Welcome
AI-powered security
AppScan on Cloud recognizes the increasing role of artificial intelligence in development protocols. Just as AI can speed and strengthen the application development process, so can AI be used to ensure those applications are secure and ready for market.
AI innovations in AppScan on Cloud
HCL AppScan RapidFix integration
HCL AppScan RapidFix is an AI-driven solution that automates the triage and remediation process for application security vulnerabilities. HCL AppScan RapidFix applies to SAST results.

Getting started
Welcome to the documentation for HCL AppScan on Cloud, where you can find information about how to install, maintain, and use this service.
Navigation
This section describes navigating AppScan on Cloud, including items on the side main menu and top navigation bars, with links to more detailed information.
Management
Define users, roles, groups, applications, policies, and configure DevOps integrations.
Dynamic analysis
AppScan on Cloud performs security scans for web-applications for production, staging and development environments. For development environments it is aided by Private Site Scanning technology to scan applications not accessible to the open Internet.
Interactive monitoring
Using an agent installed on your application, ASoC identifies security vulnerabilities in your application during runtime by monitoring all interactions, both legitimate and malicious. The process is "passive," in the sense that IAST does not send its own tests, and can therefore run indefinitely.
Software Composition Analysis
Use Software Composition Analysis (SCA) to scan for security vulnerabilities in open source and third-party packages used by your code.
Static analysis
Use static analysis (SAST) to scan for security vulnerabilities in web and desktop applications. Static analysis includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
AI-powered security
AppScan on Cloud recognizes the increasing role of artificial intelligence in development protocols. Just as AI can speed and strengthen the application development process, so can AI be used to ensure those applications are secure and ready for market.
- AI innovations in AppScan on Cloud
  - HCL AppScan RapidFix integration
    HCL AppScan RapidFix is an AI-driven solution that automates the triage and remediation process for application security vulnerabilities. HCL AppScan RapidFix applies to SAST results.
  - AppScan on Cloud AI assistant
    The AI assistant is an integrated intelligence layer that works within the AppScan on Cloud environment. It provides security insights, automates issue triage, and offers remediation guidance.
  - AppScan Model Context Protocol (MCP) server
    The AppScan MCP server integrates HCL AppScan on Cloud directly with AI-powered development environments and agents. By implementing the Model Context Protocol (MCP), this server allows LLMs (such as Claude or models running in VS Code) to securely access your security data—including SAST, DAST, SCA, and IAST results—to help you triage issues, analyze findings, and automate workflows using natural language.
  - Intelligent Findings Analytics (IFA) and Intelligent Code Analysis (ICA) for SAST
  - Agentic AI for Business Logic Vulnerability Detection in SAST
  - Intelligent Finding Analytics (IFA) and DAST
    Intelligent Finding Analytics (IFA) uses artificial intelligence (AI) and machine learning (ML) to analyze data, discover patterns, and make predictions, ultimately transforming data into actionable insights. IFA goes beyond regular data analysis by using advanced methods to find deeper meanings and make smart decisions.
- AI security in AppScan on Cloud
  In AppScan on Cloud traditional scans can cover conventional vulnerabilities within AI architecture.
Results
The Scans and Sessions page lists the scans under the categories DAST, SAST, SCA, and IAST, where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.The Scans and Sessions page lists scans under the categories where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.
Troubleshooting
If you experience problems with this service, you can perform these troubleshooting tasks to determine the corrective action to take.
FAQ & Reference
Frequently asked questions, information about integrating ASoC into the product lifecycle (SDLC), and ASoC API documentation.

HCL AppScan RapidFix integration

HCL AppScan RapidFix is an AI-driven solution that automates the triage and remediation process for application security vulnerabilities. HCL AppScan RapidFix applies to SAST results.

AppScan offers two RapidFix options to support your remediation workflows::

AppScan’s native auto triage and fix capability requiring no additional configuration,
or
Advanced remediation engine but requiring an additional subscription and configuration.

RapidFix results are integrated into the ASoC interface for quick identification and action.

Acquiring and installing HCL AppScan RapidFix

To enable RapidFix with AppScan’s native auto-triage and fix features, contact your ASoC representative to enable this functionality for your organization.

To enable RapidFix with advanced features, subscribe to RapidFix in the ASoC interface:

Click RapidFix triage from the single scan view of a static analysis (SAST) scan, then click Learn more on the resulting dialog box. ASoC opens a new browser window from which you can request more information from the HCL sales team.

Once subscribed, install Pixee Enterprise Server according to the instructions here.

Remediating results using HCL AppScan RapidFix

When RapidFix is subscribed and configured, results that have been analyzed automatically by RapidFix are indicated in the following ways:

Clicking RapidFix triage from the single scan view shows a summary of RapidFix findings. Click View suggestions to go to the Issues page.Click View suggestions to go to the Issues page.
The RapidFix icon () displays for a scan on the Scans and sessions page.
The Issues page for the scan displays two new columns, RapidFix autofix and RapidFix triage.
- RapidFix autofix indicates if an autofix is available for the issue.
- RapidFix triage notes the results of AI analysis of the issue.
  Note: If you decide to ignore the triage suggested by RapidFix, this noted in issue audit trail as RFIgnoreTriage.
Click the issue to open the Issue information pane to learn more.
A new tab – RapidFix – on the Issue information pane for the scan allows you to review the findings and take action.