerabilities accurately, provide detailed remediation steps, and the newly introduced AI-powered features that enhance its functionality further."

"The platform has valuable security features, helping us identify sensitive code issues and the possibility of internal applications' exposure to external threats."

"The most valuable feature of HCL AppScan is scanning QR codes."

"IBM AppScan has made our work easy, as we can do four to five scans of websites at a time, which saves time when it comes to vulnerability."

"It is easy it is to use. It is quick to find things, because of the code scanning tools. It's quite simple to use and it is very good the way it reports the findings."

"It provides a better integration for our ecosystem."

"The product has valuable features for static and dynamic testing."

"You can easily find particular features and functions through the UI."

More HCL AppScan pros

"Fortify supports most languages. Other tools are limited to Java and other typical languages. IBM's solutions aren't flexible enough to support any language. Fortify also integrates with lots of tools because it has API support."

"The solution saves us a lot of money. We're trying to reduce exposure and costs related to remediation."

"The SAST feature is the most valuable."

"The solution is user-friendly."

"Provides good depth of scanning and we get good results."

"The solution is user-friendly. One feature I find very effective is the tool's automatic scanning capability. It scans replicas of the code developers write and automatically detects any vulnerabilities. The integration with CI/CD tools is also useful for plugins."

"Once we have our project created with our application pipeline connected to the test scanning, it only takes two minutes. The report explaining what needs to be modified related to security and vulnerabilities in our code is very helpful. We are able to do static and dynamic code scanning."

"The solution scans our code and provides us with a dashboard of all the vulnerabilities and the criticality of the vulnerabilities. It is very useful that they provide right then and there all the information about the vulnerability, including possible fixes, as well as some additional documentation and links to the authoritative sources of why this is an issue and what's the correct way to deal with it."

More OpenText Core Application Security pros

Cons

"I think being able to search across more containers, especially some of the docker elements. We need a little tighter integration there. That's the only thing I can see at this point."

"We would like to see a check in the specific vulnerabilities in mobile applications or rooted devices, such as jailbreaking devices."

"Improving usability could enhance the overall experience with AppScan. It would be beneficial to make the solution more user-friendly, ensuring that everyone can easily navigate and utilize its features."

"One thing which I think can be improved is the CI/CD Integration"

"In future releases, I would like to see more aggressive reports. I would also like to see less false positives."

"AppScan needs to improve its handling of false positives."

"There is not a central management for static and dynamic."

"We have experienced challenges when trying to integrate this solution with other products. When you compare it with the other SecOps products, the quality of the output is too low. It is not a new-age product. It is very outdated."

More HCL AppScan cons

"With Rapid7 I utilized its reporting capabilities to deliver Client Reports within just a few minutes of checking the data. I believe that HP’s FoD Clients could sell more services to clients if HP put more effort into delivering visually pleasing reporting capabilities."

"The solution has some issues with latency. Sometimes it takes a while to respond. This issue should be addressed."

"The UI could be better. Fortify should also suggest new packages in the product that can be upgraded. Currently, it shows that, but it's not visible enough. In future versions, I would like more insights about the types of vulnerabilities and the pages associated with the exact CVE."

"We typically do our bulk uploads of our scans with some automation at the end of the development cycle but the scanning can take a lot of time. If you were doing all of it at regular intervals it would still consume a lot of time. This could procedure could improve."

"New technologies and DevOps could be improved. Fortify on Demand can be slow (slower than other vendors) to support new technologies or new software versions."

"We would like a reduction in the time frame of scans. It takes us three to five days to run a scan now. We would like that reduced to under three days."

"They could provide features for artificial intelligence similar to other vendors."

"The biggest deficiency is the integration with bug tracker systems. It might be better if the configuration screen presented for accessing the bug tracking systems could provide some flexibility."

More OpenText Core Application Security cons

Pricing and Cost Advice

"AppScan is a little bit expensive. IBM needs to work a little bit on the pricing model, decreasing the license cost."

"With the features, that they offer, and the support, they offer, AppScan pricing is on a higher level."

"I rate the product's price a seven on a scale of one to ten, where one is low, and ten is high. HCL AppScan is an expensive tool."

"The price of HCL AppScan is okay, in my opinion. You just buy HCL AppScan and don't pay anything anymore, meaning it is just a one-time purchase."

"The tool was expensive."

"The product has premium pricing and could be more competitive."

"Pricing was the main reason that we went ahead with this solution as they were the lowest in the market."

"I would rate the product's pricing a nine out of ten. The product's pricing is expensive compared to the features that they offer."

More HCL AppScan pricing and cost advice

"The product's cost depends on the type of license."

"We are still using the trial version at this point but I can already see from the trial version alone that it is a good product. For others, I would say that Fortify on Demand might look expensive at the beginning, but it is very powerful and so you shouldn't be put off by the price."

"I'd rate it an eight out of ten in terms of pricing."

"The pricing can be improved because it is complex when compared to the competition."

"It's a yearly contract, but I don't remember the dollar amount."

"Fortify on Demand is affordable, and its licensing comes with a year of support."

"We used the one-time application, Security Scan Dynamic. I believe the original fee was $8,000."

"The price is fair compared to that of other solutions."

More OpenText Core Application Security pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

867,826 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

16%

Financial Services Firm

12%

Government

11%

Manufacturing Company

10%

Financial Services Firm

19%

Manufacturing Company

14%

Computer Software Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	13
Midsize Enterprise	6
Large Enterprise	31

By reviewers
Company Size	Count
Small Business	16
Midsize Enterprise	8
Large Enterprise	43

Questions from the Community

What do you like most about HCL AppScan?

The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase.

See all answers

What needs improvement with HCL AppScan?

AppScan needs to improve its handling of false positives. It also requires enhancements in customer support, similar to what Veracode provides. Regularly scheduling calls with clients to discuss fe...

See all answers

What is your primary use case for HCL AppScan?

The primary use case for AppScan is for security purposes. I compare AppScan with other tools such as Veracode. We use AppScan for vulnerability detection and auto-remediation of vulnerabilities wi...

See all answers

What do you like most about Micro Focus Fortify on Demand?

It helps deploy and track changes easily as per time-to-time market upgrades.

See all answers

What is your experience regarding pricing and costs for Micro Focus Fortify on Demand?

In comparison with other tools, they're competitive. It is not more expensive than other solutions, but their pricing is competitive. The licenses for Fortify On Demand are generally bought in unit...

See all answers

What needs improvement with Micro Focus Fortify on Demand?

There are frequent complaints about false positives from Fortify. One day it may pass a scan with no issues, and the next day, without any code changes, it will report vulnerabilities such as passw...

See all answers

Comparisons

Acunetix vs HCL AppScan

Compared 12% of the time

SonarQube Server (formerly SonarQube) vs HCL AppScan

Compared 12% of the time

Veracode vs HCL AppScan

Compared 11% of the time

OWASP Zap vs HCL AppScan

Compared 8% of the time

Qualys Web Application Scanning vs HCL AppScan

Compared 5% of the time

More HCL AppScan Competitors

SonarQube Server (formerly SonarQube) vs OpenText Core Application Security

Compared 16% of the time

Checkmarx One vs OpenText Core Application Security

Compared 13% of the time

Coverity Static vs OpenText Core Application Security

Compared 10% of the time

Veracode vs OpenText Core Application Security

Compared 9% of the time

OpenText Dynamic Application Security Testing vs OpenText Core Application Security

Compared 3% of the time

More OpenText Core Application Security Competitors

Product Reports

Buyer's Guide

HCL AppScan

September 2025

Download HCL AppScan product report

Buyer's Guide

OpenText Core Application Security

September 2025

OpenText Core Application Security report

Download OpenText Core Application Security product report

Also Known As

IBM Security AppScan, Rational AppScan, AppScan

Micro Focus Fortify on Demand

Overview

IBM Security AppScan enhances web application security and mobile application security, improves application security program management and strengthens regulatory compliance. By scanning your web and mobile applications prior to deployment, AppScan enables you to identify security vulnerabilities and generate reports and fix recommendations.

HCLSoftware

OpenText Core Application Security offers robust features like static and dynamic scanning, real-time vulnerability tracking, and seamless integration with development platforms, designed to enhance code security and reduce operational costs.

OpenText Core Application Security is a cloud-based, on-demand service providing accurate and deep scanning capabilities with detailed reporting. Its integrations with development platforms ensure an enhanced security layer in the development lifecycle, benefiting users by lowering operational costs and facilitating efficient remediation. The platform addresses needs for intuitive interfaces, API support, and comprehensive vulnerability assessments, helping improve code security and accelerate time-to-market. Despite its strengths, challenges exist around false positives, report clarity, and language support, alongside confusing pricing and package options. Enhancements are sought in areas like CI/CD pipeline configuration, report visualization, scan times, and integration with third-party tools such as GitLab, container scanning, and software composition analysis.

What features define OpenText Core Application Security?

Static and Dynamic Scanning: Offers thorough analysis to identify vulnerabilities during development.
Real-time Vulnerability Tracking: Continuously updates and monitors potential security threats.
Seamless Development Platform Integration: Enhances security processes without disrupting workflows.
Cloud-Based Service: Provides flexible, on-demand security capabilities with accurate results.
API Support: Allows smooth integration and automation within existing systems.

What benefits should users look for in reviews?

Reduced Operational Costs: Optimizes resources by lowering costs associated with security management.
Efficient Remediation: Speeds up the process of identifying and resolving vulnerabilities.
Enhanced Code Security: Strengthens overall application security during the development lifecycle.
Accelerated Time-to-Market: Streamlines development stages by integrating essential security tools.

Industries like mobile applications, e-commerce, and banking leverage OpenText Core Application Security for its ability to identify vulnerabilities such as SQL injections. Integrating seamlessly with DevSecOps and security auditing processes, this tool supports developers in writing safer code, ensuring secure application deployment and enhancing software assurance.

OpenText

Sample Customers

Essex Technology Group Inc., Cisco, West Virginia University, APIS IT

SAP, Aaron's, British Gas, FICO, Cox Automative, Callcredit Information Group, Vital and more.

Buyer's Guide

HCL AppScan vs. OpenText Core Application Security

September 2025

Free Report: HCL AppScan vs. OpenText Core Application Security

Find out what your peers are saying about HCL AppScan vs. OpenText Core Application Security and other solutions. Updated: September 2025.

DOWNLOAD NOW

867,826 professionals have used our research since 2012.

See our HCL AppScan vs. OpenText Core Application Security report.

See our list of best Application Security Tools vendors and best Static Application Security Testing (SAST) vendors.

We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.