Unlocking Clarity: HCL AppScan on Cloud Now Comes with an AI Assistant

The true challenge modern security and development teams face is not a lack of information, but rather an abundance of it. Sorting through findings requires significant time and deep contextual understanding. Triage becomes a heavy cognitive lift, and teams often lack a customized, insightful lens to quickly identify what matters most.

To solve this visibility and time crisis, we are excited to introduce the HCL ASoC AI Assistant. Integrated directly into the HCL AppScan on Cloud (ASoC) platform, this context-aware, conversational assistant acts as a powerful intelligence layer atop your existing workflows. It helps you cut through the noise, accelerate triage, and gain instant clarity.

Uplifting Your Data with Organizational Intelligence

HCL AppScan on Cloud has always delivered world-class, foundational security data across your applications; this advanced application security AI assistant elevates this data further. Instead of treating vulnerabilities as isolated incidents, the Assistant leverages organizational intelligence to analyze findings across your portfolio. It connects the dots to help you understand the broader security posture of your applications. By asking the Assistant natural language questions about your data, you gain immediate, high-level context, allowing you to understand the strategic "why" behind your organization's security risks.

Simplifying Triage and Prioritization

Manual triage is traditionally one of the most time-consuming phases of application security. The AI Assistant transforms this bottleneck into a streamlined, interactive experience.

By analyzing the specific attributes of your findings, the AI Assistant provides intelligent recommendations on which issues pose the highest actual risk to your environment. More importantly, it allows you to act on those insights instantly and update issue statuses directly from the chat interface. This conversational intelligence works in perfect harmony with native platform capabilities like HCL AppScan RapidFix, which operates on the backend to automatically triage and prioritize static application security testing (SAST) vulnerabilities. Together, these features bring massive time savings to security engineers and managers who need to keep the pipeline moving.

Contextual Remediation Support

The application security testing landscape is expanding from pure testing to include remediation. The AI Assistant serves as an assistive guide in this space as well. By understanding a given vulnerability, the AI Assistant can offer tailored, code-level fix guidance that developers can use without leaving the HCL ASoC platform.

This conversational guidance is seamlessly backed by HCL AppScan RapidFix, our automated engine that delivers human-verified, AI-powered fix recommendations specifically for SAST findings. This integration provides developers with ready-to-use blueprints to close vulnerabilities quickly.

Choosing the Right Tool for the Job

With this release, HCL AppScan provides three distinct pillars of AI, ensuring every role in your organization has the right capabilities exactly where they work:

The HCL ASoC AI Assistant (In-Product Context): 

Built natively into the platform's user interface, this conversational assistant is tailor-made for security engineers and managers. It leverages page-level context to answer complex portfolio questions and allows users to execute rapid, manual triage updates directly within their workspace.

The HCL AppScan MCP Server (External Workflow Integration): 

Acting as a bridge, the MCP Server pulls AppScan intelligence into modern AI development environments (such as Claude, Cursor, or Windsurf). It places AppScan insights directly alongside your source code within the integrated development environment (IDE). This streamlines remediation exactly where the code lives while orchestrating powerful, cross-tool workflows with Jira and GitHub.

HCL AppScan RapidFix (Agentic Source-Code Remediation):

Operating automatically on the backend, this agentic AI engine filters SAST false positives and writes human-verified code fixes. It empowers developers and code owners to clear code-level security debt instantly, before vulnerabilities are ever merged.

Enterprise Security, Built In

Enterprise AI requires absolute trust. Securely powered on enterprise-grade infrastructure via Azure OpenAI Foundry, the HCL ASoC AI Assistant operates within strict, transparent guardrails to keep you entirely in control:

• Absolute Privacy: Your prompts and scan data are completely segregated. They are never retained by third parties or used to train public large language models (LLMs). What happens in your tenant stays in your tenant.
• Strict Access Control (RBAC): The Assistant automatically inherits your user account's exact permissions, meaning it can only see and query data you are explicitly authorized to access.
• Assistance, Not Autonomy: The AI acts as a smart advisor for data retrieval and triage. It will never autonomously alter your source code, change system configurations, or trigger new scans without a human in the loop.
• Seamless Access: The Assistant is built directly into the platform experience, with usage limits automatically optimized based on your existing license tier.
• Secured by HCL AppScan’s DAST for LLM: We practice what we preach. The AI Assistant is continuously secured using HCL AppScan’s own Dynamic Application Security Testing (DAST) for LLM solution. By deploying our generative AI security testing on our own product, we ensure the platform remains resilient against prompt injections and AI-specific threats.

Experience the Future of HCL AppScan

The HCL ASoC AI Assistant represents a major evolutionary leap for HCL AppScan on Cloud, turning a powerful testing platform into an active, conversational partner. By delivering a customized lens for your organizational data, it gives your team the visibility and time they need to secure what matters most.

Request a demo today to experience a smarter, more intuitive way to manage your security data.