start portlet menu bar

HCLSoftware: Fueling the Digital+ Economy

Display portlet menu
end portlet menu bar
Select Page

According to The Linux Foundation Research, 70-90% of application code being used in modern-day applications is dependent on third-party libraries. This software supply chain dependency is a direct result of the demanding pace of modern development. It is far more efficient to incorporate “off the shelf” code for certain types of functionalities than it is to create these components from scratch.

But there is a security downside to all this reliance on third-party libraries. While the propriety code your team builds from scratch may have no vulnerabilities, it does not mean your application is secure if the external applications or components in the supply chain are vulnerable.

The dependent vulnerable components provide an opportunity for attackers, which, when undetected, can have a serious impact on your application and your business.


HCL AppScan DAST with Vulnerable Third-Party Component Detection


HCL AppScan DAST (dynamic application security testing) is an industry-leading technology that scans your applications and APIs against potential vulnerabilities. HCL AppScan DAST helps you prevent expensive web application security breaches by executing automated scans, assessing risks and helping you mitigate them before deployment.

One of the key strengths of the HCL AppScan DAST engine is in its ability to leverage a rich database of vulnerabilities. The database has been trained for over 30+ years while serving clients across the globe, analyzing their application behavior and providing valuable insights into the security posture of the application.

Now HCL AppScan introduces Vulnerable Third-Party Component Detection. This new capability augments the existing DAST capabilities by fingerprinting the most-used client and server-side technologies and reporting their vulnerabilities.


A screenshot of a computer Description automatically generated

Snapshot from AppScan Standard highlighting the “Report vulnerable components” scan configuration.


Vulnerable Third-Party Component Detection Provides Numerous Benefits

  • Comprehensive Vulnerability Coverage

    Hackers target well-known vulnerabilities in popular libraries. DAST together with Vulnerable Third-Party Component Detection provide you with much more comprehensive vulnerability coverage, allowing you to identify libraries with known vulnerabilities and see those findings alongside all your DAST results.

A screenshot of a computer Description automatically generated

Snapshot from HCL AppScan Enterprise showing components detected on an application.

  • Vulnerability Mitigation

    Tracking each vulnerability independently allows your security team to be more proactive when it comes to remediation. This focus and visibility also help mitigate the risks of potential future attacks targeting the same vulnerabilities. Teams can allocate resources for prioritized vulnerabilities, reducing the attack surface & maintaining a strong security posture.

A screenshot of a computer Description automatically generated

Snapshot from AppScan Enterprise showing vulnerabilities in the identified third-party components.

  • Compliance & Auditing

    DAST & Vulnerability Third-Party Component Detection helps your organization to identify & address non-complaint components, ensuring the necessary regulatory compliance requirements are met.

  • Developer Awareness

    This added attention to third-party components promotes a culture of proactive security and encourages development team to regularly monitor & update software dependencies.

  • Release Scope

    AppScan Standard 10.3.0 and AppScan Enterprise 10.3.0 release onwards.


AppScan on Cloud (SaaS offering)


With so many third-party components being incorporated into applications today, it is critical to know whether they are introducing vulnerabilities to your code base and/or undermining all your hard work to stay secure.

HCL AppScan DAST continues to provide industry-leading functional testing of applications. Now with the addition of fingerprinting vulnerable third-party components, development teams can see all these aggregated findings in centralized views for easier triage and remediation, significantly improving their overall software supply chain security.

Visit for more information on HCL AppScan DAST with Vulnerable Third-Party Component Detection.

Comment wrap
Secure DevOps | February 12, 2024
Mobile Application Security Testing Continues Upward Trajectory
Cybersecurity threats on the rise? Secure your mobile apps with HCL AppScan. Top-tier solutions for developers in a $3.2B market. Learn more from the Forrester Wave™ report (Q3, 2023).
Secure DevOps | December 20, 2023
Secure Application Code Against Vulnerabilities Faster with HCL AppScan Fix Groups
Stop in for an update on how HCL AppScan helps find vulnerabilities and security risks, starting with built in AI that dramatically reduces the number of scan findings and practically eliminates false positives.
Secure DevOps | December 13, 2023
HCL AppScan 10.4.0 Delivers Greater Speed, Accuracy, and Automation for Customers
Explore HCL AppScan 10.4.0 for enhanced application security testing automation. Faster scan times, accurate results, and seamless integration with GitLab and GitHub.