I'm currently working with BigFix and HCL AppScan. At least three people in my company are using HCL AppScan. Since we are a reseller, we run it in both lab environments and live production applications. Our production applications include our CRM, monitoring setups, active directory, and quite a few other live applications. We don't have too many applications in our own environment, but in our customer environments, we do plan to integrate HCL AppScan into the DevOps toolchains. Although we've read about the integration capabilities, we will have to identify how it works specifically for our needs. It may be slightly early to fully assess that integration. Although automated scanning may not be very important for us, it is definitely going to be important for our customers.
The primary use case for AppScan is for security purposes. I compare AppScan with other tools such as Veracode. We use AppScan for vulnerability detection and auto-remediation of vulnerabilities with features built into the tool, including their AI solutions. I work with AppScan and other security tools as part of my role, focusing on market-leading tools.
I mainly use AppScan to secure various types of applications. I use its DAFDAT solution for black box scanning, as well as SaaS and source code validation. AppScan helps in scanning code for vulnerabilities, including open-source code.
Cyber Security Architect and Presales Consultant at Kyndryl
Reseller
Jan 16, 2024
We use the product for Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST). By integrating AppScan into our CI/CD pipelines, aligned with Agile methodologies, we ensure that security testing becomes an integral part of the software development lifecycle.
We use it for evaluating the application's code on web pages and previously published applications to identify vulnerabilities. It helps us to see how the code is written and how hard it is to find vulnerabilities. It's a useful tool for our purposes.
Software Engineer at Inspire for Solutions Development
Real User
Feb 6, 2023
We use HCL AppScan products to help us scan for vulnerabilities and generate reports to provide a foundation on how to fix any issues. Their 4.7 version facilitates machine learning to help us select APIs and customize our scans more specifically. We also use the HCL AppScan Standard Enterprise Source and Cloud for scanning, and we plan to add the HCL AppScan Switch Casing to our toolkit. This makes it easier for us to scan the internet and use Tenable to help us find any issues.
Innovation manager at a computer software company with 51-200 employees
Real User
May 5, 2022
I have a set project, and I'm writing an application for monitoring server status, and I tried several times to scan it with AppScan in order to understand if there are vulnerabilities in my code.
Principal Architect, Application Build Security. at a logistics company with 10,001+ employees
Real User
Jan 19, 2022
HCL AppScan is primarily used to improve application security. We are transitioning from DevOps to DevSecOps. We are attempting to integrate these tools into our CICD pipeline in order to meet our business use cases. And if we notice that the tool is missing any business features or a feature, we will highlight them and work to have them fixed or implemented. That is how we go about it. We don't go for any generic features because that will be handled by the product team. We are here to identify our gaps and then have them implemented by the vendor team. AppScan is only used for web scanning; we do not use it for anything else.
General Manager at a consultancy with 51-200 employees
Real User
Nov 4, 2020
We perform more dynamic scanning using AppScan. We set up a scan, perform it and get the results, and then give the results back to our customer. Within our organization, there are four members of the team who are using it. Currently, we are satisfied with AppScan but I am sure there are better alternatives available because this is a very old product. It's been on market for more than ten years now. I am sure there are a lot of new age products that are more scalable and cloud-based. Although we are using it and will probably continue to do so moving forward, I think there are better alternatives on the market now.
Cybersecurity Architecture and Technology Lead at a tech company with 51-200 employees
Consultant
Top 20
May 4, 2019
The primary use case is to detect time-based Blind SQL Injection attacks, as well as Error-Based Injection attacks. The SQL injection attack is my favorite and I have more expertise in this vulnerability.
Our clients use it to try to find errors in base code, and also to find how solutions work together. I believe they have on-premise usage; they are local government, so they are not very used to using the cloud.
HCL AppScan offers quick vulnerability detection with effective SDLC integration and is known for its user-friendly interface and seamless security integration.HCL AppScan provides dynamic and static scanning to identify vulnerabilities like XSS and SQL injection. It integrates well into CI/CD pipelines, supports multiple languages, and offers web and dynamic scanning, helping businesses ensure security across development lifecycles. Users benefit from API coverage, Postman integration, and...
I'm currently working with BigFix and HCL AppScan. At least three people in my company are using HCL AppScan. Since we are a reseller, we run it in both lab environments and live production applications. Our production applications include our CRM, monitoring setups, active directory, and quite a few other live applications. We don't have too many applications in our own environment, but in our customer environments, we do plan to integrate HCL AppScan into the DevOps toolchains. Although we've read about the integration capabilities, we will have to identify how it works specifically for our needs. It may be slightly early to fully assess that integration. Although automated scanning may not be very important for us, it is definitely going to be important for our customers.
The primary use case for AppScan is for security purposes. I compare AppScan with other tools such as Veracode. We use AppScan for vulnerability detection and auto-remediation of vulnerabilities with features built into the tool, including their AI solutions. I work with AppScan and other security tools as part of my role, focusing on market-leading tools.
We use AppScan primarily for security testing and performance monitoring across our systems.
I mainly use AppScan to secure various types of applications. I use its DAFDAT solution for black box scanning, as well as SaaS and source code validation. AppScan helps in scanning code for vulnerabilities, including open-source code.
We use the product for Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST). By integrating AppScan into our CI/CD pipelines, aligned with Agile methodologies, we ensure that security testing becomes an integral part of the software development lifecycle.
HCL AppScan efficiently scans through the website and identifies vulnerabilities for AWS. It is reducing tools day by day, making it more efficient.
I used the solution to find vulnerabilities in our website and system. I did some regular checkups.
I use HCL AppScan in my company for application security scanning.
The solution is used for the vulnerabilities scan on the network side.
We use it for evaluating the application's code on web pages and previously published applications to identify vulnerabilities. It helps us to see how the code is written and how hard it is to find vulnerabilities. It's a useful tool for our purposes.
We primarily use the solution for static scans as well as dynamic scans to check for vulnerabilities.
I use the tool to scan the web interface.
We use HCL AppScan products to help us scan for vulnerabilities and generate reports to provide a foundation on how to fix any issues. Their 4.7 version facilitates machine learning to help us select APIs and customize our scans more specifically. We also use the HCL AppScan Standard Enterprise Source and Cloud for scanning, and we plan to add the HCL AppScan Switch Casing to our toolkit. This makes it easier for us to scan the internet and use Tenable to help us find any issues.
This is a primarily application security testing solution.
I mainly use AppScan for vulnerability scanning and database bridging.
I have a set project, and I'm writing an application for monitoring server status, and I tried several times to scan it with AppScan in order to understand if there are vulnerabilities in my code.
HCL AppScan is primarily used to improve application security. We are transitioning from DevOps to DevSecOps. We are attempting to integrate these tools into our CICD pipeline in order to meet our business use cases. And if we notice that the tool is missing any business features or a feature, we will highlight them and work to have them fixed or implemented. That is how we go about it. We don't go for any generic features because that will be handled by the product team. We are here to identify our gaps and then have them implemented by the vendor team. AppScan is only used for web scanning; we do not use it for anything else.
We primarily use the solution for static analysis.
We perform more dynamic scanning using AppScan. We set up a scan, perform it and get the results, and then give the results back to our customer. Within our organization, there are four members of the team who are using it. Currently, we are satisfied with AppScan but I am sure there are better alternatives available because this is a very old product. It's been on market for more than ten years now. I am sure there are a lot of new age products that are more scalable and cloud-based. Although we are using it and will probably continue to do so moving forward, I think there are better alternatives on the market now.
The primary use case is to detect time-based Blind SQL Injection attacks, as well as Error-Based Injection attacks. The SQL injection attack is my favorite and I have more expertise in this vulnerability.
External and internal web application vulnerability scan.
Our clients use it to try to find errors in base code, and also to find how solutions work together. I believe they have on-premise usage; they are local government, so they are not very used to using the cloud.