# HCL AppScan: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 11 judge labels across 3 categories by 8 of 14 models. Page: https://www.gane.ai/index/it/vendors/hcl-appscan

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Dynamic application security testing](https://www.gane.ai/index/it/developer/dynamic-application-security-testing/index.md) | 0% | 39 | 25% | 8 |
| [Static application security testing](https://www.gane.ai/index/it/developer/static-application-security-testing/index.md) | 0% | 29 | 0% | 2 |
| [Software composition analysis](https://www.gane.ai/index/it/developer/software-composition-analysis/index.md) | 0% | 43 | 0% | 1 |

## What the models said for it

- "HCL AppScan: ~2% false positives (best in class)" (DeepSeek V4 Flash, DAST)
- "Legacy applications → HCL AppScan, Qualys WAS" (MiniMax M2.5, DAST)

## And against it

- "Only 4% positive recommendation rate with 14% negative labels in enterprise assessments" (DeepSeek V4 Flash, DAST)
- "Avoid for Mid-Market: Heavy legacy enterprise suites (e.g., Veracode DAST, HCL AppScan)" (Gemini 3.5 Flash, DAST)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 0 | 0 | 0 | 0 |
| GPT-5.4 mini | 0 | 0 | 0 | 0 | 0 |
| Gemini 3.5 Flash | 0 | 0 | 0 | 1 | 1 |
| Perplexity Sonar | 0 | 0 | 1 | 0 | 1 |
| Grok 4.20 | 0 | 0 | 2 | 0 | 2 |
| Mistral Small | 0 | 0 | 1 | 0 | 1 |
| DeepSeek V4 Flash | 0 | 1 | 0 | 1 | 2 |
| Llama 4 Maverick | 0 | 0 | 0 | 0 | 0 |
| Qwen 3.7 Flash | 0 | 0 | 0 | 0 | 0 |
| Kimi K2 | 0 | 0 | 1 | 0 | 1 |
| GLM 4.7 FlashX | 0 | 0 | 0 | 0 | 0 |
| MiniMax M2.5 | 0 | 1 | 0 | 0 | 1 |
| GPT-6 Luna | 0 | 0 | 0 | 0 | 0 |
| Muse Glimmer 30B | 0 | 0 | 2 | 0 | 2 |

## Sources returned with these answers

The sites and pages cited by the answers that named HCL AppScan, from 59 of the 61 answers that named it (only the models that return a source list).

### Domains cited

- safeguard.sh: 29
- checkmarx.com: 28
- invicti.com: 24
- aimultiple.com: 23
- g2.com: 22
- aikido.dev: 19
- softwaretestinghelp.com: 19
- escape.tech: 17
- appsecsanta.com: 16
- augmentcode.com: 14

### Pages cited

- https://aimultiple.com/dast-tools: 21
- https://softwaretestinghelp.com/dynamic-application-security-testing-dast-software: 19
- https://aikido.dev/blog/top-enterprise-dast-tools: 16
- https://checkmarx.com/learn/dast/dast-tools-key-features-and-12-solutions-to-know-in-2026: 16
- https://safeguard.sh/resources/blog/best-dast-tools-for-web-application-security-testing: 15
- https://augmentcode.com/tools/best-dast-tools-for-enterprise-security: 13
- https://escape.tech/blog/top-dast-tools: 12
- https://immuniweb.com/resources/best-dast-tools: 12

## In its own words

What HCL AppScan's own pages state, read 2026-10-05. Stated by the vendor, not checked by the index.

- Positioning: Scans for application vulnerabilities. (https://hcl-software.com/)
- For: Security & IT Compliance (https://hcl-software.com/)
- Free plan or trial: Start a free trial (https://www.hcl-software.com/legal/compliance)
- Customers named: Ipsen, Edison SPA, Penn Veterinary Supply, Augusta Sportswear

## What it publishes

Every page hcl-software.com exposes, read 2026-10-05: 12905 addresses. By kind, pages and the last 90 days:

- blog: 1870 pages, 47 in the last 90 days, latest 2026-09-29
- case study: 25 pages, 1 in the last 90 days, latest 2026-08-26
- webinar or virtual event: 17 pages, 0 in the last 90 days, latest 2025-10-10
- conference or event: 45 pages, 0 in the last 90 days, latest 2026-06-08
- report or ebook: 54 pages, 1 in the last 90 days, latest 2026-09-15
- comparison: 23 pages, 4 in the last 90 days, latest 2026-09-10
- template or tool: 14 pages, 1 in the last 90 days, latest 2026-07-07
- glossary or explainer: 18 pages, 4 in the last 90 days, latest 2026-09-16
- podcast or video: 1 pages, 0 in the last 90 days, latest 2023-08-02
- news or press: 166 pages, 1 in the last 90 days, latest 2026-09-01
- Recent: 2026-09-29 blog: Retail observability when peak season hits what breaks first https://www.hcl-software.com/blog/icontrol/retail-observability-when-peak-season-hits-what-breaks-first
- Recent: 2026-09-28 blog: Digital sovereignty is the uk sleeping on a strategic risk https://www.hcl-software.com/blog/hclsoftware/digital-sovereignty-is-the-uk-sleeping-on-a-strategic-risk
- Recent: 2026-09-28 blog: Hcl domino legacy it gds framework https://www.hcl-software.com/blog/domino/hcl-domino-legacy-it-gds-framework
- Recent: 2026-09-25 blog: Ai native full stack observability how to spot the real thing and avoid ai washing https://www.hcl-software.com/blog/hclsoftware/ai-native-full-stack-observability-how-to-spot-the-real-thing-and-avoid-ai-washing
- Recent: 2026-09-17 blog: Your move to hcl mosaic the phased migration path https://www.hcl-software.com/blog/mosaic/your-move-to-hcl-mosaic-the-phased-migration-path
- Recent: 2026-09-17 blog: Enterprise vibe coding from prototype to production https://www.hcl-software.com/blog/mosaic/enterprise-vibe-coding-from-prototype-to-production

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.