Micro Focus Fortify is a product dedicated to supporting application security – automatically testing vulnerabilities contained in source code as well as in compiled code. In an era where applications form a critical element of business infrastructure and cybercriminals constantly search for software vulnerabilities, automating code security testing has become essential for every organization engaged in software development.
The traditional approach to application security relied primarily on tests conducted at the end of the development cycle. This approach generated significant costs – detecting and fixing vulnerabilities in the production phase can be many times more expensive than eliminating them in early development stages. Fortify enables shifting security testing left (shift-left security), integrating directly with the development environment.
The platform offers a comprehensive set of application security testing tools:
- Static Application Security Testing (SAST) – supports many programming languages and offers support for many popular IDE development platforms, enabling source code analysis directly in the developer’s environment
- Dynamic Application Security Testing (DAST) – analysis of compiled web applications (Java, .NET), testing running applications from an external attacker’s perspective
- Interactive Application Security Testing (IAST) – combines the advantages of SAST and DAST, monitoring the application during runtime and correlating results with source code
- Runtime Application Self-Protection (RASP) – provides real-time application protection, detecting and blocking attacks during execution
A key advantage of Fortify is its ability to identify a wide spectrum of vulnerabilities, including those from the OWASP Top 10 – from SQL Injection, through Cross-Site Scripting (XSS), to authentication and session management issues. The system not only detects vulnerabilities but also provides detailed information about their location in the code along with remediation recommendations.
Integration with popular CI/CD tools such as Jenkins, Azure DevOps, or GitLab allows automatic security test execution with every build. This enables DevOps teams to implement a true DevSecOps approach, where security is an integral part of the entire software lifecycle.
https://www.microfocus.com/en-us/portfolio/application-security
What static analysis can and cannot tell you
A static analyser reads code and reports patterns that are known to be dangerous. That is genuinely useful and it is not the same as reporting a vulnerability, because the tool cannot see whether the dangerous path is reachable at runtime, whether an upstream control already blocks it, or whether the input in question is ever attacker-controlled. This is the origin of the false-positive volume that discourages teams during the first month of use.
The practical consequence is that scanner output needs a triage step before it becomes a backlog, and that step needs someone who understands the application rather than the tool. Skipping it produces either an ignored queue or a lot of pointless work. Combining automated scanning with a human review that establishes which findings are actually exploitable in this codebase is the scope of a source code vulnerability review.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- IT Automation — IT automation is the process of using technology to perform IT tasks and…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
- Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
- NIST Cybersecurity Framework — NIST Cybersecurity Framework (NIST CSF) is a set of standards and best…
- Security Orchestration, Automation and Response — Security Orchestration, Automation and Response (SOAR) is a set of tools and…
Learn More
Explore related articles in our knowledge base:
- Automation in vulnerability management
- Penetration Testing Automation with RidgeBot
- RidgeBot – Penetration Testing Automation
- Chained Exploitation of n8n: How RidgeBot Detects Workflow Takeover in Practice
- Ivanti Neurons for Patch Management: Patch Management Automation
Explore Our Services
📚 Read the complete guide: Penetration Testing: Penetration testing - types, methodologies, process
Need cybersecurity support? Check out:
- Security Audits - comprehensive security assessment
- Penetration Testing - identify vulnerabilities in your infrastructure
- SOC as a Service - 24/7 security monitoring
Explore Our Products
Solutions mentioned in this article that can help protect your organization:
- Ivanti Neurons — Ivanti
- RidgeBot — Ridge Security
Frequently asked questions
What is Micro Focus Fortify and what does it do?
Micro Focus Fortify is a Static Application Security Testing (SAST) solution that automatically scans source code and binaries to identify security vulnerabilities before software is deployed. It integrates into the software development lifecycle to help development teams find and fix security flaws early, reducing the cost and risk of vulnerabilities in production.
What types of vulnerabilities can Fortify detect?
Fortify can detect a wide range of vulnerabilities including SQL injection, cross-site scripting (XSS), buffer overflows, hardcoded credentials, insecure cryptography usage, path traversal, and many other issues listed in the OWASP Top 10 and CWE catalogues. It supports dozens of programming languages and frameworks.
How does Fortify integrate into a development pipeline?
Fortify can be integrated directly into IDEs, build systems such as Maven and Gradle, CI/CD pipelines including Jenkins and Azure DevOps, and code repositories. This allows automated security scans to run on every code commit or build, providing developers with immediate feedback on introduced vulnerabilities.
What is the difference between Fortify SAST and dynamic application security testing?
Fortify SAST analyzes source code without executing the application, enabling vulnerability detection early in development before a running environment is available. Dynamic Application Security Testing (DAST) tests a running application by sending attack payloads, finding runtime vulnerabilities. Both approaches are complementary and together provide more comprehensive application security coverage.
