Compare
Against the tools you would otherwise use.
Three categories, not three vendors. Each is good at something AppScan is not, and the last row of every table says which. A comparison that only lists wins is an advertisement.
01A header checker
Against a header checker
A header checker makes one request to your home page and grades the response headers. It is useful, it is fast, and it stops at the first line of the story.
| Capability | A header checker | AppScan |
|---|---|---|
| Requests made | One, to the home page. | 84 read-only requests: GET, HEAD, OPTIONS and one TRACE. No bodies, no wordlists. |
| Headers | Presence of the usual handful. | 12 header rules that judge quality, not presence: a Content-Security-Policy that allows inline scripts fails.runtime.headers.csp-missing-or-unsafe |
| DNS and email | Not read. | A, AAAA, CNAME, NS, MX, TXT and CAA at the host and the apex; SPF, DMARC, MTA-STS, TLS-RPT, BIMI, eight DKIM selectors, DNSSEC over DNS-over-HTTPS.runtime.email.dmarc-missing |
| A real browser | No. | One Chromium load: every request the page makes, Core Web Vitals, third-party weight, JavaScript errors.browser.performance.web-vitals |
| Secrets in public JavaScript | No. | 15 provider-aware patterns; a publishable key is expected public and never reported as a leak.runtime.javascript.credential-exposed |
| Exposed files | No. | The .env file, the .git directory, backups, dumps and developer tools, read-only.runtime.exposure.sensitive-path-public |
| Subdomain takeover | No. | A dangling CNAME matched against hosting-provider fingerprints; nothing is ever claimed.runtime.dns.dangling-cname |
| What AppScan does not do | — | No TLS version probing (one handshake, chain trusted or not), no certificate-transparency lookup, nothing behind a login. |
02A SAST tool
Against a SAST tool
A static analyser reads code in many languages and reports every pattern it recognises. It does not know whether the pattern is reachable in production, or whether it was already there last week.
| Capability | A SAST tool | AppScan |
|---|---|---|
| Languages, deterministically | Many. | TypeScript and JavaScript only: ts, tsx, js, jsx, mjs, cjs. Intra-procedural taint through 18 sink kinds. |
| Other languages | Rules. | A model reads 37 file types - Python, Go, Java, Ruby, PHP, Rust among them - at no credit cost, and a lead is kept only if the symbol it names exists in the file.ai.source.* |
| Runtime evidence | None. | A code finding is confirmed live and carries the response that proves it; one problem is one finding.source.authorization.unguarded-mutating-route |
| Invariants | No. | 13 derived from your code, persisted per site, re-checked on every push.billing.prices-from-backend |
| Pull requests | Every finding on the branch. | NEW against UNCHANGED, with what the branch fixed; the base branch is never held against it.source.authorization.protection-removed |
| Dependencies | Sometimes. | 7 ecosystems, exact versions only, re-evaluated daily; framework advisories fire only when the feature is in use.source.framework.conditioned-advisory |
| Infrastructure | Rarely. | 38 rules for Dockerfile, Compose, nginx, Kubernetes, Terraform and GitHub Actions.infra.actions.untrusted-checkout |
| What AppScan does not do | — | No inter-procedural taint across files, no deterministic rules for Python, Go or Java, no GitLab or Bitbucket, no custom rules. |
03A penetration test
Against a pentest
A pentest is a person with permission to break in, once. It finds what a scanner cannot, and it describes the application as it was on the day, not the day after the next deploy.
| Capability | A penetration test | AppScan |
|---|---|---|
| When | Once, before a launch or an audit. | Continuously: every push, every pull request, and a scheduled full scan on every paid plan. |
| What it may touch | Anything in scope, by agreement. | Only reads. Only endpoints classified SAFE_READ, at most 6 replays of a request your own page made, and only after you verified the domain. |
| Authentication | Logs in as a user and as an admin. | Never logs in. The half of your app behind a session is not seen, and the report says so. |
| Exploitation | Proves impact by exploiting. | Proves exposure by observing. Nothing is written, nothing is submitted, nobody is logged in. |
| Evidence | A document, weeks later. | A finding with the rule id, the file or URL and masked evidence, within minutes, and re-checked on the next scan. |
| Cost | Days of a specialist. | A subscription. Live-site scans are free and unlimited on paid plans; AI work is priced per task in credits. |
| What AppScan does not do | — | It does not replace a pentest before a launch that needs one. It makes the next one shorter. |
04Not built
What AppScan does not do.
Listed here so that no other page has to imply otherwise. If one of these is the thing you need, we would rather you knew before the first scan.
- Deterministic source rules for Python, Go, Java, Ruby, PHP or Rust (a model reads them; rules do not)
- Scanning behind a login, or any authenticated flow
- Single sign-on, SAML, passkeys or organization-wide 2FA enforcement
- Inter-procedural taint analysis across files
- Helm, CloudFormation or Pulumi; container image CVE scanning
- Custom invariants declared by the team
- GitLab, Bitbucket, Azure DevOps, Jenkins or CircleCI integrations (recognised as facts, not connected)
- Jira, Linear, PagerDuty, Microsoft Teams, SMS, or outbound webhooks to an arbitrary URL
- Screenshots or DOM snapshots as evidence
- TLS version probing and certificate-transparency lookups
- Bundle-size analysis and per-framework image advice
See the difference on your own app.
The free scan is the header checker's one request, and eighty-three more. The report tells you whether the rest is worth your time.