HCL AppScan vs Waratek IAST
HCL AppScan
hcltech.com
Waratek IAST
waratek.comSide by side
| Figure | HCL AppScan | Waratek IAST |
|---|---|---|
| Price from | Free | $2,499/mo |
| Free plan | Yes | Yes |
| Free trial | Yes | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 6 | 3 |
| Spec score · Interactive Application Security Testing Software | 8.9 (#2) | 7.9 (#5) |
| Deployment | AppScan offerings include cloud and on-premises deployment, and Enterprise also lists private cloud deployment. | Waratek documentation describes a Portal SaaS option and an on-prem Portal Dedicated deployment. |
| Integrations | HCL lists integrations with Jenkins, GitHub Actions, Azure DevOps, GitLab CI, Bitbucket, AWS CodePipeline, Jira, ServiceNow, Visual Studio, VS Code, Eclipse, JetBrains, and Android Studio. | The Team plan lists Jira and Slack integrations, marked Coming Soon, and the Starter plan includes basic CI/CD integration. |
| Purpose | HCL AppScan identifies, prioritizes, and helps remediate software vulnerabilities across the development lifecycle. | Waratek IAST monitors application behavior during execution to find vulnerabilities in running code. |
| Support | HCL says technical support is available, with pricing dependent on the customer's needs and other factors. | Starter includes email and knowledge base support; Team includes email, chat, and knowledge base support with a 48-hour maximum response. |
Plans
HCL AppScan
- CodeSweepFree
- Free TrialFree
- Professional$29.99, paid once
- Professional regular price$299, paid once
- 50-scan pack$699, paid once
- EnterprisePriced on request
In their own words
HCL AppScan
HCL AppScan identifies and prioritizes software vulnerabilities and helps teams remediate them across the development lifecycle. It combines static, dynamic, interactive and open-source composition analysis for source code, running applications, APIs and dependencies. API security testing supports OpenAPI/Swagger, Postman and GraphQL, and can uncover shadow, zombie and undocumented APIs. HCL says its AI-powered analysis reduces false positives and helps prioritize critical risks. Deployment options include cloud and on-premises; Enterprise also lists private cloud. Integrations include CI systems, code repositories, issue-management services and developer tools such as Android Studio. CodeSweep is a free on-prem GitHub extension for pull-request SAST scanning, with support for more than 35 languages. AppScan Standard is designed for security experts and penetration testers assessing web applications and APIs, and supports specified 64-bit Windows versions. The 14-day trial allows five scans in total, one at a time, with a four-hour limit per scan. Its summary reports omit issue details and remediation tasks; private-site scanning, regulatory reports and IAST are also excluded.
Waratek IAST
Waratek IAST monitors Java applications as they run to identify vulnerabilities in application behavior. Runtime instrumentation tracks data flow and execution paths, and findings include the code line involved, a full stack trace, and the flow that led to the issue. Waratek says it analyzes compiled bytecode or binaries without source-code access. QA teams or automated suites can generate security insights while running regular functional tests, without a separate security scan phase. The product is offered through a Portal SaaS option or an on-prem Portal Dedicated deployment. Starter is a free trial for one application, with runtime analysis, basic CI/CD integration, standard vulnerability reporting, and email and knowledge base support. Team costs $2,499 per month and includes three applications, with the option to add up to two more for $833/mo per additional app. Jira and Slack integrations are marked Coming Soon. Enterprise pricing is custom, and its custom rulesets, advanced CI/CD plugins, and software composition analysis are marked Coming Soon. Waratek reports a 100% true positive rate, 0% false positive rate, and OWASP Benchmark score of 100.