Welcome
AI-powered security
AppScan on Cloud recognizes the increasing role of artificial intelligence in development protocols. Just as AI can speed and strengthen the application development process, so can AI be used to ensure those applications are secure and ready for market.
AI security in AppScan on Cloud
In AppScan on Cloud traditional scans can cover conventional vulnerabilities within AI architecture.
AppScan AI red teaming

Getting started
Welcome to the documentation for HCL AppScan on Cloud, where you can find information about how to install, maintain, and use this service.
Navigation
This section describes navigating AppScan on Cloud, including items on the side main menu and top navigation bars, with links to more detailed information.
Management
Define users, roles, groups, applications, policies, and configure DevOps integrations.
Dynamic analysis
AppScan on Cloud performs security scans for web-applications for production, staging and development environments. For development environments it is aided by Private Site Scanning technology to scan applications not accessible to the open Internet.
Interactive monitoring
Using an agent installed on your application, ASoC identifies security vulnerabilities in your application during runtime by monitoring all interactions, both legitimate and malicious. The process is "passive," in the sense that IAST does not send its own tests, and can therefore run indefinitely.
Software Composition Analysis
Use Software Composition Analysis (SCA) to scan for security vulnerabilities in open source and third-party packages used by your code.
Static analysis
Use static analysis (SAST) to scan for security vulnerabilities in web and desktop applications. Static analysis includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
AI-powered security
AppScan on Cloud recognizes the increasing role of artificial intelligence in development protocols. Just as AI can speed and strengthen the application development process, so can AI be used to ensure those applications are secure and ready for market.
- AI innovations in AppScan on Cloud
- AI security in AppScan on Cloud
  In AppScan on Cloud traditional scans can cover conventional vulnerabilities within AI architecture.
Results
The Scans and Sessions page lists the scans under the categories DAST, SAST, SCA, and IAST, where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.The Scans and Sessions page lists scans under the categories where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.
Troubleshooting
If you experience problems with this service, you can perform these troubleshooting tasks to determine the corrective action to take.
FAQ & Reference
Frequently asked questions, information about integrating ASoC into the product lifecycle (SDLC), and ASoC API documentation.

AppScan AI red teaming

AppScan AI red teaming provides continuous, automated adversarial testing for AI agents, copilots, RAG architectures, and AI-powered applications. By combining DAST-driven probes with live endpoints and Model Context Protocol (MCP) server security validation, AppScan identifies AI-specific vulnerabilities before they can be exploited in production.

Unlike traditional application security testing, which primarily evaluates code, APIs, infrastructure, and web application vulnerabilities, AI red teaming examines risks arising from probabilistic model behavior and AI orchestration. These include, but are not limited to:

Prompt injection and indirect prompt injection
Jail breaking
Sensitive data disclosure
System prompt leakage
RAG manipulation and knowledge-base poisoning
Insecure MCP and other agent communication protocols
Harmful, misleading, or policy-violating responses
Function/tool-calling abuse and unauthorized actions

Findings are mapped to recognized frameworks such as the OWASP Top 10 for LLM Applications and emerging agentic security standards. This enables organizations to prioritize risk, validate AI safeguards, support governance and compliance initiatives, and deploy AI-enabled applications with greater security and confidence.

Key capabilities

Integrated LLM testing with DAST and IAST, with correlation
AppScan seamlessly secures LLM-augmented applications by treating AI assistants, chatbots, and other AI functionality as integral parts of the application under test, combining web and LLM security testing in a single assessment. DAST identifies LLM-specific vulnerabilities, while IAST tracks untrusted LLM outputs reaching sensitive operations without validation. These LLM-related findings from DAST and IAST are correlated, enabling efficient remediation of related issues through a single fix. Learn more at AppScan DAST for LLM-augmented applications and About interactive monitoring (IAST).
AI Stack Threat Coverage
Evaluates applications, foundation models, and autonomous agents, including prompt injections, jailbreaks, system prompt exposure, data leakage, and unsafe outputs.
OWASP Alignment
Covers the OWASP Top 10 risks for LLMs and MCPs.
Continuous Security Validation
Regularly scan AI-augmented applications for new vulnerabilities introduced by model drift, prompt changes, or updated agent toolsets.