What you are evaluating
Product SKU sprawl is the main teaching hazard: Standard, Enterprise, Source, on Cloud, and 360° are not interchangeable. Correlation of SAST and DAST, and whether self-managed air-gap actually matches the needed engines, must be proven per SKU.
A useful evaluation context
A plausible evaluation context is a regulated team that needs self-managed or sovereign analysis and must map HCL AppScan SKUs rather than assuming one family name includes every engine.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Static, dynamic, and interactive application testing in the AppScan family.
- Composition analysis, application-programming-interface checks, secrets, containers, and infrastructure-as-code scanning as vendor-described modules.
- Cloud and self-managed 360° deployment choices, including air-gap and sovereign options to confirm per SKU.
Where it fits in the work
- Name the exact AppScan SKU and deployment (cloud versus self-managed) before enabling engines, so air-gap expectations are not taken from a different product line.
- Run static analysis on lab source or binaries, then DAST or interactive testing only against non-production instances.
- Correlate SAST and DAST on the same seeded issue and retain evidence of which SKU produced each result.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
Using the specific HCL AppScan SKU you can run, analyze a synthetic app you own with a seeded static weakness and a staging-only runtime issue. Keep air-gap or cloud constraints matching the intended deployment.
Evidence to look for
Both issue classes appear in the entitled SKU or the missing engine is documented, DAST did not target production, and correlation or its absence is visible in the evidence pack.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which SKU is actually licensed: Standard, Enterprise, Source, on Cloud, or 360°?
- Does the self-managed path meet air-gap or sovereign constraints for this organization?
- Can SAST and DAST results be correlated on the same finding, or do they remain separate queues?
Names you may encounter: AppScan 360 · AppScan on Cloud. Historical names do not establish current availability or feature equivalence.