We use DerScanner to support our secure code review and SAST services. Its broad language support, reliable static analysis, and actionable findings help our consultants deliver consistent, high-quality security assessments. DerScanner has become a valuable part of our application security portfolio and helps us provide greater value to our customers.
Poom S.Chief Operational Officer, E-CQURITY (Thailand) Co., Ltd.SAST, DAST, SCA, MAST
SAST, DAST, IAST, SCA
DerScanner analyzes .exe, .dll, .apk and .ipa files directly. HCL AppScan static analysis accepts Java bytecode and .NET assemblies, and scans C/C++ from source or Visual Studio solutions.
Solidity and Vyper, along with LotusScript, are absent from the HCL AppScan language list.
DerScanner vs HCL AppScan
DerCodeFix recovers source from compiled Java and suggests a safe change. Several variants can be produced for the same finding.
Business platform code and office macros are covered next to Kotlin, Swift and TypeScript.
Published .apk and .ipa packages are analyzed statically, which helps assess apps from partners and contractors.
DerScanner searches for undocumented features and inspects obfuscated fragments for vulnerabilities.
Supply Chain Security rates authorship, popularity and credibility, and tracks how quickly the community responds.
DerTriage attaches an explanation to every verdict so a reviewer can accept or reject it. Processing stays on DerScanner hardware.
Reentrancy in Vault.sol:54
TRUE POSITIVEAn external call transfers funds before the balance is set to zero.
Sources: HCL AppScan on Cloud static analysis language support page, September 2026.
| Capability | DerScanner | HCL AppScan |
|---|---|---|
| AI verification of findings | Yes | Yes |
| AI-generated code fixes | Yes | Yes |
| Capability | DerScanner | HCL AppScan |
|---|---|---|
| Vulnerability search in source code | Yes | Yes |
| Taint, semantic and control flow analysis | Yes | Yes |
| Undocumented feature search | Yes | No |
| Obfuscated code check | Yes | No |
| LotusScript, Solidity, Vyper | Yes | No |
| RPG, Classic ASP, ColdFusion | No | Yes |
| Infrastructure as code and container checks | Yes | Yes |
| Capability | DerScanner | HCL AppScan |
|---|---|---|
| JAR, WAR, EAR (Java) | Yes | Yes |
| EXE, DLL (C/C++) | Yes | No |
| APK (Android) | Yes | No |
| IPA (iOS) | Yes | No |
| APP (macOS) | Yes | No |
| Third-party software without source code | Yes | PartialJava bytecode and .NET assemblies |
| Capability | DerScanner | HCL AppScan |
|---|---|---|
| Known vulnerability analysis | Yes | Yes |
| License risk coverage | Yes | Yes |
| Capability | DerScanner | HCL AppScan |
|---|---|---|
| Web application DAST | Yes | Yes |
| OpenAPI specification import | Yes | Yes |
| URL exclusion and trigger filtering | Yes | Yes |
| Capability | DerScanner | HCL AppScan |
|---|---|---|
| Repository, CI/CD and issue tracker integrations | Yes | Yes |
| IDE plugins with inline findings | PartialEclipse, IntelliJ IDEA, Visual Studio plugins, findings outside the editor | Yes |
| DefectDojo integration | Partialvia SARIF | Yes |
| Compliance reports (OWASP Top 10, PCI DSS, CWE/SANS) | Yes | Yes |
| Capability | DerScanner | HCL AppScan |
|---|---|---|
| SaaS | Yes | Yes |
| On-premises | Yes | Yes |
| Installation wizard | No | Yes |
HCL AppScan data comes from HCL product documentation reviewed in September 2026.
AppScan remains the active scanner until each application runs in DerScanner. No release goes out untested during the move.
Plan a migrationBring a compiled application with no source code and review the findings together with the DerScanner team.
Prefer email? company@derscanner.com