OpenText Fortify

What is OpenText Fortify?

OpenText Fortify (formerly Micro Focus Fortify) is an Application Security Testing (AST) platform - tools for detecting vulnerabilities in applications at every stage of the SDLC. From source code analysis, through dynamic testing, to open source component analysis.

Main components:

• Static Code Analyzer (SAST) - source code analysis
• WebInspect (DAST) - dynamic testing of running applications
• Software Composition Analysis (SCA) - dependency security
• Software Security Center (SSC) - centralized management

What problem does it solve?

flowchart LR
    subgraph Without AST
        A[Developer writes code] --> B[Deploy to prod]
        B --> C[Hacker finds bug]
        C --> D[Breach / fix cost]
    end

    subgraph With Fortify
        E[Developer writes code] --> F[SAST in IDE]
        F --> G[DAST before prod]
        G --> H[Secure release]
    end

    style A fill:#dc2626,stroke:#b91c1c,color:#fff
    style B fill:#dc2626,stroke:#b91c1c,color:#fff
    style C fill:#dc2626,stroke:#b91c1c,color:#fff
    style D fill:#dc2626,stroke:#b91c1c,color:#fff
    style E fill:#22c55e,stroke:#16a34a,color:#fff
    style F fill:#22c55e,stroke:#16a34a,color:#fff
    style G fill:#22c55e,stroke:#16a34a,color:#fff
    style H fill:#22c55e,stroke:#16a34a,color:#fff

Common problems:

• Vulnerabilities detected only in production (or by hackers)
• No visibility - how many vulnerabilities do we have in portfolio?
• Open source components with CVEs
• Compliance requires security testing (PCI DSS, OWASP)
• DevOps without security - “DevSecOps” only on paper

How does Fortify work?

flowchart TD
    A[Source code] --> B[Static Code Analyzer]
    B --> C[SAST results]

    D[Running application] --> E[WebInspect]
    E --> F[DAST results]

    G[Dependencies] --> H[SCA]
    H --> I[CVEs in libraries]

    C --> J[Software Security Center]
    F --> J
    I --> J

    J --> K[Dashboard]
    J --> L[Reports]
    J --> M[Remediation tracking]

    style A fill:#6366f1,stroke:#4f46e5,color:#fff
    style B fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style D fill:#6366f1,stroke:#4f46e5,color:#fff
    style E fill:#f59e0b,stroke:#d97706,color:#fff
    style G fill:#6366f1,stroke:#4f46e5,color:#fff
    style H fill:#22c55e,stroke:#16a34a,color:#fff
    style J fill:#dc2626,stroke:#b91c1c,color:#fff

Fortify Components

SAST vs DAST vs SCA

Aspect	SAST (Static Code Analyzer)	DAST (WebInspect)	SCA
What it analyzes	Source code	Running application	Dependencies (libs)
When	Development, CI	QA, before prod	Build time
Coverage	Entire code	Available endpoints	Open source
False positives	More	Less	Low
Requires	Source access	Application URL	Manifest/lock file

flowchart LR
    A[Code] --> B[SAST]
    B --> C[Build]
    C --> D[SCA]
    D --> E[Deploy]
    E --> F[DAST]
    F --> G[Production]

    style A fill:#6366f1,stroke:#4f46e5,color:#fff
    style B fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style C fill:#6366f1,stroke:#4f46e5,color:#fff
    style D fill:#22c55e,stroke:#16a34a,color:#fff
    style E fill:#6366f1,stroke:#4f46e5,color:#fff
    style F fill:#f59e0b,stroke:#d97706,color:#fff
    style G fill:#22c55e,stroke:#16a34a,color:#fff

Supported languages (SAST)

Category	Languages
Web	Java, C#, JavaScript, TypeScript, PHP, Python, Ruby, Go
Mobile	Swift, Objective-C, Kotlin, Java (Android)
System	C, C++, Rust
Scripting	Python, Perl, Bash
Other	COBOL, ABAP, Apex (Salesforce), SQL
Frameworks	Spring, .NET, React, Angular, Vue, Django, Rails

DevSecOps Integration

Fortify integrates with CI/CD pipelines:

Who is it for?

Fortify vs competition

Aspect	Fortify	Checkmarx	Veracode	Snyk	SonarQube
SAST	Yes	Yes	Yes	Yes	Yes
DAST	WebInspect	No	Yes	No	No
SCA	Yes	Yes	Yes	Core	Community
Languages	33+	30+	100+	10+	30+
On-prem	Yes	Yes	No	No	Yes
Deployment	On-prem + SaaS	On-prem + SaaS	SaaS	SaaS	On-prem
Price	Premium	Premium	Premium	Freemium	Free + Paid

Fortify advantage:

• Complete platform (SAST + DAST + SCA)
• On-premises option for regulated industries
• 33+ languages with deep analysis
• Software Security Center for governance

Specifications

Parameter	Value
Deployment	On-premises, Fortify on Demand (SaaS), Hybrid
SAST	33+ languages, 1000+ vulnerability categories
DAST	Web apps, APIs (REST, SOAP, GraphQL)
SCA	NVD, proprietary vulnerability database
Standards	OWASP Top 10, SANS 25, CWE, PCI DSS
Integration	Jenkins, Azure DevOps, GitLab, GitHub, IDE
Reporting	SSC dashboard, PDF, CSV, SARIF

FAQ

SAST or DAST - which to choose? Both. SAST finds problems in code (early, more false positives). DAST tests running application (later, fewer FP). Together they provide best coverage.

How long does SAST scan take? Depends on code size. Small project: minutes. Large enterprise: hours. Can scan incrementally (only changed code).

Can WebInspect “break” the application? DAST is active testing - may trigger errors. Don’t run on production without preparation. Staging/QA is the best environment.

What about false positives? SAST generates more FP. Fortify has “Audit Workbench” for triage. You can mark FP - they won’t return in future scans.

Fortify on Demand vs on-premises? FoD is SaaS - code sent to OpenText cloud. On-prem for sensitive code (finance, government). Hybrid also possible.

How to start?

1. Choose pilot applications
2. Install SAST in CI/CD
3. Train developers with Audit Workbench
4. Add DAST before prod
5. Expand to portfolio

Does nFlo implement Fortify? Yes. SAST/DAST/SCA deployments, CI/CD integration, developer training, SSC configuration.