Try our new research platform with insights from 80,000+ expert users

HCL AppScan vs Veracode comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
1.7
HCL AppScan enhances architecture with fewer errors and improved security, achieving 50% return and 20% cost savings.
Sentiment score
6.6
Veracode enhances code security and quality, saves time and costs, supports compliance, and boosts client trust and retention.
The scanners of Veracode bring status of the weaknesses in the current infrastructure. It scans and provides reports regarding the servers, the network, and the applications running on those servers.
Senior Solutions Architect at IDS Comercial
Regarding price, the evaluation should focus on how efficiently they will recover their investment, considering the time saved through the use of Veracode Fix, for example, and the ability to fix code at dev time compared to the problems faced when fixing after the product is already deployed.
Head of Security Architecture at a healthcare company with 5,001-10,000 employees
We did see a return on investment with Veracode, as we segregated our remediation efforts, which reduced our time to delivery as well as the number of engineers needed to help us in delivering a secure solution.
DevSecOps Engineer at a tech services company with 11-50 employees
 

Customer Service

Sentiment score
5.6
HCL AppScan's support is responsive with mixed reviews, facing regional challenges and lagging behind competitors like Veracode.
Sentiment score
7.2
Veracode support is praised for expertise and responsiveness, but some users report delays and unhelpful interactions with complex issues.
Veracode provides excellent assistance and regularly scheduled calls to address customer concerns and updates.
Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech
There is still room for improvement when it comes to the speed of response.
Founder Director at Techsa Services
Access to the engineering team is crucial for faster feedback on the product fix process.
Principal Architect at a consultancy with 11-50 employees
I have communicated with the technical support of Veracode a couple of times, and this was a really great experience because these professionals know their material.
Application Security Specialist at Herrenknecht
They share detailed information via email, including screenshots or further clarification about the issue.
DevSecOps Engineer at a tech services company with 1,001-5,000 employees
 

Scalability Issues

Sentiment score
3.9
HCL AppScan is scalable yet varies by license, integration issues, infrastructure compatibility, and CI/CD pipeline design effectiveness.
Sentiment score
7.5
Veracode offers impressive scalability, efficiently handling growth and multiple applications, despite some licensing challenges, earning high user ratings.
Cloud solutions are easier to scale than on-premise solutions.
Senior Solutions Architect at IDS Comercial
It has a good capacity to scale effectively.
Lead Automation Quality Engineer in Leading UK Bank at a consultancy with 10,001+ employees
Implementing these features into our normal CI/CD was good, so I can say that scalability is really good.
Application Security Specialist at Herrenknecht
 

Stability Issues

Sentiment score
7.2
HCL AppScan is stable and reliable, with minor hardware issues, improved by recent upgrades enhancing performance and stability.
Sentiment score
7.8
Veracode is highly reliable with minimal downtime and issues, though occasional scan speed and false positive concerns exist.
Since we've been using HCL AppScan for about three months, we really have not encountered a false positive.
Founder Director at Techsa Services
If the Veracode server is down, we experience many issues during the scan.
Lead Automation Quality Engineer in Leading UK Bank at a consultancy with 10,001+ employees
It's not that easy to onboard, but once they have been onboarded on the platform, and the pipeline configured alongside the product configured, it works effectively.
Head of Security Architecture at a healthcare company with 5,001-10,000 employees
 

Room For Improvement

HCL AppScan requires improvements in vulnerability detection, usability, integration, performance, support, pricing, and language/codebase compatibility to stay competitive.
Veracode users face false positives, outdated UI, integration issues, slow scans, and desire flexible pricing and improved support.
If I'm scanning a web application, it shows me the various components being used. It tells me whether I have Java libraries, .NET frameworks, or other log management libraries such as Log4j, and what versions of those specific components are present.
Founder Director at Techsa Services
If it could be integrated directly with code repositories such as Bitbucket or GitHub, without the need to create a pipeline to upload and decode code, it would simplify the code scan process significantly.
We had issues with scanning large applications. Scanning took a lot of time, so we kept it outside the DevOps pipeline to avoid delaying deployments.
Lead Automation Quality Engineer in Leading UK Bank at a consultancy with 10,001+ employees
A nice addition would be if it could be extended for scenarios with custom cleansers.
IT App Security Senior Analyst at a transportation company with 10,001+ employees
 

Setup Cost

HCL AppScan is considered expensive but cost-effective, with varied pricing opinions influenced by its premium features and discounts.
Veracode's pricing is costly, but its features suit large enterprises; smaller businesses should consider alternatives due to budget constraints.
Companies often choose based on budget constraints, with Veracode being on the higher end cost-wise.
Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech
It's not the most expensive solution.
Senior Solutions Architect at IDS Comercial
Overall, Veracode's pricing is lower and more scalable than many alternatives in the market.
DevSecOps Engineer at a tech services company with 1,001-5,000 employees
If there's a security gap, you'll never know the cost or effect.
 

Valuable Features

HCL AppScan detects vulnerabilities, integrates with agile processes, offers scalability, user-friendly features, and AI-enhanced rapid scanning for security.
Veracode provides comprehensive code analysis, vulnerability management, and integration tools, enhancing security and supporting complex project needs efficiently.
AppScan's most valuable features include its ability to identify vulnerabilities accurately, provide detailed remediation steps, and the newly introduced AI-powered features that enhance its functionality further.
Associate Principal, Software Engineering at LTI - Larsen & Toubro Infotech
I have utilized its interactive application security testing, as well as both static application security testing, dynamic application security testing, and IAST.
Founder Director at Techsa Services
It offers confidence by preventing exposure to vulnerabilities and helps ensure that we are not deploying vulnerable code into production.
Site Leader (India) at Industrial Scientific
The best features in Veracode include static analysis and the early detection of vulnerable libraries; it integrates with tools such as Jenkins.
It fixes issues directly in the IDE while you're doing it.
IT App Security Senior Analyst at a transportation company with 10,001+ employees
 

Categories and Ranking

HCL AppScan
Ranking in Application Security Tools
20th
Ranking in Static Application Security Testing (SAST)
17th
Ranking in Dynamic Application Security Testing (DAST)
4th
Average Rating
7.6
Reviews Sentiment
5.9
Number of Reviews
44
Ranking in other categories
No ranking in other categories
Veracode
Ranking in Application Security Tools
2nd
Ranking in Static Application Security Testing (SAST)
2nd
Ranking in Dynamic Application Security Testing (DAST)
1st
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
207
Ranking in other categories
Container Security (8th), Software Composition Analysis (SCA) (3rd), Static Code Analysis (1st), Application Security Posture Management (ASPM) (1st)
 

Mindshare comparison

As of January 2026, in the Application Security Tools category, the mindshare of HCL AppScan is 2.3%, down from 2.6% compared to the previous year. The mindshare of Veracode is 5.4%, down from 10.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools Market Share Distribution
ProductMarket Share (%)
Veracode5.4%
HCL AppScan2.3%
Other92.3%
Application Security Tools
 

Featured Reviews

Ravi Khanchandani - PeerSpot reviewer
Founder Director at Techsa Services
Has improved identification of encryption and authentication issues across cloud and on-prem applications
During the learning curve of onboarding HCL AppScan, we learned that HCL has altered the portfolio and now offers HCL AppScan 360, which has a much better look and feel with an improved user interface. However, there is one feature called SCA, which stands for Software Composition Analysis, that could be improved. When I'm doing an application scan, HCL AppScan has the ability to generate information about what components are in use. For example, if I'm scanning a web application, it shows me the various components being used. It tells me whether I have Java libraries, .NET frameworks, or other log management libraries such as Log4j, and what versions of those specific components are present. I would like to see more detailed reports from the tool. Currently, you can find out the components belonging to a specific software, but if detailed reporting became available, you would be in a better position to identify vulnerabilities. For instance, I could identify that I had the Log4j vulnerability and know that I need to fix my application accordingly. If they add the features I'm describing, I would consider giving them a higher rating. However, I've only been experienced with the product for three months.
reviewer2703864 - PeerSpot reviewer
Head of Security Architecture at a healthcare company with 5,001-10,000 employees
Onboarding developers successfully while improving code security through IDE integration
Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
879,455 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
13%
Financial Services Firm
11%
Government
10%
Manufacturing Company
10%
Financial Services Firm
17%
Computer Software Company
14%
Manufacturing Company
10%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise6
Large Enterprise31
By reviewers
Company SizeCount
Small Business70
Midsize Enterprise44
Large Enterprise113
 

Questions from the Community

What do you like most about HCL AppScan?
The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase.
What needs improvement with HCL AppScan?
During the learning curve of onboarding HCL AppScan, we learned that HCL has altered the portfolio and now offers HCL AppScan 360, which has a much better look and feel with an improved user interf...
What is your primary use case for HCL AppScan?
I'm currently working with BigFix and HCL AppScan. At least three people in my company are using HCL AppScan. Since we are a reseller, we run it in both lab environments and live production applica...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
What do you like most about Veracode Static Analysis?
I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabilities.
What is your experience regarding pricing and costs for Veracode Static Analysis?
My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.
 

Comparisons

 

Also Known As

IBM Security AppScan, Rational AppScan, AppScan
Crashtest Security , Veracode Detect
 

Overview

 

Sample Customers

Essex Technology Group Inc., Cisco, West Virginia University, APIS IT
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Find out what your peers are saying about HCL AppScan vs. Veracode and other solutions. Updated: December 2025.
879,455 professionals have used our research since 2012.