HCL AppScan vs SonarQube vs Trustwave App Scanner [EOL] comparison

Cancel
You must select at least 2 products to compare!
Comparison Buyer's Guide
Executive Summary

We performed a comparison between HCL AppScan, SonarQube, and Trustwave App Scanner [EOL] based on real PeerSpot user reviews.

Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Application Security Tools.
To learn more, read our detailed Application Security Tools Report (Updated: March 2024).
765,234 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"For me, as a manager, it was the ease of use. Inserting security into the development process is not normally an easy project to do. The ability for the developer to actually use it and get results and focuses, that's what counted.""We are now deploying less defects to production.""This is a stable solution.""Compared to other tools only AppScan supports special language.""The most valuable feature of the solution is the scanning or security part.""The product is useful, particularly in its sensitivity and scanning capabilities.""We use it as a security testing application.""The most valuable feature of the solution is Postman."

More HCL AppScan Pros →

"It helps our developers work more efficiently as we can identify things in a code prior to it being pushed to where it needs to go.""Before you even compile, it can catch known vulnerability issues or patterns.""Improve the code coverage and evaluates the technical steps and percentage of code being resolved.""Strong code evaluation for budget-minded clients.""We have the software metrics that SonarQube gives us, which is something we did not have before. This helps us work towards aiming coding standards to empower us to move in the direction of better code quality. SonarQube provides targets and metrics for that.""The software quality gate streamlines the product's quality.""Code Convention: Using the tool to implement some sort of coding convention is really useful and ensures that the code is consistent no matter how many contributors.""SonarQube has a lot of value, it reviews the basic coding standards and security vulnerabilities of code that help to reduce issues."

More SonarQube Pros →

"The stability is great. We haven't had any issues at all with it."

More Trustwave App Scanner [EOL] Pros →

Cons
"Scans become slow on large websites.""It has crashed at times.""If HCL AppScan is able to alert the clients over email once the scan is complete, it would be great. Right now, HCL AppScan doesn't let me know if the scanning part is finished or not, because of which I have to come back and check mostly.""We would like to integrate with some of the other reporting tools that we're planning to use in the future.""​IBM Security AppScan Source is rather hard to use​.""We would like to see a check in the specific vulnerabilities in mobile applications or rooted devices, such as jailbreaking devices.""The solution needs to improve in some areas. The tool needs to add more languages. It also needs to improve its speed.""The product has some technical limitations."

More HCL AppScan Cons →

"When we have a thousand products published over it, we expect it to be more efficient in terms of serving requests from the browser.""We called support and complained but have not received any information as we use the free version. We had to fix it on our own and could not escalate it to the tool's developer.""We're in the process of figuring out how to automate the workflow for QA audit controls on it. I think that's perhaps an area that we could use some buffing. We're a Kubernetes shop, so there are some things that aren't direct fits, which we're struggling with on the component Docker side. But nothing major.""A better design of the interface and add some new rules.""SonarQube could improve by adding automatic creation of tasks after scanning and more support for the Czech language.""The product's pricing could be lower.""The software testing tool capability could improve. It does not always integrate well. You have to use a specific plugin and the plugin does not always go in Apple's applications.""Their dashboarding is very limited. They can improve their dashboards for multiple areas, such as security review, maintainability, etc. They have all this information, so they should publish all this information on the dashboard so that the users can view the summary and then analyze it further. This is something that I would like to see in the next version."

More SonarQube Cons →

"I would like to see a little more flexibility with regards to setting up profiles for vulnerabilities."

More Trustwave App Scanner [EOL] Cons →

Pricing and Cost Advice
  • "AppScan is a little bit expensive. IBM needs to work a little bit on the pricing model, decreasing the license cost."
  • "With the features, that they offer, and the support, they offer, AppScan pricing is on a higher level."
  • "Pricing was the main reason that we went ahead with this solution as they were the lowest in the market."
  • "HCL AppScan is expensive."
  • "I would rate the product's pricing a nine out of ten. The product's pricing is expensive compared to the features that they offer."
  • "The price is very expensive."
  • "The solution is moderately priced."
  • "The price of HCL AppScan is okay, in my opinion. You just buy HCL AppScan and don't pay anything anymore, meaning it is just a one-time purchase."
  • More HCL AppScan Pricing and Cost Advice →

  • "This is open source."
  • "We did not purchase a license (required for C++ support), but this option was considered."
  • "Get the paid version which allows the customized dashboard and provides technical support."
  • "People can try the free licenses and later can seek buying plugins/support, etc. once they started liking it."
  • "This product is open source and very convenient."
  • "The licence is standard open source licensing"
  • "The price point on SonarQube is good."
  • "Some of the plugins that were previously free are not free now."
  • More SonarQube Pricing and Cost Advice →

    Information Not Available
    report
    Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
    765,234 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:The product has valuable features for static and dynamic testing.
    Top Answer:HCL AppScan generates false results. Sometimes, it incorrectly identifies requests as vulnerable when they are not… more »
    Top Answer:HCL AppScan efficiently scans through the website and identifies vulnerabilities for AWS. It is reducing tools day by… more »
    Top Answer:I am not very familiar with SonarQube and their solutions, so I can not answer But if you are asking me about which… more »
    Top Answer:SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis… more »
    Top Answer:We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security… more »
    Ask a question

    Earn 20 points

    Ranking
    Views
    5,763
    Comparisons
    4,452
    Reviews
    17
    Average Words per Review
    339
    Rating
    7.2
    Views
    57,256
    Comparisons
    45,052
    Reviews
    18
    Average Words per Review
    397
    Rating
    8.0
    Unranked
    In Application Security Tools
    Comparisons
    Also Known As
    IBM Security AppScan, Rational AppScan, AppScan
    Sonar
    Hailstorm, Cenzic Hailstorm
    Learn More
    Interactive Demo
    HCLTech
    Demo Not Available
    Trustwave
    Demo Not Available
    Overview

    IBM Security AppScan enhances web application security and mobile application security, improves application security program management and strengthens regulatory compliance. By scanning your web and mobile applications prior to deployment, AppScan enables you to identify security vulnerabilities and generate reports and fix recommendations.

    SonarQube is a self-managed open-source platform that helps developers create code devoid of quality and vulnerability issues. By integrating seamlessly with the top DevOps platforms in the Continuous Integration (CI) pipeline, SonarQube continuously inspects projects across multiple programming languages, providing immediate status feedback while coding. SonarQube’s quality gates become part of your release pipeline, displaying pass/fail results for new code based on quality profiles you customize to your company standards. Following Sonar’s Clean as You Code methodology guarantees that only software of the highest quality makes it to production.

    At its core, SonarQube includes a static code analyzer that identifies bugs, security vulnerabilities, hidden secrets, and code smells. The platform guides you through issue resolution, fostering a culture of continuous improvement. SonarQube’s comprehensive reporting is a valuable tool for dev teams to monitor their codebase's overall health and quality across multiple projects in their portfolio. With SonarQube, you can achieve a state of Clean Code, leading to secure, reliable, and maintainable software.

    Sonar is the only solution combining the power of industry-leading software quality analysis with static application security testing (SAST) and real-time coding guidance in the IDE (with SonarLint) to meet the DevOps and DevSecOps demand of putting agility, automation, and security in the hands of developers. Further accelerate DevOps continuous integration by helping developers find and fix issues in code before the software testing stage, reducing the churn of finding, fixing, rebuilding, and retesting your app.

    With over 5,000 Clean Code rules, SonarQube analyzes 30+ of the most popular programming languages, including dozens of frameworks, the top DevOps platforms (GitLab, GitHub, Azure DevOps, and Bitbucket, and more), and the leading infrastructure as code (IaC) platforms.

    SonarQube is the most trusted static code analyzer used by over 7 million developers and 400,000 organizations globally to clean over half a trillion lines of code.

    Provides ability to test applications for security vulnerabilities, security policies and regulatory compliance.
    Sample Customers
    Essex Technology Group Inc., Cisco, West Virginia University, APIS IT
    Leading Health Insurer
    Top Industries
    REVIEWERS
    Government16%
    Transportation Company16%
    Manufacturing Company11%
    Insurance Company11%
    VISITORS READING REVIEWS
    Computer Software Company19%
    Financial Services Firm14%
    Government10%
    Manufacturing Company8%
    REVIEWERS
    Computer Software Company30%
    Financial Services Firm21%
    Comms Service Provider7%
    Insurance Company6%
    VISITORS READING REVIEWS
    Financial Services Firm17%
    Computer Software Company15%
    Manufacturing Company11%
    Government6%
    No Data Available
    Company Size
    REVIEWERS
    Small Business25%
    Midsize Enterprise11%
    Large Enterprise64%
    VISITORS READING REVIEWS
    Small Business17%
    Midsize Enterprise13%
    Large Enterprise70%
    REVIEWERS
    Small Business25%
    Midsize Enterprise15%
    Large Enterprise60%
    VISITORS READING REVIEWS
    Small Business17%
    Midsize Enterprise13%
    Large Enterprise71%
    No Data Available
    Buyer's Guide
    Application Security Tools
    March 2024
    Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Application Security Tools. Updated: March 2024.
    765,234 professionals have used our research since 2012.