HCL AppScan vs SonarQube Server (formerly SonarQube) comparison

HCL AppScan vs. SonarQube Server (formerly SonarQube)

Download the complete report

Helped 814,528 peers since 2012

Categories and Ranking

HCL AppScan

Ranking in Application Security Tools

13th

Ranking in Static Application Security Testing (SAST)

12th

Average Rating

7.8

Number of Reviews

Ranking in other categories

Dynamic Application Security Testing (DAST) (1st)

SonarQube Server (formerly ...

Ranking in Application Security Tools

1st

Ranking in Static Application Security Testing (SAST)

1st

Average Rating

8.0

Number of Reviews

113

Ranking in other categories

Software Development Analytics (1st)

Mindshare comparison

As of November 2024, in the Application Security Tools category, the mindshare of HCL AppScan is 2.6%, down from 2.8% compared to the previous year. The mindshare of SonarQube Server (formerly SonarQube) is 26.7%, down from 27.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools

Featured Reviews

Gladwin Christian

QA manager at SmartStream Technologies ltd.

Sep 29, 2023

A useful tool to scan applications that can be easily installed

Given that we have been using HCL AppScan for many years, I think the setup process is not difficult at all. Sometimes, some issues stop or prevent my company from moving forward with the product's setup phase. We have to call HCL's support team and engage in long discussions to smoothly carry out the setup phase. In general, the product's setup phase is not difficult in our company. The solution is deployed on an on-premises model. The licenses for the solution are available only on cloud deployments nowadays. The solution is already installed in our environment. Every time a new release or software comes out from HCL, our company does a scan, which takes maybe a day or two.

Read full review

Wang Dayong

Senior Software Engineering Manager at Hill

May 10, 2023

Easy to integrate and has a plug-in that supports both C and C++ languages

We use the product to review our software codes. We have integrated the product to review our new delivery code When we deliver a code, the solution scans the code and reports whether the code has bugs or any other vulnerability issues. Thus the solution helps us identify issues and improve the…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The security and the dashboard are the most valuable features."

"You can easily find particular features and functions through the UI."

"For me, as a manager, it was the ease of use. Inserting security into the development process is not normally an easy project to do. The ability for the developer to actually use it and get results and focuses, that's what counted."

"This solution saves us time due to the low number of false positives detected."

"The platform has valuable security features, helping us identify sensitive code issues and the possibility of internal applications' exposure to external threats."

"The static scans are good, and the SaaS as well."

"It comes with all of the templates that we need. For example, we are a company that is regulated by PCI. In order to be PCI compliant, we have a lot of checks and procedures to which we have to comply."

"It's generally a very user-friendly tool. Anyone can easily learn how to scan"

More HCL AppScan pros

"This solution has helped with the integration and building of our CICD pipeline."

"The tool helps us to monitor and manage violations. It manages the bugs and security violations."

"The product itself has a friendly UI."

"There are many options and examples available in the tool that help us fix the issues it shows us."

"Using SonarQube benefits us because we are able to avoid the inclusion of malware in our applications."

"This has improved our organization because it has helped to find Security Vulnerabilities."

"Before you even compile, it can catch known vulnerability issues or patterns."

"Apart from the security point of view, I like that it makes it easy to detect code smells and other issues in terms of code quality and standards."

More SonarQube Server (formerly SonarQube) pros

Cons

"Improvement can be done as per customer requirements."

"I would love to see more containers. Many of the tools are great, they require an amount of configuration, setup and infrastructure. If most the applications were in a container, I think everything would be a little bit faster, because all our clients are now using containers."

"We have experienced challenges when trying to integrate this solution with other products. When you compare it with the other SecOps products, the quality of the output is too low. It is not a new-age product. It is very outdated."

"The pricing has room for improvement."

"HCL AppScan needs to improve security."

"They have to improve support."

"There is room for improvement in the pricing model."

"One thing which I think can be improved is the CI/CD Integration"

More HCL AppScan cons

"Code security could be better. They are already focusing on it, but I see a lot of improvement opportunities over there. I can see a lot of false positives in terms of security. They need to make the tests more accurate so that the false positives are not detected so frequently. It would also help if they provided us with an installer."

"We found a solution with dynamic testing, and are looking to find a solution that can be used for both types of testing."

"I find it is light on the security side."

"There needs to be a shareable reporting piece or something we can click and generate easily."

"We did have some trouble with the LDAP integration for the console."

"The software testing tool capability could improve. It does not always integrate well. You have to use a specific plugin and the plugin does not always go in Apple's applications."

"Code security scanning could be improved."

"If the product could assist us with fixing issues by giving us more pointers then it would help to resolve more of the warnings without such a commitment in terms of time."

More SonarQube Server (formerly SonarQube) cons

Pricing and Cost Advice

"The price of HCL AppScan is okay, in my opinion. You just buy HCL AppScan and don't pay anything anymore, meaning it is just a one-time purchase."

"I would rate the product's pricing a nine out of ten. The product's pricing is expensive compared to the features that they offer."

"HCL AppScan is expensive."

"The product is moderately priced, though it's an investment due to extensive code analysis needs."

"Our clients are willing to pay the extra money. It is expensive."

"The solution is cheap."

"AppScan is a little bit expensive. IBM needs to work a little bit on the pricing model, decreasing the license cost."

"I rate the product's price a seven on a scale of one to ten, where one is low, and ten is high. HCL AppScan is an expensive tool."

More HCL AppScan pricing and cost advice

"We are using the Developer Edition and the cost is based on the amount of code that is being processed."

"It is very expensive. Its price should be improved."

"We use the tool's community edition."

"I am satisfied with the pricing."

"The solution is cheaper than other products."

"We're using the Community Edition, and we don't pay for anything."

"My guess is that we have a yearly subscription. We use it quite extensively, so a monthly license wouldn't make sense. Yearly subscriptions are usually cheaper. In addition to the standard licensing fee, there is just the cost of running the hardware where it is hosted."

"People can try the free licenses and later can seek buying plugins/support, etc. once they started liking it."

More SonarQube Server (formerly SonarQube) pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

814,528 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

18%

Financial Services Firm

14%

Manufacturing Company

11%

Government

Financial Services Firm

17%

Computer Software Company

15%

Manufacturing Company

13%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about HCL AppScan?

The most valuable feature of HCL AppScan is its integration with the SDLC, particularly during the coding phase.

What needs improvement with HCL AppScan?

They could incorporate AI to enhance vulnerability detection and improve the product's reporting capabilities.

What is your primary use case for HCL AppScan?

We use AppScan primarily for security testing and performance monitoring across our systems.

Is SonarQube the best tool for static analysis?

I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...

Fortify on Demand vs HCL AppScan

Comparisons

Acunetix vs HCL AppScan

Compared 14% of the time

Veracode vs HCL AppScan

Compared 11% of the time

Compared 8% of the time

PortSwigger Burp Suite Professional vs HCL AppScan

Compared 7% of the time

OWASP Zap vs HCL AppScan

Compared 7% of the time

More HCL AppScan Competitors

Checkmarx One vs SonarQube Server (formerly SonarQube)

Compared 17% of the time

Coverity vs SonarQube Server (formerly SonarQube)

Compared 12% of the time

SonarQube Cloud (formerly SonarCloud) vs SonarQube Server (formerly SonarQube)

Compared 12% of the time

GitHub Advanced Security vs SonarQube Server (formerly SonarQube)

Compared 9% of the time

Veracode vs SonarQube Server (formerly SonarQube)

Compared 9% of the time

More SonarQube Server (formerly SonarQube) Competitors

Product Reports

HCL AppScan

Download HCL AppScan product report

SonarQube Server (formerly SonarQube)

Download SonarQube Server (formerly SonarQube) product report

SonarQube Server (formerly SonarQube) report

Also Known As

IBM Security AppScan, Rational AppScan, AppScan

Sonar

Learn More

HCLSoftware

Sonar

Interactive Demo

Demo not available

HCLSoftware

Sonar

Overview

IBM Security AppScan enhances web application security and mobile application security, improves application security program management and strengthens regulatory compliance. By scanning your web and mobile applications prior to deployment, AppScan enables you to identify security vulnerabilities and generate reports and fix recommendations.

SonarQube Server enhances code quality and security via static code analysis. It detects vulnerabilities, improves standards, and reduces technical debt, integrating into CI/CD pipelines.

SonarQube Server is a comprehensive tool for enhancing code quality and security. It offers static code analysis to identify vulnerabilities, improve coding standards, and reduce technical debt. By integrating into CI/CD pipelines, it provides automated checks for adherence to best practices. Organizations use it for code inspection, security testing, and compliance, ensuring development environments with better maintainability and fewer issues.

What are the key features of SonarQube Server?

Support for 20+ languages: Extensive programming language support suitable for diverse coding environments.
Custom coding rules: Allows for tailored rule sets to match specific coding standards.
Flexible quality gates: Define criteria for code acceptance at various intervals.
CI/CD integration: Seamless integration with Continuous Integration/Continuous Deployment tools.
Rich interface: User-friendly dashboard with detailed visual insights.

What benefits should users expect from SonarQube Server?

Improved code quality: Enhanced analysis contributes to fewer bugs and improved coding practices.
Security enhancements: Identifies and mitigates security vulnerabilities pre-emptively.
Maintainability: Reduces technical debt, yielding long-term development efficiency.
Customizable: Flexibility in configuration aligns with specific project needs.

Many industries implement SonarQube Server to uphold coding standards, maintain security protocols, and streamline their software development lifecycle. In sectors like finance and healthcare, adhering to regulations and ensuring reliable software is critical, making SonarQube Server invaluable. It is often integrated into CI/CD pipelines, ensuring that code changes meet set standards before deployment. This approach enhances productivity and maintains compliance with industry-specific requirements.

Sample Customers

Essex Technology Group Inc., Cisco, West Virginia University, APIS IT

Information Not Available

HCL AppScan vs. SonarQube Server (formerly SonarQube)