We performed a comparison between HCL AppScan and Sonarqube based on our users’ reviews in four categories. After reading all of the collected data, you can find our conclusion below.
Comparison Results: Sonarqube offers better integration capabilities than HCL AppScan. Additionally, Sonarqube users are happier with the pricing. For these reasons, Sonarqube is the more desirable product in this comparison.
"I like the recording feature."
"There's extensive functionality with custom rules and a custom knowledge base."
"The UI was very intuitive."
"It's generally a very user-friendly tool. Anyone can easily learn how to scan"
"The most valuable feature of the solution is the scanning or security part."
"The static scans are good, and the SaaS as well."
"It identifies all the URLs and domains on its own and then performs tests and provides the results."
"It provides a better integration for our ecosystem."
"SonarQube is one of the more popular solutions because it supports 29 languages."
"I like that it covers most programming languages for source code review."
"This has improved our organization because it has helped to find Security Vulnerabilities."
"It has very good scalability and stability."
"The most valuable features are the wide array of languages, multiple languages per project, the breakdown of bugs, and the description of vulnerabilities and code smells (best practices)."
"The static code analysis is very good."
"We advise all of our developers to have this solution in place."
"The stability is good."
"If HCL AppScan is able to alert the clients over email once the scan is complete, it would be great. Right now, HCL AppScan doesn't let me know if the scanning part is finished or not, because of which I have to come back and check mostly."
"The penetration testing feature should be included."
"In future releases, I would like to see more aggressive reports. I would also like to see less false positives."
"We have experienced challenges when trying to integrate this solution with other products. When you compare it with the other SecOps products, the quality of the output is too low. It is not a new-age product. It is very outdated."
"The pricing has room for improvement."
"The tool should improve its output. Scanning is not a challenge anymore since there are many such tools available in the market. The product needs to focus on how its output is being used by end users. It should be also more user-friendly. One of the major challenges is in the tool's integration with applications that need to be scanned. Sometimes, the scanning is not proper."
"The solution needs to improve in some areas. The tool needs to add more languages. It also needs to improve its speed."
"There are so many lines of code with so many different categories that I am likely to get lost. "
"The handling of the contents of Docker container images could be better."
"We could use some team support, but since we are using the community version, it's not available."
"SonarQube could be improved with more dynamic testing—basically, now, it's a static code analysis scan. For example, when the developer writes the code and does the corresponding unit test, he can cover functional and non-functional. So the SonarQube could be improved by helping to execute unit tests and test dynamically, using various parameters, and to help detect any vulnerabilities. Currently, it'll just give the test case and say whether it passes or fails—it won't give you any other input or dynamic testing. They could use artificial intelligence to build a feature that would help developers identify and fix issues in the early stages, which would help us deliver the product and reduce costs. Another area with room for improvement is in regard to automating things, since the process currently needs to be done manually."
"We're in the process of figuring out how to automate the workflow for QA audit controls on it. I think that's perhaps an area that we could use some buffing. We're a Kubernetes shop, so there are some things that aren't direct fits, which we're struggling with on the component Docker side. But nothing major."
"The product's user documentation can be vastly improved."
"SonarQube can improve by scanning the internal library which currently it does not do. We are looking for a solution for this."
"The security in SonarQube could be better."
"It requires advanced heuristics to recognize more complex constructs that could be disregarded as issues."
HCL AppScan is ranked 14th in Application Security Tools with 39 reviews while SonarQube is ranked 1st in Application Security Tools with 108 reviews. HCL AppScan is rated 7.6, while SonarQube is rated 8.0. The top reviewer of HCL AppScan writes " A stable and scalable product useful for application security scanning". On the other hand, the top reviewer of SonarQube writes "Easy to integrate and has a plug-in that supports both C and C++ languages". HCL AppScan is most compared with Veracode, Acunetix, OWASP Zap, PortSwigger Burp Suite Professional and Fortify WebInspect, whereas SonarQube is most compared with Checkmarx, SonarCloud, Coverity and Veracode. See our HCL AppScan vs. SonarQube report.
See our list of best Application Security Tools vendors and best Application Security Testing (AST) vendors.
We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.