Welcome
Managing application risk
Follow this workflow to manage application security risks in your organization.
Step 5: Measuring progress and demonstrating compliance
Learn how to measure progress and demonstrate compliance.
Demonstrating compliance
Learn how to demonstrate compliance.
Industry standard reports
Learn about Industry standard report.

Welcome
Welcome to the HCL AppScan Enterprise 10.11.0 documentation, where you can find information about how to install, maintain, and use HCL AppScan Enterprise.
Accessibility features for AppScan® Enterprise
Accessibility features assist users who have a disability, such as restricted mobility or limited vision, to use information technology content successfully.
Overview
Learn general information about the product.
Installing
Learn how to install the product.
Upgrading and migrating
Learn how to upgrade the product.
Integrating
Learn how to integrate the product with other solutions.
DevOps
Learn how to extend the product with REST APIs and plugins.
Best practices
Learn best practices for using the product.
Configuring
Learn how to configure the product.
Administering
Learn how to administer the product.
Managing application risk
Follow this workflow to manage application security risks in your organization.
- Step 1: Creating an application inventory
  Learn how to create an application inventory.
- Step 2: Testing applications for vulnerabilities
  Learn how to test vulnerabilities identified in an application.
- Step 3: Determining risks and prioritizing vulnerabilities
  Learn how to determine risks and prioritize vulnerabilities identified in an application.
- Step 4: Remediating risks
  Learn how to remediate risks identified in an application.
- Step 5: Measuring progress and demonstrating compliance
  Learn how to measure progress and demonstrate compliance.
  - Measuring progress
    Learn how to track various metrics and trends of the applications that compose your portfolio.
  - Demonstrating compliance
    Learn how to demonstrate compliance.
    - Exporting issues as reports
      You can generate customized reports ( HTML, PDF, Excel, or XML) for issues and send them to developers, internal auditors, penetration testers, managers, and the CISO. The reporting templates in AppScan Enterprise map application security data to key government regulations and industry standards. Use the reports to document progress towards regulatory compliance goals, such as showing a reduction in the number of application vulnerabilities associated with compliance issues.
    - Limiting the size of a Security report
      Security reports can be large. During report generation, you might receive a warning message that the file is hundreds of pages long, or the report creation process might time out. Try the following tips to reduce report size.
    - Compliance Report
      Learn about Compliance report.
    - Industry standard reports
      Learn about Industry standard report.
      - International Standard - ISO 27001:2022 report
        The International Standard - ISO 27001:2022 compliance report helps you assess your web application's security against the ISO 27001:2022 information security management system (ISMS) framework.
      - International Standard - ISO 27002:2022 Report
        The International Standard - ISO 27002:2022 compliance report helps you assess your web app's security against the standard's information security guidelines.
      - NERC Cyber Security Standards report
        This report displays NERC Cyber Security Standards issues found on your site. Many web application vulnerabilities might lead to security breaches of personal information, directly or indirectly, and might be considered as violations of the regulation.
      - NIST Special Publication 800-53 Revision 5.2.0 report
        The NIST Special Publication 800-53 Revision 5.2.0 compliance report helps you assess your web app's security against the security and privacy controls required for U.S. federal information systems.
      - OWASP Top 10 2021 report
        The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to your web applications.
      - OWASP Top 10 2025 report
        The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.
      - OWASP API Security Top 10 report 2019
        APIs, or application program interfaces, are vital tools for businesses in all industries. Since there is a rise in use of APIs in many domains and APIs are a critical part of modern mobile, SaaS and web applications, it is inevitable to release the importance of API security and its unique vulnerabilities as compared to web applications. OWASP API Security Top 10 report help developers, testers, and users — as well as project managers, security researchers, and educators — provide insight into the most severe and current security weaknesses related to APIs.
      - OWASP API Security Top 10 report 2023
        APIs, or application program interfaces, are vital tools for businesses in all industries. Since there is a rise in use of APIs in many domains and APIs are a critical part of modern mobile, SaaS and web applications, it is inevitable to release the importance of API security and its unique vulnerabilities as compared to web applications. OWASP API Security Top 10 report help developers, testers, and users — as well as project managers, security researchers, and educators — provide insight into the most severe and current security weaknesses related to APIs.
      - OWASP Cloud-Native Application Security Top 10 report
        The OWASP Cloud-Native Application Security Top 10 is a resource that identifies the most critical security risks associated with cloud-native applications. It also details the challenges organizations face when securing these applications and provides guidance on mitigating those risks.
      - OWASP Application Security Verification Standard Report
        The Application Security Verification Standard (ASVS) is a list of application security requirements or tests that can be used by architects, developers, testers, security professionals, tool vendors, and consumers to define, build, test, and verify secure applications.
      - CWE Top 25 Most Dangerous Software Weaknesses 2024 report
        This report references the 2024 CWE Top 25 Most Dangerous Software Weaknesses list. This list, published by the CWE Team, highlights the most severe and prevalent weaknesses based on an analysis of Common Vulnerabilities and Exposures (CVE®) records from the National Vulnerability Database (NVD). This information reflects the integration of the 2024 list into AppScan Enterprise.
      - WASC Threat Classification v2.0 report
        This report displays WASC threat classification issues found on your site.
      - OWASP Top 10 for LLM Applications 2025 report
        The OWASP Top 10 for LLM Applications 2025 industry standard compliance report helps you assess your application's security against common vulnerabilities in Large Language Model (LLM) applications.
Troubleshooting and support
To help you understand, isolate, and resolve problems with your HCL® software, the troubleshooting and support information contains instructions for using the problem-determination resources that are provided with your HCL products.
Reference
Review reference information for the product.
Glossary

Industry standard reports

Learn about Industry standard report.