AppScan (formerly Rational AppScan) is an application security testing solution acquired by HCL Technologies from IBM in late 2018. Appscan supports both dynamic (DAST) and static (SAST) application security testing.
N/A
Pentest-Tools.com
Score 7.0 out of 10
N/A
Pentest-Tools.com helps security professionals find, validate, and communicate vulnerabilities, whether they’re internal teams defending at scale, MSPs juggling clients, or consultants under pressure. The service provides coverage across network, web, API, and cloud assets, and includes built-in exploit validation to turn every scan into credible, actionable insight. Boasting users among over 2,000 teams in 119 countries for use…
$95
per month
Tanium
Score 9.2 out of 10
N/A
Tanium delivers Autonomous Endpoint Management (AEM) with the goal of allowing security-conscious organizations to break down silos between IT and Security operations that results in reduced complexity, cost, and risk.
In HCL AppScan automation maintain a reasonable pace of review and remediation of flaws for our apps. HCL AppScan is a cloud-based enterprise mobile application security testing solution for Android and iOS applications developed using Java, .Net or Objective-C. So it covers all our area and It consists of three components: AppScan Source Edition for developing and testing apps internally, AppScan Standard Edition for testing internally or externally, and AppScan Enterprise Edition for large enterprises who need to secure their entire mobile application portfolio across the organization with multiple device types.
This website is well suited for organisations that perform regular security assessments. In particular, external scans and reconnaissance. As an example, I am able to run a report on our Wordpress website to enable me to see whether we are missing any important security updates. We found it to be very useful for training new security analysts, due to the straightforward GUI. You can work on the same projects together to help you to do this. Having it laid out in front of them helps them to understand the concepts much easier than using dozens of different tools to achieve the same goals, and also speeds up training. If you're a personal user it may not be appropriate due to price. If you are a personal user, I would advise using the many open source tools there are that do the same things. The strength of this platform is that it combines them into a single pane of glass, but you can achieve the same things with other tools if necessary. For example, there are many other tools that you could use to run a UDP port scan that do not cost money (EG NMAP)
Tanium is well suited for organizations where enterprise infrastructure has great significance and needs to be properly managed as well as protected. Most organizations depend upon their infrastructure to sustain so Tanium can be a boon for them to sustain in this competitive market. However, Tanium is less appropriate for the traditional offices that don't have or have a less online presence.
AppScan works well in finding application vulnerabilities such as SQL injection, cross-site scripting and all of the OWASP top 10.
Flexible reporting allows us to generate executive reports for application owners as well as separate technical reports for developers and system engineers.
Technical reports include remediation information and cross reference CVSS scores
Because it maintains data on all repeated assessments it helps us to do trending and metrics on compliance
No logging for things like scanning. This means you don't actually know when the scan has failed if you're not immediately on the ball.
Reports could look better. It would be good to be able to customise the report with some different styles to suit your company's branding.
Could have better tutorials.
It may be useful to have a feature similar to Microsoft Secure Score, which compares your organisation to similar ones, so that you have a reference of how secure your environment actually is.
One issue is its ring topology, as the data is stored in central hubs and pushed through its peer nodes. If the central hub fails, then the associated node will also result in failure.
Another problem is that all Tanium management is on premises requiring the customer to maintain it. If we want ask any help from Tanium support we always get a response like "you are maintaining it yourselves and it's your responsibility.
The Tanium User Interface could be improved a bit as, although the tool is rich in performance, a more impressive UI might really attract new customers.
Both solutions are decent, however, I had team members who had the experience working with HCL AppScan. Also, the product was priced nominally which suited our budget. Further, HCL AppScan's user community was bigger and many learning resources were freely available which helped junior peers learn quickly and eliminate any issues
Offers a great number of tools in one interface, giving you a single pane of glass to work from. Therefore, it's favourable compared to some of these other products, that do similar things but are less intuitive and less easy to use. This makes it not only easier to use, but easier to report results to your customers. Also, although the price point can seem high, once you start adding multiple paid tools that do the same job, there probably isn't a massive amount of difference (if any)
Tanium is always my first choice, so much excellent feedback online from genuine users, easy to use in any system environment, and value for money, so many good things about Tanium stacks up against all the other competitors in the market. Tanium is one of the most reliable and trusted risk and compliance management software.
There are countless implementations to accomplish the same thing, and so many configurations are required.
Even if you test it finished and find no vulnerabilities, there is no point if you just get the error screen.
Until now, I was worried about vulnerabilities and security in software development, but I think it was good to find the vulnerability problem quickly with HCL AppScan.
