IBM AppScan is a dynamic application security testing (DAST) tool designed to scan the web application itself, the underlying web server hosting it, and the web application platform. It does not scan operating systems or network-layer devices, which are handled by network vulnerability scanners.