My usual use cases for OpenText Core Application Security include SAST and static testing, which covers the majority of the CVAs or CVSS that we have in the deployments.

The dynamic application security testing feature is the most valuable and useful for me so far, because the synapse does not have that—it has only FCA or CBON. The best application security tools support this testing, and usually, the customer wants to do tests while running, simulating real-world attacks. This is why OpenText Core Application Security is important, as it enables the customer to do that. The second is the SCA; I also support the customer in managing vulnerabilities for free open-source libraries and components. We can perform vulnerability management and handle the CVEs and licenses, of course, when we are talking about intellectual property.

The integration of OpenText Core Application Security with existing systems for security operations benefits us by providing vulnerability management and quality gates; without both, we will always have vulnerable applications running for our customers. This is the main benefit. The other benefit is related to the infrastructure; we leverage OpenText Core Application Security using the SaaS model, so we do not have to deploy any applications inside the customer environment. We can reduce the false positives and have a better approach to handle vulnerability management, making it the best tool for continuous integration with DevOps pipelines such as GitHub, Jenkins, and Azure DevOps.

The dynamic application security testing feature is the most valuable and useful for me so far, because the synapse does not have that—it has only FCA or CBON. The best application security tools support this testing, and usually, the customer wants to do tests while running, simulating real-world attacks. This is why OpenText Core Application Security is important, as it enables the customer to do that. The second is the SCA; I also support the customer in managing vulnerabilities for free open-source libraries and components. We can perform vulnerability management and handle the CVEs and licenses, of course, when we are talking about intellectual property.

The integration of OpenText Core Application Security with existing systems for security operations benefits us by providing vulnerability management and quality gates; without both, we will always have vulnerable applications running for our customers. This is the main benefit. The other benefit is related to the infrastructure; we leverage OpenText Core Application Security using the SaaS model, so we do not have to deploy any applications inside the customer environment. We can reduce the false positives and have a better approach to handle vulnerability management, making it the best tool for continuous integration with DevOps pipelines such as GitHub, Jenkins, and Azure DevOps.

I know OpenText is developing Aviator, similar to ChatGPT, with LLM inside the OpenText Core Application Security environment. However, I understand they do not have it for the on-premises environment. If customers need to implement it inside, or if they have data residency obligations, they will not be able to use Aviator. Perhaps in the future, they can make a module for Aviator to be usable in transit environments; that would be useful.

I have been working with OpenText Core Application Security for one year.

I have had no problems regarding the stability and reliability of OpenText Core Application Security. However, I am not a heavy user, so I do not have any insights about any downtime or issues.

My customers have never expressed any concerns about reliability issues.

OpenText Core Application Security is highly scalable; it is running on the cloud, and elasticity is one of the best points of a cloud environment.

I rate the scalability of OpenText Core Application Security at least an eight since it is not running inside the customer environment.

I have not needed to communicate with the technical support of OpenText Core Application Security or OpenText support.

For me, the documentation is adequate; I do not feel they need to add more information or use cases to what is available.

I have been working with OpenText Core Application Security for code security and AppSec, GitHub advanced security, and the hyperscaler tools such as Azure Defender, AWS Security Hub, and WiredDaddy, covering all the AWS ecosystem tools. I am quite familiar with the Google Security Center, and I come from Palo Alto.

OpenText Core Application Security helps maintain compliance standards with a faster remediation cycle, as we know the vulnerabilities, and everybody knows that the developers can perform fixes more quickly. This is important for compliance. The second point relates to PCI DSS, the framework for security concerning payment methods. I know that OpenText Core Application Security also provides access to OpenText trainings, enabling us to check all the requirements for PCI DSS.

We use the tool for static code analysis.

The solution is user-friendly. One feature I find very effective is the tool's automatic scanning capability. It scans replicas of the code developers write and automatically detects any vulnerabilities. The integration with CI/CD tools is also useful for plugins.

The tool's AI feature analyzes security threats and recommends updating the code accordingly. One major issue that AI detected for us was logging issues and hardware vulnerabilities. Fortify On Demand identified these, allowing our developers to address and fix the issues.

Fortify on Demand needs to improve its pricing.

I have been working with the product for two years.

I rate Fortify on Demand's stability an eight out of ten.

I rate the tool's scalability an eight out of ten. My company has around 25 users.

The initial setup experience with Fortify On Demand was straightforward for us. We installed the plugin and integrated it with our existing tools and logins. There was no need for configuration or setup—it was quite simple. The deployment time varies based on the code complexity. Once vulnerabilities are identified, the support team provides the necessary fixes.

Fortify on Demand is more expensive than Burpsuite. I rate its pricing a nine out of ten.

We use Burpsuite for dynamic code analysis. Fortify on Demand is a good tool for static code analysis. I rate it a nine out of ten.

I have used Fortify on Demand for security scanning, along with outsourcing to companies that scan our systems and report vulnerabilities. My work has involved securing our APIs and systems.

We use Fortify across all stages of the environment: development, test, and production. We even use it for disaster recovery.

Whenever we deploy our Jenkins pipelines, the system automatically scans our Git repository to fix security vulnerabilities. All the security vulnerabilities are then created as tasks in Jira, so we can fix them as quickly as possible.

We have added it to our operational toolkit to ensure it's part of our development spectrum. We added it directly into our Jenkins pipelines.

We have some products that are publicly accessible via phone or website. These products need to be extra secure because they rely on firewalls, and hackers could potentially exploit them. Fortify on Demand provided us with valuable information on how to fix a critical API vulnerability.

So, Fortify on Demand identifies critical vulnerabilities. We have two security scans. One is Fortify on Demand, and the other is for an outsourced company. For Fortify, you assign the specific branch of code you want to scan. You can scan the code you're currently deploying through Jenkins pipelines. Since it's external, you can also scan other brands if needed. Otherwise, you can specify which specific brands or smaller branches to scan within your entire codebase.

The scanning capabilities, particularly for our repositories, have been invaluable.

There is room for improvement in the integration process, especially with the pipeline system, which could be streamlined. Making changes and configuring it for different systems, like desktop environments, is challenging.

For example, Jenkins integration was hard.

Improving the ease of integration would be beneficial.

I have been using it since July.

It has been a stable solution for me.

For me, it has been scalable enough.

It provides good security. It is a backbone for our security needs. So, that's the biggest benefit for us.

There is a licensing model in place.

Overall, I would rate the solution an eight out of ten. I would recommend using it.

The primary use case for Fortify On Demand in our environment revolves around its critical role in sales and desk operations. It helps identify application vulnerabilities from both a source code and web perspective. It directly detects issues such as SQL injection in the source code. It conducts website scans with customizable configurations to examine potential risks and vulnerabilities, which is crucial during software development. We can avoid risks before moving to the production stage.

One of the most valuable features of Fortify On Demand is its ability to integrate seamlessly with the DevOps lifecycle, particularly in terms of security testing. Injecting security testing into the DevOps process ensures that security measures are incorporated from the development stage onwards. It aligns with the main objective of DevOps, which is to automate and streamline the software development lifecycle, from code commit to deployment. With automation tools orchestrating the pipeline, tasks such as code compilation, testing, and deployment can be carried out rapidly and efficiently. This results in faster time-to-market for features, reducing deployment times from hours to minutes. It enhances trust from customers and cybersecurity teams, as security measures are built into the software from the outset, increasing confidence in the security.

They could provide features for artificial intelligence similar to other vendors like OpenText products.

We have been using Fortify on Demand for about three years.

I rate the platform's stability as seven out of ten.

The initial setup is complicated. It takes around four to five hours to complete, including installation and scanning. I rate the process a seven out of ten.

Fortify On Demand is not highly expensive. It provides options for the number of scans and tests for the on-premise version. The customers utilizing hardware must install the tool for cost-effectiveness and high availability.

The product's cost depends on the type of license. The on-premise licenses are more expensive than the cloud subscriptions. I rate the pricing a six out of ten.

I rate the platform's accuracy for detecting vulnerabilities an eight and a half out of ten. By utilizing Fortify as a comprehensive security testing tool, financial institutions operating at high-security levels gain confidence in the security posture of their applications. It helps deploy and track changes easily as per time-to-time market upgrades.

I advise new users to learn about new features introduced in the last two years. I rate it a nine out of ten.