Try our new research platform with insights from 80,000+ expert users

Checkmarx One vs HCL AppScan comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Checkmarx One
Ranking in Application Security Tools
3rd
Ranking in Static Application Security Testing (SAST)
3rd
Average Rating
7.6
Reviews Sentiment
6.9
Number of Reviews
70
Ranking in other categories
Vulnerability Management (21st), Static Code Analysis (2nd), API Security (3rd), DevSecOps (2nd), Risk-Based Vulnerability Management (8th)
HCL AppScan
Ranking in Application Security Tools
14th
Ranking in Static Application Security Testing (SAST)
10th
Average Rating
7.8
Reviews Sentiment
6.9
Number of Reviews
43
Ranking in other categories
Dynamic Application Security Testing (DAST) (1st)
 

Mindshare comparison

As of April 2025, in the Application Security Tools category, the mindshare of Checkmarx One is 10.7%, down from 15.1% compared to the previous year. The mindshare of HCL AppScan is 2.6%, down from 2.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools
 

Featured Reviews

Rohit Kesharwani - PeerSpot reviewer
Provides good security analysis and security identification within the source code
We integrate Checkmarx into our software development cycle using GitLab's CI/CD pipeline. Checkmark has been the most helpful for us in the development stage. The solution's incremental scanning feature has impacted our development speed. The solution's vulnerability detection is around 80% to 90% accurate. I would recommend Checkmarx to other users because it is one of the good tools for doing security analysis and security identification within the source code. Overall, I rate Checkmarx a nine out of ten.
Rishi Anupam - PeerSpot reviewer
A stable and scalable scanning solution with good reporting feature
The solution is used for the vulnerabilities scan on the network side The reporting part is the most valuable feature. The penetration testing feature should be included. I have been using the solution for four years. It is a stable solution. I rate it seven out of ten. It is a scalable…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It gives the proper code flow of vulnerabilities and the number of occurrences."
"It is very useful because it fits our requirements. It is also easy to use. It is not complex, and we are satisfied with the results."
"Both automatic and manual code review (CxQL) are valuable."
"The product's most valuable feature is static code and supply chain effect analysis. It provides a lot of visibility."
"The setup is fairly easy. We didn't struggle with the process at all."
"The best thing about Checkmarx is the amount of vulnerabilities that it can find compared to other free tools."
"It's not an obstacle for developers. They can easily write their code and make it more secure with Checkmarx."
"The reports are very good because they include details on the code level, and make suggestions about how to fix the problems."
"You can easily find particular features and functions through the UI."
"The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase."
"AppScan's most valuable features include its ability to identify vulnerabilities accurately, provide detailed remediation steps, and the newly introduced AI-powered features that enhance its functionality further."
"AppScan is stable."
"It has certainly helped us find vulnerabilities in our software, so this is priceless in the end."
"I like the recording feature."
"The product has valuable features for static and dynamic testing."
"Compared to other tools only AppScan supports special language."
 

Cons

"The cost per user is high and should be reduced."
"Checkmarx reports many false positives that we need to manually segregate and mark “Not exploitable”."
"Updating and debugging of queries is not very convenient."
"Checkmarx could improve the speed of the scans."
"It is an expensive solution."
"When we first ran it on a big project, there wasn't enough memory on the computer. It originally ran with eight gigabytes, and now it runs with 32. The software stopped at some point, and while I don't think it said it ran out of memory, it just said "stopped" and something else. We had to go to the logs and send them to the integrator, and eventually, they found a memory issue in the logs and recommended increasing the memory. We doubled it once, and it didn't seem enough. We doubled it again, and it helped."
"The interactive application security testing, or IAST, the interactive part where you're looking at an application that lives in a runtime environment on a server or virtual machine, needs improvement."
"In terms of dashboarding, the solution could provide a little more flexibility in terms of creating more dashboards. It has some of its own dashboards that come out of the box. However, if I have to implement my own dashboards that are aligned to my organization's requirements, that dashboarding feature has limited capability right now."
"AppScan is too complicated and should be made more user-friendly."
"We would like to see a check in the specific vulnerabilities in mobile applications or rooted devices, such as jailbreaking devices."
"The databases for HCL are small and have room for improvement."
"Improving usability could enhance the overall experience with AppScan. It would be beneficial to make the solution more user-friendly, ensuring that everyone can easily navigate and utilize its features."
"Visibility is an issue for us. Our partners do not know we have integrations with some of IBM products."
"A desktop version should be added."
"Many silly false positives are produced."
"In future releases, I would like to see more aggressive reports. I would also like to see less false positives."
 

Pricing and Cost Advice

"The solution is costly."
"The pricing is competitive and provides a lower TCO (total cost of ownership) for achieving application security."
"If you want more, you have to pay more. You have to pay for additional modules or functionalities."
"It is the right price for quality delivery."
"The pricing was not very good. This is just a framework which shouldn’t cost so much."
"​Checkmarx is not a cheap scanning tool, but none of the security tools are cheap. Checkmarx is a powerful scanning tool, and it’s essential to have one of these products."
"It is not expensive, but sometimes, their pricing model or licensing model is not very clear. There are similar variables, such as projects or developers, and sometimes, it is a little bit confusing."
"This solution is expensive. The customized package allows you to buy additional users at any time."
"Our clients are willing to pay the extra money. It is expensive."
"Pricing was the main reason that we went ahead with this solution as they were the lowest in the market."
"I rate the product's price a seven on a scale of one to ten, where one is low, and ten is high. HCL AppScan is an expensive tool."
"I would rate the product's pricing a nine out of ten. The product's pricing is expensive compared to the features that they offer."
"With the features, that they offer, and the support, they offer, AppScan pricing is on a higher level."
"AppScan is a little bit expensive. IBM needs to work a little bit on the pricing model, decreasing the license cost."
"The solution is moderately priced."
"HCL AppScan is expensive."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
842,767 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
21%
Computer Software Company
15%
Manufacturing Company
10%
Government
5%
Computer Software Company
19%
Financial Services Firm
15%
Government
11%
Manufacturing Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?
I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.
What do you like most about Checkmarx?
Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.
What is your experience regarding pricing and costs for Checkmarx?
The pricing is relatively expensive due to the product's quality and performance, but it is worth it.
What do you like most about HCL AppScan?
The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase.
What needs improvement with HCL AppScan?
AppScan needs to improve its handling of false positives. It also requires enhancements in customer support, similar to what Veracode provides. Regularly scheduling calls with clients to discuss fe...
What is your primary use case for HCL AppScan?
The primary use case for AppScan is for security purposes. I compare AppScan with other tools such as Veracode. We use AppScan for vulnerability detection and auto-remediation of vulnerabilities wi...
 

Also Known As

No data available
IBM Security AppScan, Rational AppScan, AppScan
 

Overview

 

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
Essex Technology Group Inc., Cisco, West Virginia University, APIS IT
Find out what your peers are saying about Checkmarx One vs. HCL AppScan and other solutions. Updated: March 2025.
842,767 professionals have used our research since 2012.