HCL AppScan vs. Mobile Security Framework (MobSF)

In HCL AppScan automation maintain a reasonable pace of review and remediation of flaws for our apps. HCL AppScan is a cloud-based enterprise mobile application security testing solution for Android and iOS applications developed using Java, .Net or Objective-C. So it covers all our area and It consists of three components: AppScan Source Edition for developing and testing apps internally, AppScan Standard Edition for testing internally or externally, and AppScan Enterprise Edition for large enterprises who need to secure their entire mobile application portfolio across the organization with multiple device types.

Incentivized

MobSF is good for checking for vulnerabilities in your app. It will also give suggestions on how to address them. Another thing is can do is find code that may be incorrect. It is not, however, a substitute for a system that actually checks your code for proper use. It really is concentrated on security.

Incentivized

• AppScan works well in finding application vulnerabilities such as SQL injection, cross-site scripting and all of the OWASP top 10.
• Flexible reporting allows us to generate executive reports for application owners as well as separate technical reports for developers and system engineers.
• Technical reports include remediation information and cross reference CVSS scores
• Because it maintains data on all repeated assessments it helps us to do trending and metrics on compliance

Incentivized

• Scan for vulnerabilities
• Scan for bad coding
• Give suggestions on fixes for security issues

Incentivized

• It can have a FAQ session in the Application itself.
• It can recommend the fix for the error that occurred during the scan.
• Like its storing multiple manuals explore, It should have the capability of storing multiple logins.

Incentivized

• The UI is not that user friendly
• The documentation could be easier to understand
• An easier method of deploying MobSF would be appreciated

Incentivized

Both solutions are decent, however, I had team members who had the experience working with HCL AppScan. Also, the product was priced nominally which suited our budget. Further, HCL AppScan's user community was bigger and many learning resources were freely available which helped junior peers learn quickly and eliminate any issues

Incentivized

In my opinion, MobSF is not as comprehensive as SonarQube. Both, however, do a very good job in scanning your code for vulnerabilities. Both do roughly the same things. The reports of SonarQube are more detailed though. The advantage that MobSF has over SonarQube is the price. One is free while the other is a paid solution (with several tiers). However, we use them together to get a more comprehensive scan.

Incentivized

• There are countless implementations to accomplish the same thing, and so many configurations are required.
• Even if you test it finished and find no vulnerabilities, there is no point if you just get the error screen.
• Until now, I was worried about vulnerabilities and security in software development, but I think it was good to find the vulnerability problem quickly with HCL AppScan.

Incentivized

• It has allowed our apps to pass a security vetting requirement of a third party to deploy our app
• We can see where we can improve on the development of our app
• The deployment can take a while, especially with teams not familiar with the software

Incentivized