GitGuardian Platform vs HCL AppScan comparison

GitGuardian and HCLSoftware are both solutions in the Application Security Tools category. GitGuardian is ranked #7 with an average rating of 9.0, while HCLSoftware is ranked #14 with an average rating of 7.9. GitGuardian holds a 0.6% mindshare in AS, compared to HCLSoftware ’s 2.6% mindshare. Additionally, 100% of GitGuardian users are willing to recommend the solution, compared to 83% of HCLSoftware users who would recommend it.

GitGuardian Platform

Read 24 GitGuardian Platform reviews

2,303 Views
409 Comparison Views

100% willing to recommend

HCL AppScan

Read 43 HCL AppScan reviews

3,792 Views
2,867 Comparison Views

83% willing to recommend

GitGuardian Platform

HCL AppScan

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 8, 2024

HCL AppScan and GitGuardian Platform are prominent contenders in application security testing. User feedback indicates GitGuardian Platform might have an edge due to its specific advantages in threat detection speed.

Features: HCL AppScan offers comprehensive security testing, integration flexibility, and a broad automation suite. GitGuardian Platform provides powerful secret detection, advanced API security features, and AI-driven rapid threat detection.

Room for Improvement: HCL AppScan needs faster scanning speed, more efficient update processes, and improved reporting capabilities. GitGuardian Platform could enhance its reporting features, customization options, and scalability.

Ease of Deployment and Customer Service: HCL AppScan deployment is efficient, though customer service responsiveness could improve. GitGuardian Platform features straightforward deployment and offers robust customer support, assisting effectively during onboarding.

Pricing and ROI: HCL AppScan has higher setup costs tied to its feature-rich offerings, with some users questioning ROI. GitGuardian Platform is competitively priced and viewed as delivering high value, with positive ROI reflecting good performance relative to cost.

To learn more, read our detailed GitGuardian Platform vs. HCL AppScan Report (Updated: April 2025).

Buyer's Guide

GitGuardian Platform vs. HCL AppScan

April 2025

Download the complete report

Helped 846,617 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

GitGuardian Platform

Ranking in Application Security Tools

7th

Ranking in Static Application Security Testing (SAST)

5th

Average Rating

9.0

Reviews Sentiment

7.4

Number of Reviews

Ranking in other categories

Data Loss Prevention (DLP) (6th), Software Supply Chain Security (4th), DevSecOps (4th)

HCL AppScan

Ranking in Application Security Tools

14th

Ranking in Static Application Security Testing (SAST)

10th

Average Rating

7.8

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

Dynamic Application Security Testing (DAST) (1st)

Mindshare comparison

As of April 2025, in the Application Security Tools category, the mindshare of GitGuardian Platform is 0.6%, up from 0.3% compared to the previous year. The mindshare of HCL AppScan is 2.6%, down from 2.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools

Featured Reviews

Joan Ging

Head of Development at Inhabit

It dramatically improved our ability to detect secrets, saved us time, and reduced our mean time to remediation

While they do offer some basic reporting, more comprehensive reporting would be beneficial in the long run. This would allow me to demonstrate the value of the product over time to continue to effectively budget for this subscription, especially as they add features that may come at an additional cost. I appreciate the improvements made to reporting over the past year, but continued development in this area will be appreciated. We have encountered occasional difficulties with the Single Sign-On process. There is room for improvement in its current implementation. It works, but was not quite as smooth as the rest of the GitGuardian experience.

Read full review

Rishi Anupam

Senior Manager at Airtel

A stable and scalable scanning solution with good reporting feature

The solution is used for the vulnerabilities scan on the network side The reporting part is the most valuable feature. The penetration testing feature should be included. I have been using the solution for four years. It is a stable solution. I rate it seven out of ten. It is a scalable…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It actually creates an incident ticket for us. We can now go end-to-end after a secret has been identified, to track down who owns the repository and who is responsible for cleaning it up."

"The breadth of the solution detection capabilities is pretty good. They have good categories and a lot of different types of secrets... it gives us a great range when it comes to types of secrets, and that's good for us."

"It's also worth mentioning that GitGuardian is unique because they have a free tier that we've been using for the first twelve months. It provides full functionality for smaller teams. We're a smaller company and have never changed in size, but we got to the point where we felt the service brought us value, and we want to pay for it. We also wanted an SLA for technical support and whatnot, so we switched to a paid plan. Without that, they had a super-generous, free tier, and I was immensely impressed with it."

"When they give you a description of what happened, it's really easy to follow and to retest. And the ability to retest is something that you don't have in other solutions. If a secret was detected, you can retest if it is still there. It will show you if it is in the history."

"GitGuardian Internal Monitoring has helped increase our secrets detection rate by several orders of magnitude. This is a hard metric to get. For example, if we knew what our secrets were and where they were, we wouldn't need GitGuardian or these types of solutions. There could be a million more secrets that GitGuardian doesn't detect, but it is basically impossible to find them by searching for them."

"The most valuable feature is the general incident reporting system."

"GitGuardian has pretty broad detection capabilities. It covers all of the types of secrets that we've been interested in... [Yet] The "detector" concept, which identifies particular categories or types of secrets, allows an organization to tweak and tailor the configuration for things that are specific to its environment. This is highly useful if you're particularly worried about a certain type of secret and it can help focus attention, as part of early remediation efforts."

"GitGuardian has many features that fit our use cases. We have our internal policies on secret exposure, and our code is hosted on GitLab, so we need to prevent secrets from reaching GitLab because our customers worry that GitLab is exposed. One of the great features is the pre-receive hook. It prevents commits from being pushed to the repository by activating the hook on the remotes, which stops the developers from pushing to the remote. The secrets don't reach GitLab, and it isn't exposed."

More GitGuardian Platform pros

"It's generally a very user-friendly tool. Anyone can easily learn how to scan"

"The security and the dashboard are the most valuable features."

"The most valuable feature of HCL AppScan is scanning QR codes."

"You can easily find particular features and functions through the UI."

"The product is useful, particularly in its sensitivity and scanning capabilities."

"This solution saves us time due to the low number of false positives detected."

"The solution is cheap."

"It was easy to set up."

More HCL AppScan pros

Cons

"For some repositories, there are a lot of incidents. For example, one repository says 255 occurrences, so I assume these are 255 alerts and nobody is doing anything about them. These could be false positives. However, I cannot assess it correctly, because I haven't been closing these false positives myself. From the dashboard, I can see that for some of the repositories, there have been a lot of closing of these occurrences, so I would assume there are a lot of false positives. A ballpark estimate would be 60% being false positives. One of the arguments from the developers against this tool is the number of false positives."

"One of our current challenges is that the GitGuardian platform identifies encrypted secrets and statements as sensitive information even though they're secured."

"GitGuardian could have more detailed information on what software engineers can do. It only provides some highly generic feedback when a secret is detected. They should have outside documentation. We send this to our software engineers, who are still doing the commits. It's the wrong way to work, but they are accustomed to doing it this way. When they go into that ticket, they see a few instructions that might be confusing. If I see a leaked secret committed two years ago, it's not enough to undo that commit. I need to go in there, change all my code to utilize GitHub secrets, and go on AWS to validate my key."

"An area for improvement is the front end for incidents. The user experience in this area could be much better."

"Other solutions have a live chat feature that provides instant results. Waiting for an agent to reply to an email is less ideal than an instant conversation with a support employee. That's a complaint so minor I almost hesitate to mention it."

"The purchasing process is convoluted compared to Snyk, the other tool we use. It's like night and day because you only need to punch in your credit card, and you're set. With GitGuardian, getting a quote took two or three weeks. We paid for it in December but have not settled that payment yet."

"We have been somewhat confused by the dashboard at times."

"One improvement that I'd like to see is a cleaner for Splunk logs. It would be nice to have a middle man for anything we send or receive from Splunk forwarders. I'd love to see it get cleaned by GitGuardian or caught to make sure we don't have any secrets getting committed to Splunk logs."

More GitGuardian Platform cons

"There is room for improvement in the pricing model."

"Improving usability could enhance the overall experience with AppScan. It would be beneficial to make the solution more user-friendly, ensuring that everyone can easily navigate and utilize its features."

"They have to improve support."

"It has crashed at times."

"Many silly false positives are produced."

"AppScan needs to improve its handling of false positives."

"IBM Security AppScan needs to add performance optimization for quickly scanning the target web applications."

"It's a little bit basic when you talk about the Web Services. If AppScan improved its maturity on Web Services testing, that would be good."

More HCL AppScan cons

Pricing and Cost Advice

"I compared the solution to a couple of other solutions, and I think it is very competitively priced."

"The pricing and licensing are fair. It isn't very expensive and it's good value."

"We have seen a return on investment. The amount of time that we would have spent manually doing this definitely outpaces the cost of GitGuardian. It is saving us about $35,000 a year, so I would say the ROI is about $20,000 a year."

"We don't have a huge number of users, but its yearly rate was quite reasonable when compared to other per-seat solutions that we looked at... Having a free plan for a small number of users was really great. If you're a small team, I don't see why you wouldn't want to get started with it."

"The pricing for GitGuardian is fair."

"I am only aware of the base price. I do not know what happened with our purchasing team in discussions with GitGuardian. I was not privy to the overall contract, but in terms of the base MSRP price, I found it reasonable."

"You get what you pay for. It's one of the more expensive solutions, but it is very good, and the low false positive rate is a really appealing factor."

"With GitGuardian, we didn't need any middlemen."

More GitGuardian Platform pricing and cost advice

"HCL AppScan is expensive."

"The tool was expensive."

"I would rate the product's pricing a nine out of ten. The product's pricing is expensive compared to the features that they offer."

"The product has premium pricing and could be more competitive."

"The solution is moderately priced."

"The price of HCL AppScan is okay, in my opinion. You just buy HCL AppScan and don't pay anything anymore, meaning it is just a one-time purchase."

"I rate the product's price a seven on a scale of one to ten, where one is low, and ten is high. HCL AppScan is an expensive tool."

"The product is moderately priced, though it's an investment due to extensive code analysis needs."

More HCL AppScan pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

846,617 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

21%

Government

12%

Media Company

10%

Financial Services Firm

Computer Software Company

18%

Financial Services Firm

14%

Government

11%

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about GitGuardian Internal Monitoring ?

It's also worth mentioning that GitGuardian is unique because they have a free tier that we've been using for the first twelve months. It provides full functionality for smaller teams. We're a smal...

See all answers

What is your experience regarding pricing and costs for GitGuardian Internal Monitoring ?

The pricing for GitGuardian is fair.

See all answers

What needs improvement with GitGuardian Internal Monitoring ?

We'd like to request a new GitGuardian feature that automates user onboarding and access control for code repositories. Ideally, when a user contributes to a repository, they would be automatically...

See all answers

What do you like most about HCL AppScan?

The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase.

See all answers

What needs improvement with HCL AppScan?

AppScan needs to improve its handling of false positives. It also requires enhancements in customer support, similar to what Veracode provides. Regularly scheduling calls with clients to discuss fe...

See all answers

What is your primary use case for HCL AppScan?

The primary use case for AppScan is for security purposes. I compare AppScan with other tools such as Veracode. We use AppScan for vulnerability detection and auto-remediation of vulnerabilities wi...

See all answers

Comparisons

SonarQube Server (formerly SonarQube) vs GitGuardian Platform

Compared 34% of the time

Snyk vs GitGuardian Platform

Compared 18% of the time

GitHub Advanced Security vs GitGuardian Platform

Compared 17% of the time

GitGuardian Public Monitoring vs GitGuardian Platform

Compared 16% of the time

Cycode vs GitGuardian Platform

Compared 10% of the time

More GitGuardian Platform Competitors

Acunetix vs HCL AppScan

Compared 15% of the time

SonarQube Server (formerly SonarQube) vs HCL AppScan

Compared 12% of the time

Veracode vs HCL AppScan

Compared 10% of the time

Fortify on Demand vs HCL AppScan

Compared 8% of the time

OWASP Zap vs HCL AppScan

Compared 8% of the time

More HCL AppScan Competitors

Product Reports

Buyer's Guide

GitGuardian Platform

April 2025

Download GitGuardian Platform product report

Buyer's Guide

HCL AppScan

April 2025

Download HCL AppScan product report

Also Known As

GitGuardian Internal Monitoring

IBM Security AppScan, Rational AppScan, AppScan

Overview

GitGuardian helps organizations detect and fix vulnerabilities in source code at every step of the software development lifecycle. With GitGuardian’s policy engine, security teams can monitor and enforce rules across their VCS, DevOps tools, and infrastructure-as-code configurations.

Widely adopted by developer communities, GitGuardian is used by more than 500,000 developers and is the #1 app in the security category on the GitHub Marketplace. GitGuardian is also trusted by leading companies, including Instacart, Genesys, Orange, Iress, Beyond Identity, NOW: Pensions, and Stedi.

GitGuardian Platform includes automated secrets detection and remediation. By reducing the risks of secrets exposure across the SDLC, GitGuardian helps software-driven organizations strengthen their security posture and comply with frameworks and standards.

Its detection engine is trained against more than a billion public GitHub commits every year, and it covers 350+ types of secrets such as API keys, database connection strings, private keys, certificates, and more.

GitGuardian brings security and development teams together with automated remediation playbooks and collaboration features to resolve incidents fast and in full. By pulling developers closer to the remediation process, organizations can achieve higher incident closing rates and shorter fix times.

The platform integrates across the DevOps toolchain, including native support for continuously scanning VCS platforms like GitHub, Gitlab, Azure DevOps and Bitbucket or CI/CD tools like Jenkins, CircleCI, Travis CI, GitLab pipelines, and many more. It also integrates with ticketing and messaging systems like Splunk, PagerDuty, Jira and Slack to support teams with their incident remediation workflows. GitGuardian is offered as a SaaS platform but can also be hosted on-premise for organizations operating in highly regulated industries or with strict data privacy requirements.

GitGuardian

IBM Security AppScan enhances web application security and mobile application security, improves application security program management and strengthens regulatory compliance. By scanning your web and mobile applications prior to deployment, AppScan enables you to identify security vulnerabilities and generate reports and fix recommendations.

HCLSoftware

Sample Customers

Automox, 66degrees (ex Cloudbakers), Iress, Now:Pensions, Payfit, Orange, BouyguesTelecom, Seequent, Stedi, Talend, Snowflake...

Essex Technology Group Inc., Cisco, West Virginia University, APIS IT

Buyer's Guide

GitGuardian Platform vs. HCL AppScan

April 2025

Free Report: GitGuardian Platform vs. HCL AppScan

Find out what your peers are saying about GitGuardian Platform vs. HCL AppScan and other solutions. Updated: April 2025.

DOWNLOAD NOW

846,617 professionals have used our research since 2012.

See our GitGuardian Platform vs. HCL AppScan report.

See our list of best Application Security Tools vendors and best Static Application Security Testing (SAST) vendors.

We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.