OpenText Core Application Security (Fortify)

For OpenText Core Application Security , I currently support a couple of my clients who are using Fortify on Demand for their web application, CRM , and sales platform.

Many good features of Fortify on Demand include SAST  and DAST capabilities, and you can do sandboxing of a few features when you're testing web applications. You can create environments and recreate scenarios. I can walk you through the platform itself, taking about six to eight hours, because I have been working on the product as a product specialist and product manager, so I know the ins and outs of it.

Before Micro Focus OpenText , I used multiple solutions like Synopsys, which offers very promising competition.

The biggest advantage of this tool, Fortify on Demand, is that it is very scalable; it provides all the features just in time, and you do not need to have massive deployment or a lot of compute capabilities to use the product—that's the beauty of it. It is supporting a few of the largest deployment web applications globally.

Fortify on Demand supports most of the major integrations and gives an opportunity to integrate custom-built solutions. For enterprise licenses, if you consume more than a couple of custom integrations, each would be a separate cost, allowing integration with any solution.

Automated risk assessment helps ensure that continuous risk analysis is happening; you get automated reports through a set of rules, batch scripts, and relating to different logs and events—that's how continuous assessment occurs.

Our solutions like SAST  and DAST are compliant, allowing compliance with CMMI levels. Additionally, integration with ArcSight provides various compliance reporting for PCI, HI-TRUST, HIPAA, FCC, ISO 27001, 22301, and 27701.

Areas for improvement should be contextualized post the OpenText  acquisition, but back when I was working with Micro Focus, they focused heavily on enterprise-centric solutions. Now, after the acquisition, there is a shift towards supporting SMBs, and Fortify on Demand gained immense traction afterward. Prior to that, Micro Focus catered primarily to enterprise deals, leading to a heavy infrastructure focus which posed challenges.

Currently, Fortify on Demand primarily caters to web-based application security; this could be an area of improvement in the future.

I would say OpenText Core Application Security is not very user-friendly in terms of price; it is quite high. People consider buying luxury items like a Mercedes, where price is not a concern, but first-time buyers often need to be price-sensitive and may compromise on certain features.

I have used OpenText Core Application Security for approximately three years.

OpenText Core Application Security is stable and has minimal downtime, benefitting from AWS  cloud availability; the last downtime I recall was six months ago for a few minutes.

Fortify is superior to many solutions because of its scalability and that it does not require massive compute capabilities for its SAST and sandboxing features.

Threat response time improves as much correlation happens; by inducing different data points, you have a clearer vision of your infrastructure, reducing threat response time. We have observed a reduction in up to 68 to 72 percent in threat response time when all solutions are working in harmony with proper orchestration.

The technical support from OpenText is very good.

As a vendor, I was part of Micro Focus while I was taking care of OpenText Core Application Security.

Before Micro Focus OpenText, I used multiple solutions like Synopsys, which offers very promising competition.

As a SaaS solution, OpenText Core Application Security is now easy to install, unlike prior versions that required more expertise.

There are indeed savings with OpenText Core Application Security because when investing in a security solution, the efficacy depends on the orchestration and the layers in place. Many failures in achieving ROI stem from configurations, not deployments. A notable example is securing an important transportation application for a different country—a situation demanding stringent security measures.

There is definitive ROI if OpenText Core Application Security is deployed properly; it substantially reduces efforts in securing the solution while averting various application-related risks.

I use Fortify on Demand for monitoring up to a certain extent; it provides monitoring and helps analyze and identify issues that could propagate in the application. When used in conjunction with ArcSight and other solutions, it gives a lot of analytics which allows you to make predictions and be proactive rather than reactive in security.

When it comes to custom integration, it usually takes about seven to ten days. This does improve threat response time in general.

I have been working with AWS  cloud for the past six to seven years, and in my current role, I am working on AWS  cloud.

Fortify was used for scanning applications to identify dynamic security vulnerabilities. Another solution from Fortify named Fortify Source Code Analyzer, basically SCA , scans lines of code for different technologies, such as ASP.NET , VB.NET, and Java-based applications. It scans different lines of code for an application and flags vulnerabilities, and on the basis of that vulnerability, a security professional has to identify false positives and then report it to the internal application team.

When security issues are identified in the early stage of the software development life cycle, it really helps because if threats are identified early, the product being developed by the application development team has fewer security issues. There is no product that doesn't have any issues. Obviously, the team tries to build a solution that has zero issues, but that is hypothetical. When threats are identified in the early software development life cycle, it gives confidence among the team and provides a fair idea that the application being developed will be a viable solution for the customer.

Whenever any security vulnerability is identified by Fortify or OpenText , it gives information about whether that particular security issue is non-compliant related to PCI, ISO 27001, or SOC 2. It provides a fair understanding that this security vulnerability should be prioritized because if you don't fix this vulnerability, your application will be non-compliant and your compliance goal will ultimately fail. So it helps a lot.

Fortify on Demand is a good service. Since it is fully being managed by OpenText , after Micro Focus acquired Fortify, all services are managed by the Fortify team when a customer is using Fortify on Demand. When you are seeing the application and the vulnerabilities which have been identified by their tool, you can see the issues. However, the visibility of the actual work being done is by the Fortify team. If you want to fully outsource your services, then it's a very good solution.

The best feature is that it supports many language frameworks. VB.NET was not available previously, but later they onboarded VB.NET as well, which is a legacy-based application, but some organizations still use VB.NET, so they have onboarded it, which is a good thing. Another aspect I appreciated about Fortify is that it gives a good understanding of the issues. The false positive rate is less, and they give valid issues. The invalid issues identified by Fortify are fewer. That is a good aspect. Additionally, you can integrate Fortify in CICD pipeline, so you get real-time updates about the security issues in your pipeline.

If you have an internal team and you want your internal team to validate false positives, basically to determine whether it's a valid issue or an invalid issue, then I wouldn't recommend it much. That was the only reason we migrated from Fortify on Demand to another solution.

Fortify has another tool which is Fortify WebInspect . On Demand is the outsourcing solution, and WebInspect  you can use with your in-house team, which is basically the product developed by the Fortify team. For automated scanning, Fortify helps a lot.

Regarding the visibility for the internal team, everyone is moving toward the DevSecOps  side, and Fortify team has made good progress that you can integrate into your CICD pipeline. One thing I would highlight is if Fortify can focus more on the centralized dashboard of the tools because nowadays, tools such as SentinelOne also exist for identifying security issues, but they have a centralized dashboard that merges their cloud solution and application security side solution together. If you have one tool that works for different solutions, it helps a lot.

They are doing good, but they should invest more on the AI side as well because AI security is evolving these days. On the cloud side, they have already made good progress, but I believe they should explore the new area related to AI security as well.

I have been using Fortify on Demand, Veracode , Checkmarx, and SonarQube  for close to ten years. If you are asking particularly about Fortify, I will say seven years.

I have not experienced any issue with stability, reliability, crashes, or downtimes. The support was very good, and since I had direct interaction with the Fortify team, I didn't raise any escalation because the support was very good in my experience.

It was very good and scalable. The only thing I mentioned before was that they provide limited understanding of what tools they're working on. If a customer wants to know the tools and the technology used for their application to scan their application, they provide less information on that.

My experience with the technical support customer service team of Fortify was pretty good; I would rate it four out of five.

I had direct contact with Fortify team and the sales director. I had direct interaction with them, which facilitated how we onboarded Fortify.

Neutral

We switched to Checkmarx.

When you talk about the key differences between Fortify and Checkmarx, we migrated from Fortify to Checkmarx because at that time, Fortify was not supporting VB.NET application, and our main application was using VB.NET. We raised the case with Fortify team about any plan in their future release to onboard VB.NET, but they didn't give us a good answer because they were saying they would try to onboard VB.NET into their platform in a year. A customer won't wait for one year to assess their application.

When you talk about static application source code testing, we had to involve the Fortify team to create an LDAP role for us. Regarding Fortify on Demand, it was pretty much straightforward because we just needed to configure our application in their platform. We had to enter the information for our application, and the rest was done by the Fortify team. Fortify on Demand was very simple. Regarding the SAST  part, I won't say it was hard, but it was a little bit complicated, and when we raised cases with their technical support team, they resolved our queries and we onboarded the tool into our environment.

It depends upon your license which you have used. We were assessing 180 applications, and our license cost was $200,000.

It depends upon if you get a good offer from Fortify team. Regarding the cost-effective part, it is a bit expensive to be honest because some good organizations can obviously afford it, but if you talk about small organizations, I'm afraid they won't be going ahead with Fortify because it's an expensive solution.

When you talk about the key differences between Fortify and Checkmarx, we migrated from Fortify to Checkmarx because at that time, Fortify was not supporting VB.NET application, and our main application was using VB.NET. We raised the case with Fortify team about any plan in their future release to onboard VB.NET, but they didn't give us a good answer because they were saying they would try to onboard VB.NET into their platform in a year. A customer won't wait for one year to assess their application.

The pros of Fortify include that you get a good understanding of the issues identified by the application. They continuously send notifications that the scan is being paused and the customer has to initiate the scan because the application scan has failed for some reason. The timely notification and visibility of issues identified is good, and the false positive aspect is also good.

Coming to Checkmarx, when we onboarded it, our primary reason was the VB.NET issue, and Checkmarx also has very good coverage on Java-based applications. The majority of our applications were on Java, and Checkmarx did a great job on the coverage of assessing our applications. Regarding the accuracy of issues, I find it almost the same for Fortify and Checkmarx. I didn't find much difference on the false positive side either.

If you want to onboard a solution for your application security side, I will definitely recommend Fortify because for your application, when you get a fair understanding of the security issues in the early stage of the software development life cycle, it's a very good thing.

I have worked on Fortify on Demand. I have used it six months ago.

Our applications were hosted on AWS cloud, and Fortify identified security vulnerabilities on our cloud platform. Our application which was hosted in AWS cloud showed that they provide good visibility. However, every tool has some pros and cons. If you ask me that if I want to recommend Fortify on Demand, it's obviously a good service which can be used by any organization when they are building a team. But if you have an in-house team which is working on many solutions, then it won't fit into their umbrella.

Fortify on Demand was the on-demand service provided by Fortify that was assessing all our applications. When applications hosted on AWS cloud were being assessed, Fortify was identifying issues for the application which was hosted on AWS cloud.

My experience with the technical support customer service team of Fortify was pretty good; I would rate it four out of five. Overall, I would rate this review a seven.