HCL AppScan Source

What HCL AppScan Source is

HCL AppScan Source is a static application security testing product that examines source code for vulnerabilities early in development. HCL presents it for AppSec program managers, security analysts, and development teams, with use as a desktop application, IDE plugin, or automation tool. Intelligent Finding Analytics and Intelligent Code Analytics broaden code coverage, reduce false positives, and draw attention to critical issues; HCL says Intelligent Finding Analytics can reduce false positives by up to 98%. The product can identify and prioritize secrets and misconfigurations in Infrastructure as Code files. Scanning, storage, and analysis can remain entirely inside a customer’s infrastructure. AppScan Source supports a broad set of programming languages and includes a bring-your-own-language capability. Documented IDE integrations include Eclipse, JetBrains IDEs, Microsoft Visual Studio, and Visual Studio Code, while Ounce/Maven is listed for continuous integration and delivery pipelines. Compliance reports cover CWE Top 25, DISA Application Security and Development STIG, OWASP Top 10, OWASP Mobile 10, OWASP API 10, and PCI DSS. Installation runs on Windows and Linux. HCL says macOS and iOS Xcode project scanning have not been supported since version 9.0.3.11, and Windows 10 and Windows Server 2016 are not supported as of version 10.11.0.

Who it suits

AppScan Source fits AppSec program managers, security analysts, and development teams responsible for source-code security. It suits organizations that want desktop, IDE, or automated scanning while keeping analysis within their own infrastructure.

Limits

Pricing is not published for either the Per Authorized User or Per Floating User plans. macOS and iOS Xcode project scanning are unsupported, and Windows 10 and Windows Server 2016 are unsupported as of AppScan Source 10.11.0.

Getting started

1. Review HCL product documentation and system requirements
2. Choose an authorized-user or floating-user SAST license
3. Install the wizard on Windows or Linux
4. Use AppScan Source as a desktop application, IDE plugin, or automation tool
5. Connect a supported IDE or Ounce/Maven pipeline

Verdict

Choose HCL AppScan Source if your security or development team needs source-code SAST with IDE and CI/CD integration, custom language support, and on-premises control. Its analytics and compliance reporting cover many listed security workflows. Consider another option if you require macOS or iOS Xcode project scanning, or need published pricing.