HCL AppScan Reviews

The most valuable feature of HCL AppScan is scanning QR codes.

The solution could improve by having a mobile version.

I have been using HCL AppScan for approximately one year.

I have found HCL AppScan to be stable.

HCL AppScan is a scalable solution. it can easily scale up and out.

The support I have received has been good. I had an issue and I opened a ticket with the support, and everything went smooth. 

The initial setup of HCL AppScan is easy.

I rate HCL AppScan an eight out of ten.

We use the solution to test our web applications and services.

The security and the dashboard are the most valuable features.

The pricing has room for improvement.

I have been using the solution for eight years.

I give the stability a seven out of ten.

I give the scalability an eight out of ten.

The support is fine.

Neutral

I give the initial setup a seven out of ten. The implementation took a few weeks.

The implementation was completed in-house.

We have seen around a 50 percent return on investment.

HCL AppScan is expensive.

I give the solution an eight out of ten.

I recommend the solution to others.

We have around 4,000 end users.

I have a set project, and I'm writing an application for monitoring server status, and I tried several times to scan it with AppScan in order to understand if there are vulnerabilities in my code.

The dynamic scan, the DAST tool, dynamic applications scanning and testing tool, is great.

It was easy to set up.

It's a stable solution.

The product is easy to scale. 

The solution is affordable and reasonably priced.

The performance could be better. Sometimes it doesn't work so well. There's a tool for connecting the cloud with the application server. Sometimes it doesn't work really well.

I have not come across any missing features. 

I've been using the solution for six months. It's been less than a year so far. 

The solution has been stable. There aren't bugs or glitches. It doesn't crash or freeze. It's reliable. 

So far, we've found the solution can scale well.

I've reached out to support in the past. They are pretty good, however, they are also working from India, and I'm in Italy. There is a delay of course when I open a ticket. We have to wait a bit due to the time shift.

We did not previously use a different solution. This was our first. 

The initial setup is pretty simple and straightforward. It's not an overly complex or difficult process. 

It took about one day to deploy the solution.

I handled the initial setup on my own. I did not ask for help from any consultants or integrators. 

I actually pay for tokens. Any time that I want to perform scanning, I have to pay for another token. It's pretty good for me, this system, as it's really, really nice when I need it. I just need to pay for it, and that's it.

We are end-users.

I'd rate the solution a seven out of ten.

We primarily use the solution for static analysis.

AppScan is within the top three or four static analyzers. Its features include support for many languages. 

The product has a relatively reasonable scan time.

There's extensive functionality with custom rules and a custom knowledge base.

The solution often has a high number of false positives. It's an aspect they really need to improve upon. 

The product has vulnerabilities, or findings, that are almost identical in nature. 

I've used the solution for the last 12 months or so. It's been about a year at this point.

The stability is okay. it's good. It's not very good or excellent, it's just good. I would describe the stability as a bit better than acceptable.

When I worked on it, it wasn't in the cloud. It didn't offer Federation. Now, it is my understanding that it has those, which would make it very scalable. That said, when I used it, I would not give it a very scalable grade - maybe a two out of ten for scalability if you are using it off of the cloud. That said, that's not the latest version. The latest is likely more scalable, I just don't have experience with it.

The technical support is pretty good. They are knowledgeable and responsive. We were satisfied with the level of support we received.

I also know a bit about Checkmarx, Fortify, Veracode, and AppScan.

I didn't really do the actual setup once it got moved into the cloud. I don't know how easy the cloud set up was. However, it's my understanding that it is now potentially easier than it was before, which wasn't too bad. 

I don't know the prices currently. I knew the prices when it was still in-house with IBM, however, I don't know what the cost is now.

I worked with the solution at a previous company. Now I am a consultant and I no longer work with the product. I don't have a business relationship with HCL.

I wanted to do a POC with the current state of what was IBM AppScan and now is HCL. I contacted my contacts at IBM and then they started off the conversation and it went smoothly because a number of people from IBM had gone over to HCL when that product was acquired.

Various tools have their strengths, I would advise anyone who is interested in using a similar solution do a proof of concept first with a few options. Try Checkmarx, Fortify, Veracode, and AppScan, and see which one makes the most sense for your company's purposes. Those would be the top four in my opinion right now.

Overall, I would rate the solution eight out of ten.

I use it for my customers. 

Improvement can be done as per customer requirements.

I have been using HCL AppScan for some time. 

The technical support is good. 

Positive

The initial setup took one to two days. 

The solution is cheap. 

I rate the overall solution a nine out of ten.

HCL AppScan efficiently scans through the website and identifies vulnerabilities for AWS. It is reducing tools day by day, making it more efficient. 

HCL AppScan generates false results. Sometimes, it incorrectly identifies requests as vulnerable when they are not vulnerable. In the ADSL feature managed, the primary objective is to identify application security vulnerabilities. However, sometimes AppScan wrongly flags something as a vulnerability when it's not present, which we call a false positive.

I have been using HCL AppScan for nine years.

I rate the solution’s stability an eight out of ten.

The solution is scalable if required.

Customer support is helpful. 

Positive

There is a licensing partner. Sometimes, it is required to install a server. I must remove that license and then eject a new one on a different server. It becomes a bit harder for beginners if they do not have enough experience to install Zoho software.

Deployment takes around an hour, and one person can do it.

I rate the initial setup a six and a half out of ten, where one is difficult and ten is easy.

The tool is not cost-efficient. Considering the type of service with encryption security scanning from HCL AppScan, it drives up the cost unnecessarily. It is fairly priced.

There are some very cost-effective solutions out there. They are also very efficient for systems scanning.

Overall, I rate the solution an eight-point five out of ten.

I use the tool to scan the web interface.

Compared to other tools only AppScan supports special language.

The solution needs to improve in some areas. The tool needs to add more languages. It also needs to improve its speed.

I have been using the solution for two years.

The solution has dedicated and good tech support. We can open a ticket and we get information within two hours. Once we open a ticket we get validation or confirmation of our problem. When we get to the specialist, we will get more information.

Positive

I would rate the overall solution a nine out of ten.

I mainly use AppScan for vulnerability scanning and database bridging.

AppScan is too complicated and should be made more user-friendly.

I've been using HCL AppScan for three to four years.

AppScan is stable.

AppScan is scalable.

HCL's technical support is ok, but it could be faster and more responsive.

The initial setup was complex and took about a day and a half.

I would rate AppScan four out of ten.