HCL SW Blogs
Select Page


In a recent Technical Review of HCL AppScan, analyst firm Enterprise Strategy Group (ESG) evaluated and analyzed how AppScan helps developers to continuously secure applications. ESG also evaluated how AppScan can easily be integrated into CI/CD pipelines and support DevSecOps initiatives, to provide organizations with continuous application security at scale.  

ESG’s Methodology 

To thoroughly evaluate AppScan’s application security testing capabilities, ESG followed the general steps that are outlined below: 

  1. ESG defined and associated security policies with an applicationusing HCL AppScan on Cloud’s user interface.  
  2. Then, ESG associated security policies with the application.  
  3. Next, ESG evaluated AppScan’s scan and analyze capabilities, by integrating AppScan into a DevSecOps toolchain 
  4. After evaluating AppScan’s “scan and analyze” capabilities, ESG created a manual dynamic scan and reviewed scan results using the AppScan console.  
  5. Finally, ESG evaluated AppScan’s reporting capabilities 

AppScan’s Impact on DevSecOps  

ESG found that AppScan integrated into four main aspects of DevSecOps:  apps

  • Policy definition, where security and regulatory professionals define and associate policies with an application.  
  • Scan and analyze, when developers use static analysis to “shift security left,” so that they can identify vulnerabilities in code early in their CI/CD pipelines. Dynamic and interactive testing similarly help developers to identify vulnerabilities in running applications.  
  • Vulnerability Remediation, the process that permits developers to review and fix vulnerabilities. ESG found that AppScan’s machine learning accelerated remediation by grouping and prioritizing related vulnerabilities and by identifying potential fixes and fix locations in source code.  
  • Reporting, a key component of the DevSecOps process, where security and regulatory professionals and organizational management can continuously monitor their security and compliance progress.  

You can review all of ESG’s key findings- including benefits that you can achieve by incorporating AppScan into a DevSecOps model- by downloading the complimentary report now.  

Why Application Security Matters to You  

In the closing “Why This Matters” section of its report, ESG summarized the benefits of an effective Application Security Testing program, which I’ve captured verbatim below:  

Integrating and automating application security testing into the DevSecOps methodology enables the identification and correction of cybersecurity vulnerabilities earlier in the application development lifecycle, which enhances security and increases efficiency. It also helps to alleviate challenges faced by skilled cybersecurity teams, which are often much smaller than development teams, as they try to keep up with the increasing pace DevSecOps demands. 

ESG validated that HCL AppScan simplified and accelerated application security testing. With just a few clicks, ESG defined security policies and configured AppScan to test our application for a set of security vulnerabilities and compliance with benchmarks and regulations. ESG found configuring and running on-demand scans to be just as quick and easy, and results from static and dynamic analysis were presented quickly in a concise and consistent interface. 

To Learn More

In addition to downloading ESG’s complete reportyou can watch my companion video with ESG analyst Dave Gruber, where Dave and I spotlight the elements of a truly state-of-the-art Application Security Testing solution.  

Comment wrap
Further Reading
HCL AppScan Standard Reinvents the Configuration UI in Version 10.2.0
Secure DevOps | April 6, 2023
HCL AppScan Standard Reinvents the Configuration UI in Version 10.2.0
Chek out what's new with AppScan Standard, a DAST (Dynamic Application Security Testing) tool designed for security experts and pen-testers that automatically crawls target applications and APIs and tests them for vulnerabilities.
OWASP Global AppSec Dublin 2023
Secure DevOps | March 13, 2023
What you missed at OWASP Global AppSec Dublin 2023
See what you missed at OWASP Global AppSec Dublin 2023. HCLSoftware has the scoop.
Filters result by