start portlet menu bar

HCLSoftware: Fueling the Digital+ Economy

Display portlet menu
end portlet menu bar
Select Page

According to The Linux Foundation Research, 70-90% of application code being used in modern-day applications is dependent on third-party libraries. This software supply chain dependency is a direct result of the demanding pace of modern development. It is far more efficient to incorporate “off the shelf” code for certain types of functionalities than it is to create these components from scratch.

But there is a security downside to all this reliance on third-party libraries. While the propriety code your team builds from scratch may have no vulnerabilities, it does not mean your application is secure if the external applications or components in the supply chain are vulnerable.

The dependent vulnerable components provide an opportunity for attackers, which, when undetected, can have a serious impact on your application and your business.


HCL AppScan DAST with Vulnerable Third-Party Component Detection


HCL AppScan DAST (dynamic application security testing) is an industry-leading technology that scans your applications and APIs against potential vulnerabilities. HCL AppScan DAST helps you prevent expensive web application security breaches by executing automated scans, assessing risks and helping you mitigate them before deployment.

One of the key strengths of the HCL AppScan DAST engine is in its ability to leverage a rich database of vulnerabilities. The database has been trained for over 30+ years while serving clients across the globe, analyzing their application behavior and providing valuable insights into the security posture of the application.

Now HCL AppScan introduces Vulnerable Third-Party Component Detection. This new capability augments the existing DAST capabilities by fingerprinting the most-used client and server-side technologies and reporting their vulnerabilities.


A screenshot of a computer Description automatically generated

Snapshot from AppScan Standard highlighting the “Report vulnerable components” scan configuration.


Vulnerable Third-Party Component Detection Provides Numerous Benefits

  • Comprehensive Vulnerability Coverage

    Hackers target well-known vulnerabilities in popular libraries. DAST together with Vulnerable Third-Party Component Detection provide you with much more comprehensive vulnerability coverage, allowing you to identify libraries with known vulnerabilities and see those findings alongside all your DAST results.

A screenshot of a computer Description automatically generated

Snapshot from HCL AppScan Enterprise showing components detected on an application.

  • Vulnerability Mitigation

    Tracking each vulnerability independently allows your security team to be more proactive when it comes to remediation. This focus and visibility also help mitigate the risks of potential future attacks targeting the same vulnerabilities. Teams can allocate resources for prioritized vulnerabilities, reducing the attack surface & maintaining a strong security posture.

A screenshot of a computer Description automatically generated

Snapshot from AppScan Enterprise showing vulnerabilities in the identified third-party components.

  • Compliance & Auditing

    DAST & Vulnerability Third-Party Component Detection helps your organization to identify & address non-complaint components, ensuring the necessary regulatory compliance requirements are met.

  • Developer Awareness

    This added attention to third-party components promotes a culture of proactive security and encourages development team to regularly monitor & update software dependencies.

  • Release Scope

    AppScan Standard 10.3.0 and AppScan Enterprise 10.3.0 release onwards.


AppScan on Cloud (SaaS offering)


With so many third-party components being incorporated into applications today, it is critical to know whether they are introducing vulnerabilities to your code base and/or undermining all your hard work to stay secure.

HCL AppScan DAST continues to provide industry-leading functional testing of applications. Now with the addition of fingerprinting vulnerable third-party components, development teams can see all these aggregated findings in centralized views for easier triage and remediation, significantly improving their overall software supply chain security.

Visit for more information on HCL AppScan DAST with Vulnerable Third-Party Component Detection.

Comment wrap
Secure DevOps | November 28, 2023
Strengthen Your AWS Security with a Comprehensive Application Scanning Integration from HCL AppScan
Strenghten AWS security with HCL AppScan. Continuous testing, custom policies, insights, fail-build compliance, and more. Start 30-day trial!
Secure DevOps | November 2, 2023
Get Hands-On with AppScans Next Virtual Workshop - API Discovery, Secret Key, Vulnerable Components Scanning
Chek out what's new with AppScan Standard, a DAST (Dynamic Application Security Testing) tool designed for security experts and pen-testers that automatically crawls target applications and APIs and tests them for vulnerabilities.