No more typing reviews! Try our Samantha, our new voice AI agent.

Contrast Security Assess vs OpenText Core Application Security comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 29, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Contrast Security Assess
Ranking in Application Security Tools
32nd
Ranking in Static Application Security Testing (SAST)
26th
Average Rating
8.8
Reviews Sentiment
7.2
Number of Reviews
11
Ranking in other categories
No ranking in other categories
OpenText Core Application S...
Ranking in Application Security Tools
12th
Ranking in Static Application Security Testing (SAST)
9th
Average Rating
8.0
Reviews Sentiment
7.0
Number of Reviews
64
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of May 2026, in the Application Security Tools category, the mindshare of Contrast Security Assess is 1.6%, up from 0.6% compared to the previous year. The mindshare of OpenText Core Application Security is 3.1%, down from 4.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools Mindshare Distribution
ProductMindshare (%)
OpenText Core Application Security3.1%
Contrast Security Assess1.6%
Other95.3%
Application Security Tools
 

Featured Reviews

ToddMcAlister - PeerSpot reviewer
Lead Application and Data Security Engineer at a insurance company with 5,001-10,000 employees
It has an excellent API interface to pull APIs.
Assess has brought our development time down because it helps create code the first time. Instead of going through the Jenkins process to build an application, they can see right off the bat that if there are errors in the code and fix them before it even goes to build.
Himanshu_Tyagi - PeerSpot reviewer
Lead Cybersecurity at TBO
Supports secure development pipelines and improves issue detection but limits internal visibility and needs broader dashboard integration
If you have an internal team and you want your internal team to validate false positives, basically to determine whether it's a valid issue or an invalid issue, then I wouldn't recommend it much. That was the only reason we migrated from Fortify on Demand to another solution. Fortify has another tool which is Fortify WebInspect. On Demand is the outsourcing solution, and WebInspect you can use with your in-house team, which is basically the product developed by the Fortify team. For automated scanning, Fortify helps a lot. Regarding the visibility for the internal team, everyone is moving toward the DevSecOps side, and Fortify team has made good progress that you can integrate into your CICD pipeline. One thing I would highlight is if Fortify can focus more on the centralized dashboard of the tools because nowadays, tools such as SentinelOne also exist for identifying security issues, but they have a centralized dashboard that merges their cloud solution and application security side solution together. If you have one tool that works for different solutions, it helps a lot. They are doing good, but they should invest more on the AI side as well because AI security is evolving these days. On the cloud side, they have already made good progress, but I believe they should explore the new area related to AI security as well.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable feature is the continuous monitoring aspect: the fact that we don't have to wait for scans to complete for the tool to identify vulnerabilities. They're automatically identified through developers' business-as-usual processes."
"Contrast was a very complete solution; it met all of our technical requirements and it was really the only IAST product that felt like a real product."
"The solution is very accurate in identifying vulnerabilities. In cases where we are performing application assessment using Contrast Assess, and also using legacy application security testing tools, Contrast successfully identifies the same vulnerabilities that the other tools have identified but it also identifies significantly more. In addition, it has visibility into application components that other testing methodologies are unaware of."
"No other tool does the runtime scanning like Contrast does. Other static analysis tools do static scanning, but Contrast is runtime analysis, when the routes are exercised. That's when the scan happens. This is a tool that has a very unique capability compared to other tools. That's what I like most about Contrast, that it's runtime."
"By far, the thing that was able to provide value was the immediate response while testing ahead of release, in real-time."
"It is a stable solution...Contrast Security Assess is one of the first players in this market, so they have experience and customers, especially abroad. Overall, it's a good product."
"The accuracy of the solution in identifying vulnerabilities is better than any other product we've used, far and away."
"Assess has brought our development time down because it helps create code the first time."
"What is most useful is how you can have related features upgraded on the tools."
"HP Fortify on Demand provides an independent review of third-party applications, allowing organizations to test software before purchasing, and also allowing software vendors to demonstrate the security of their software."
"The features I found most valuable is that it is very configurable and the installation was also very easy."
"I don’t know of any other On-Demand enterprise solution like this one where we can load the details and within a few days, receive the results of intrusion attacks, and work with HP Security Experts when needed for clarification"
"Fortify on Demand has helped us more easily ensure the security of our client's application, which works with sensitive information such as payments and taxation."
"To my mind, the best features of this product are its speed and efficiency."
"Overall, it is a very good tool and it works well for what it is designed for."
"Each bank may have its own core banking applications with proprietary support for different programming languages. This makes Fortify particularly relevant and advantageous in those cases."
 

Cons

"I would like to see them come up with more scanning rules."
"The solution needs to improve flexibility...The scalability of the product is a problem in the solution, especially from a commercial perspective."
"The product's retesting part needs improvement. The tool also needs improvement in the suggestions provided for fixing vulnerabilities. It relies more on documentation rather than on quick fixes."
"The out-of-the-box reporting could be improved. We need to write our own APIs to make the reporting more robust."
"Personalization of the board and how to make it appealing to an organization is something that could be done on their end."
"I think there was activity underway to support the centralized configuration control. There are ways to do it, but I think they were productizing more of that."
"I think there was activity underway to support the centralized configuration control. There are ways to do it, but I think they were productizing more of that."
"I would like to see them come up with more scanning rules."
"I would like the solution to add AI support."
"The solution has some issues with latency. Sometimes it takes a while to respond. This issue should be addressed."
"As of now, the interface to give restricted access to the developers is not the best. It gives them more access than what is basically required, but we don't want over-provisioning and over-access."
"They can also improve the securability a bit more because security is one of the biggest aspects these days when you are using the cloud."
"I would advise others not to use Fortify, but rather get something like Veracode or Checkmarx."
"The Visual Studio plugin seems to hang when a scan is run on big projects."
"It could have a little bit more streamlined installation procedure. Based on the things that I've done, it could also be a bit more automated. It is kind of taking a bunch of different scanners, and SSC is just kind of managing the results. The scanning doesn't really seem to be fully integrated into the SSC platform. More automation and any kind of integration in the SSC platform would definitely be good. There could be a way to initiate scans from SSC and more functionality on the server-side to initiate desk scans if it is not already available."
".NET code scanning is still dependent on building the code base before running any scan. Also, it's dependent on an IDE such as Visual Studio."
 

Pricing and Cost Advice

"I like the per-application licensing model... We just license the app and we look at different vulnerabilities on that app and we remediate within the app. It's simpler."
"The good news is that the agent itself comes in two different forms: the unlicensed form and the licensed form. Unlicensed gives use of that software composition analysis for free. Thereafter, if you apply a license to that same agent, that's when the instrumentation takes hold. So one of my suggestions is to do what we're doing: Deploy the agent to as many applications as possible, with just the SCA feature turned on with no license applied, and then you can be more choosy and pick which teams will get the license applied."
"The solution is expensive."
"For what it offers, it's a very reasonable cost. The way that it is priced is extremely straightforward. It works on the number of applications that you use, and you license a server. It is something that is extremely fair, because it doesn't take into consideration the number of requests, etc. It is only priced based on the number of onboarded applications. It suits our model as well, because we have huge traffic. Our number of applications is not that large, so the pricing works great for us."
"It's a tiered licensing model. The more you buy, as you cross certain quantity thresholds, the pricing changes. If you have a smaller environment, your licensing costs are going to be different than a larger environment... The licensing is primarily per application. An application can be as many agents as you need. If you've got 10 development servers and 20 production servers and 50 QA servers, all of those agents can be reporting as a single application that utilizes one license."
"The product's pricing is low. I would rate it a two out of ten."
"You only get one license for an application. Ours are very big, monolithic applications with millions of lines of code. We were able to apply one license to one monolithic application, which is great. We are happy with the licensing. Pricing-wise, they are industry-standard, which is fine."
"Their subscriptions could use a little bit of a reworking, but I am very happy with what they're able to provide."
"The pricing model it's based on how many applications you wish to scan."
"The solution is a little expensive."
"We used the one-time application, Security Scan Dynamic. I believe the original fee was $8,000."
"The licensing was good because the licenses have the heavy centralized server."
"I'd rate it an eight out of ten in terms of pricing."
"The pricing can be improved because it is complex when compared to the competition."
"It is quite expensive. Pricing and the licensing model could be improved."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
893,221 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
17%
Manufacturing Company
11%
Comms Service Provider
8%
Computer Software Company
6%
Financial Services Firm
14%
Manufacturing Company
13%
Computer Software Company
7%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise3
Large Enterprise6
By reviewers
Company SizeCount
Small Business18
Midsize Enterprise8
Large Enterprise45
 

Questions from the Community

Ask a question
Earn 20 points
What is your experience regarding pricing and costs for Micro Focus Fortify on Demand?
In comparison with other tools, they're competitive. It is not more expensive than other solutions, but their pricing is competitive. The licenses for Fortify On Demand are generally bought in unit...
What needs improvement with Micro Focus Fortify on Demand?
Areas for improvement should be contextualized post the OpenText acquisition, but back when I was working with Micro Focus, they focused heavily on enterprise-centric solutions. Now, after the acqu...
What is your primary use case for Micro Focus Fortify on Demand?
For OpenText Core Application Security, I currently support a couple of my clients who are using Fortify on Demand for their web application, CRM, and sales platform. Many good features of Fortify ...
 

Also Known As

Contrast Assess
Micro Focus Fortify on Demand
 

Overview

 

Sample Customers

Williams-Sonoma, Autodesk, HUAWEI, Chromeriver, RingCentral, Demandware.
SAP, Aaron's, British Gas, FICO, Cox Automative, Callcredit Information Group, Vital and more.
Find out what your peers are saying about Contrast Security Assess vs. OpenText Core Application Security and other solutions. Updated: April 2026.
893,221 professionals have used our research since 2012.