Skip to content
SPECIFICTION
Get listed

HCL AppScan

hcltech.com

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit hcltech.com
Spec score 8.9 #2 of 14 in Interactive Application Security Testing Software

What it is

HCL AppScan identifies and prioritizes software vulnerabilities and helps teams remediate them across the development lifecycle. It combines static, dynamic, interactive and open-source composition analysis for source code, running applications, APIs and dependencies. API security testing supports OpenAPI/Swagger, Postman and GraphQL, and can uncover shadow, zombie and undocumented APIs. HCL says its AI-powered analysis reduces false positives and helps prioritize critical risks. Deployment options include cloud and on-premises; Enterprise also lists private cloud. Integrations include CI systems, code repositories, issue-management services and developer tools such as Android Studio. CodeSweep is a free on-prem GitHub extension for pull-request SAST scanning, with support for more than 35 languages. AppScan Standard is designed for security experts and penetration testers assessing web applications and APIs, and supports specified 64-bit Windows versions. The 14-day trial allows five scans in total, one at a time, with a four-hour limit per scan. Its summary reports omit issue details and remediation tasks; private-site scanning, regulatory reports and IAST are also excluded.

Spec sheet

What it does
HCL AppScan is an enterprise platform for finding, prioritizing and fixing vulnerabilities in applications, APIs and software components across the development lifecycle.Read 15 Oct 2026 · hcltech.com
Purpose
HCL AppScan identifies, prioritizes, and helps remediate software vulnerabilities across the development lifecycle.Read 29 Sep 2026 · hcltech.com
Intended users
HCL describes AppScan Standard as a DAST solution designed for security experts and penetration testers assessing web applications and APIs.Read 29 Sep 2026 · hcl-software.com
Deployment
AppScan offerings include cloud and on-premises deployment, and Enterprise also lists private cloud deployment.Read 29 Sep 2026 · hcl-software.com
Integrations
HCL lists integrations with Jenkins, GitHub Actions, Azure DevOps, GitLab CI, Bitbucket, AWS CodePipeline, Jira, ServiceNow, Visual Studio, VS Code, Eclipse, JetBrains, and Android Studio.Read 29 Sep 2026 · hcltech.com
Support
HCL says technical support is available, with pricing dependent on the customer's needs and other factors.Read 29 Sep 2026 · hcl-software.com
AI remediation
The product advertises AI analysis, context-aware fix guidance and IDE-level automated remediation.Read 15 Oct 2026 · hcltech.com
AI triage
HCL says its AI-powered analysis reduces false positives and helps teams prioritize critical risks.Read 29 Sep 2026 · hcltech.com
API security
API testing covers OpenAPI/Swagger, Postman and GraphQL and can discover shadow, zombie and undocumented APIs.Read 15 Oct 2026 · hcltech.com
API session behavior
REST API sessions last about 30 minutes and are automatically revalidated; deleting an API key immediately revokes access and active sessions.Read 15 Oct 2026 · help.hcl-software.com
Capterra listed price
Capterra lists a starting price of $300 per user per month for HCL AppScan.Read 15 Oct 2026 · capterra.com
Chrome extension
HCL publishes an AppScan Activity Recorder extension in the Chrome Web Store for recording browser activity used in DAST scans; the opened listing did not display a rating or rating count.Read 15 Oct 2026 · chromewebstore.google.com
CI/CD integrations
Documented integrations include Jenkins, GitHub Actions, Azure DevOps, GitLab CI, Bitbucket, AWS CodePipeline, Maven and Gradle.Read 15 Oct 2026 · hcltech.com
CodeSweep
CodeSweep is a developer-focused SAST scanner offered as an on-prem GitHub extension for scanning pull requests, with support for 35+ languages.Read 29 Sep 2026 · hcl-software.com
Company founding
Gartner’s company profile lists HCLSoftware’s parent company as founded in 1991.Read 15 Oct 2026 · gartner.com
Company headquarters and size
LinkedIn lists HCLTech headquarters in Noida, Uttar Pradesh, India, and reports more than 223,000 employees across 60 countries.Read 15 Oct 2026 · linkedin.com
Company legal name
Crunchbase identifies the legal entity behind HCLSoftware as HCL Technologies Limited.Read 15 Oct 2026 · crunchbase.com
Compliance reporting
AppScan Standard offers compliance and industry reports including PCI, HIPAA, OWASP Top 10, and SANS 25.Read 29 Sep 2026 · hcl-software.com
Deployment prerequisites
A single-VM AppScan 360° installation uses Ubuntu 22.04/24.04 or RHEL 9.5 with Bash, Docker or Podman, kubectl and Helm; it also needs MSSQL 2019 or newer and identity, email and registry services.Read 15 Oct 2026 · help.hcl-software.com
Developer extensions
Official tooling includes Jenkins and Azure DevOps plugins, GitHub Actions, Maven and Gradle plugins, Android Studio and Cursor integrations, and AppScan CodeSweep.Read 15 Oct 2026 · help.hcl-software.com
Documentation
HCL publishes separate current documentation sets for AppScan on Cloud, AppScan 360° 2.2.0, Enterprise 10.12.0, Source 10.12.0 and Standard 10.12.0.Read 15 Oct 2026 · help.hcl-software.com
Download policy
Since February 28, 2025, on-premises AppScan downloads are provided through the My HCLSoftware portal.Read 15 Oct 2026 · help.hcl-software.com
Issue-management integrations
AppScan integrations synchronize findings with Jira, Azure DevOps, IBM RTC and ServiceNow, and include a Jira Cloud connector.Read 15 Oct 2026 · help.hcl-software.com
Language coverage
HCL states that AppScan supports more than 30 programming languages and many frameworks, including Java, .NET, JavaScript, Python, C/C++, Go, Rust, Swift, COBOL, ABAP, Terraform and Kubernetes YAML.Read 15 Oct 2026 · hcltech.com
License model
AppScan is commercially licensed software using node-locked or floating licenses managed through HCL licensing services; the license agreement says the program is licensed, not sold.Read 15 Oct 2026 · help.hcl-software.com
Limit: G2 reviewers
G2 complaints include slow scans, difficult initial setup, false positives, high resource use, inconsistent results between plugins, login-cache problems and costly licensing.Read 15 Oct 2026 · g2.com
Limit: Gartner reviewers
Reported problems include difficult installation and maintenance, bugs, performance issues, clunky resource-heavy operation and insufficient troubleshooting documentation.Read 15 Oct 2026 · gartner.com
Limit: TrustRadius reviewers
Reported drawbacks include cost, slow scans, difficult troubleshooting, complex configuration, resource-heavy dynamic scans and occasional crashes.Read 15 Oct 2026 · trustradius.com
Linux support
The AppScan 360° Presence component supports 64-bit RHEL 8/9, openSUSE Leap 15.3 and Ubuntu 18.04/20.04/22.04 with .NET 8.Read 15 Oct 2026 · help.hcl-software.com
Notable news: 2026 recognition
HCL reported on April 21, 2026 that Gartner Peer Insights data showed a 4.8/5 score from 53 reviews and 94% willingness to recommend AppScan as part of a Customers’ Choice recognition.Read 15 Oct 2026 · hcl-software.com
Ownership history
Independent reference material records that HCL acquired IBM’s AppScan product portfolio in 2019.Read 15 Oct 2026 · en.wikipedia.org
Praise: G2 reviewers
G2 reviewers praise CI/CD and IDE integration, vulnerability reporting, developer collaboration, remediation guidance and broad SAST/DAST coverage.Read 15 Oct 2026 · g2.com
Praise: Gartner reviewers
Gartner reviewers highlight centralized SAST, DAST and SCA coverage, compliance reporting, SBOM visibility and CI/CD integration.Read 15 Oct 2026 · gartner.com
Praise: TrustRadius reviewers
Reviewers commonly praise automated scans, configurable testing, CI/CD connectivity, reporting, broad language support and ease of sharing findings with developers.Read 15 Oct 2026 · trustradius.com
Public API
AppScan on Cloud exposes a Swagger-documented REST API with API-key login, scan creation, file upload and report-only operations.Read 15 Oct 2026 · help.hcl-software.com
Rating on Capterra
100% of displayed reviewers rated it above 4 stars; review count is not shown on the opened pageRead 15 Oct 2026 · capterra.com
Rating on G2
4.1 out of 5 from 106 reviewsRead 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.7 out of 5 from 225 ratingsRead 15 Oct 2026 · gartner.com
Rating on ITreview
4.0 out of 5 from 19 reviewsRead 15 Oct 2026 · itreview.jp
Rating on TrustRadius
7.1 out of 10 from 25 reviewsRead 15 Oct 2026 · trustradius.com
Security and compliance
HCL says AppScan reporting supports compliance programs including PCI, HIPAA and SOX.Read 15 Oct 2026 · hcltech.com
Self-hosting
AppScan 360° can be deployed as a self-managed on-premises or private-cloud platform, including single-VM and distributed containerized installations.Read 15 Oct 2026 · help.hcl-software.com
Standard platform requirement
AppScan Standard supports 64-bit Windows 11 Pro or Enterprise and Windows Server 2016, 2019, 2022, and 2025 editions listed on its requirements page.Read 29 Sep 2026 · help.hcl-software.com
System requirements
AppScan Standard requires 64-bit Windows 11 or Windows Server 2016–2025, a 2 GHz dual-core processor, at least 4 GB RAM and 5 GB free disk space.Read 15 Oct 2026 · help.hcl-software.com
Testing methods
The platform combines SAST, DAST, IAST and SCA in cloud and on-premises deployments.Read 15 Oct 2026 · hcltech.com
Trial limits
The trial permits one scan at a time, limits scans to four hours, allows five scans total, and provides summary reports without issue details or remediation tasks.Read 29 Sep 2026 · help.hcl-software.com

Plans and prices

CodeSweep Free Free SAST source-code scanner · downloadable application Read 15 Oct 2026 · hcl-software.com
Free Trial Free 14-day trial subscription 5 scans (SAST, DAST, SCA) · summary reports only · no private site scanning · no regulatory reports · IAST excluded Read 29 Sep 2026 · hcl-software.com
Professional $29.99, paid once per scan; 1-year SaaS subscription DAST, SAST or SCA choice · centralized dashboards · customizable policies · reporting · IDE/CI-CD integrations · APIs Read 15 Oct 2026 · hcl-software.com
Professional regular price $299, paid once per scan DAST, SAST or SCA choice · 1-year SaaS subscription Read 15 Oct 2026 · hcl-software.com
50-scan pack $699, paid once per 50 scans Choice of DAST, SAST or SCA scans · maximum two packs per order Read 15 Oct 2026 · hcl-software.com
Enterprise Priced on request Unlimited scans · IAST · IaC · secrets scanning · issue correlation · API security · AI triage/remediation · SaaS, on-premises or private cloud · concurrent, per-user or per-app pricing Read 15 Oct 2026 · hcl-software.com

Every HCL AppScan plan and price →

Strong points and limits

Strong points

  • Combines SAST, DAST, IAST and SCA.
  • API testing supports OpenAPI/Swagger, Postman and GraphQL.
  • CodeSweep supports more than 35 languages.
  • Offers cloud and on-premises deployment.

Limits

  • Trial permits five scans total.
  • Trial scans are limited to four hours.
  • Trial reports omit issue details and remediation tasks.
  • Trial excludes IAST and regulatory reports.

Who it suits

AppScan Standard is aimed at security experts and penetration testers assessing web applications and APIs. CodeSweep is for developers who want pull-request SAST scanning through a GitHub extension.

HCL AppScan in depth

Read the full write-up

Overview

HCL AppScan is an application security platform for finding and prioritizing vulnerabilities in code, running applications, APIs and open-source dependencies. It suits development and security teams that want several testing methods across their workflow, especially security specialists assessing web applications and APIs. Its breadth is useful, but trial restrictions and per-scan Professional pricing make plan fit an important part of the decision.

Key features

AppScan combines static, dynamic, interactive and software-composition analysis. That can cover multiple stages of application assessment in one platform, but the methods are not equally available on every plan: Professional is a choice of DAST, SAST or SCA, the trial excludes IAST, and Enterprise includes IAST. Teams that need the full set should account for that tier distinction rather than assume every subscription combines all four.

API security testing supports OpenAPI/Swagger, Postman and GraphQL, and can find shadow, zombie and undocumented APIs. Authenticated testing and agent instrumentation broaden the assessment beyond unauthenticated web scans. HCL says its AI analysis reduces false positives and helps prioritize critical risks, which could help teams focus attention on more consequential findings.

Integrations include Jenkins, GitHub Actions, Azure DevOps, GitLab CI, Bitbucket and AWS CodePipeline, plus Jira, ServiceNow and IDEs such as Visual Studio, VS Code, Eclipse, JetBrains and Android Studio. This gives teams several options for fitting scans and findings into development and issue-management workflows. AppScan offerings include cloud and on-premises deployment; Enterprise also offers private cloud.

CodeSweep is a separate, on-prem GitHub extension for scanning pull requests with SAST across 35+ languages. It is a focused free option for teams wanting pull-request checks, not a substitute for AppScan's broader testing methods. AppScan Standard is a DAST solution aimed at security experts and penetration testers; it supports 64-bit Windows 11 Pro or Enterprise and Windows Server 2016, 2019, 2022 and 2025. Its compliance and industry reports cover PCI, HIPAA, OWASP Top 10 and SANS 25.

Pricing

AppScan uses a freemium model, with a free plan and 14-day trial. The trial costs nothing and allows five scans across SAST, DAST and SCA. It limits users to one scan at a time, caps each scan at four hours, provides summary reports only, and excludes issue details, remediation tasks, private-site scanning, regulatory reports and IAST. Those limits make it useful for a short initial evaluation, but a poor fit for validating a complete workflow that depends on detailed findings or IAST.

Professional costs $29.99, paid once, billed at $29.99 / scan, and includes a one-year SaaS subscription. Each scan is a choice of DAST, SAST or SCA, with centralized dashboards, customizable policies and actionable reporting. Unused scans expire at the end of the subscription, so buyers need to estimate scan volume and timing rather than treat the purchase as an evergreen pool. It fits teams with bounded scan needs that can work within one testing method per scan; it is less suitable when scan demand is unpredictable or several methods are required together.

Enterprise has custom pricing, with unlimited scans, IAST, IaC, Secrets and API Security, and SaaS, on-premises or private-cloud deployment. Pricing can be concurrent, per user or per app. It is the more appropriate tier for organizations needing those capabilities or deployment choices, though the pricing model requires a sales discussion.

CodeSweep is a free download: an on-prem GitHub extension and SAST scanner for 35+ languages. It is the lowest-cost route for pull-request SAST, but does not provide the broader AppScan coverage described above.

Platforms

AppScan spans API, extension, Linux, macOS, self-hosted, web and Windows platforms. Standard's narrower system requirements matter for teams planning that DAST workflow: it supports 64-bit Windows 11 Pro or Enterprise and the listed Windows Server 2016, 2019, 2022 and 2025 editions. Language coverage includes Java,.NET, Node.js, PHP and Python, with frameworks including Spring, Express, Flask and FastAPI.

Who it's for

AppScan is strongest for teams that need multiple application-security testing approaches, API coverage and integrations with established CI/CD, issue-tracking or IDE workflows. Security experts and penetration testers assessing web applications and APIs are a clear fit for Standard. Smaller teams seeking only pull-request SAST can start with CodeSweep; teams needing IAST, unlimited scans or private-cloud deployment should look to Enterprise. Buyers wanting a detailed trial report or a predictable, broad allowance at the Professional tier may find the limits and per-scan structure restrictive.

Pros and cons

Pro: SAST, DAST, IAST and SCA span code, running applications and dependencies, with Enterprise bringing the methods together.

Pro: API testing supports three named specifications or tools and targets undocumented as well as known APIs.

Pro: CI/CD, issue-tracking and IDE integrations offer several routes into existing development workflows.

Pro: Standard includes compliance reporting for PCI, HIPAA, OWASP Top 10 and SANS 25.

Con: The trial's five scans, four-hour cap, one-at-a-time restriction and summary-only reports limit how thoroughly teams can assess the workflow.

Con: Professional charges per scan, offers only one chosen method per scan, and expires unused scans after a year.

Con: Enterprise pricing is custom, making cost harder to assess without contacting sales.

Alternatives

For a broader shortlist, see Interactive Application Security Testing Software. Choose Waratek IAST if a paid IAST option with a free trial and a Starter offer for one application per organization is a closer fit. Aikido CSPM is worth considering for teams that prefer a freemium option with a free Developer plan covering two users and limited repositories, images, domains and cloud accounts.

Veracode DAST is an alternative for teams focused on web applications and APIs that want to request a live demo; it has no free plan. Contrast Assess is another paid option across API, Linux, macOS, self-hosted, web and Windows platforms. DongTai IAST may suit teams seeking a free, open-source self-hosted deployment via Docker Compose or Kubernetes.

Acunetix offers a paid, trial-available alternative with a $500 max per pentest for a single application and its API suite, including audit-ready PDF reports and delivery within 24 hours. New Relic IAST is another paid option with a free plan that includes 100 GB of monthly data ingest and one free full platform user. NowSecure Platform is an alternative priced by demo or order form, with no public price stated.

Verdict

Choose HCL AppScan if your security and development teams need several testing methods, API coverage and workflow integrations, and can match their needs to the right tier. Its strongest case is breadth across application assessment and deployment; its main drawback is that trial constraints and Professional's per-scan, single-method structure can leave important needs to Enterprise, where pricing is custom.

Verdict

AppScan spans several vulnerability-testing methods and deployment options, with a separate developer-focused CodeSweep extension. Trial limits and exclusions are substantial, so check the available scan workflow before relying on it.

Where Specifiction places it

Alternatives to HCL AppScanAll alternatives →