

OpenText Core Application Security and Harness both compete in the application security market. Harness seems to have the upper hand given its comprehensive features and flexibility in deployment and customer service.
Features: OpenText Core Application Security features include strong security management, automated compliance, and a centralized dashboard for real-time monitoring. Harness, on the other hand, provides seamless integration, intelligent automation, and granular access control, making it highly efficient in diverse environments.
Room for Improvement: OpenText could enhance integration capabilities and flexibility in deployment options. Harness may require improvements in initial configuration ease and cost-effectiveness for smaller-scale deployments. Both products could benefit from enhanced user interfaces and reporting features.
Ease of Deployment and Customer Service: OpenText provides extensive onboarding support, facilitating a swift deployment process, ideal for businesses focusing on efficient setup. Harness offers a flexible deployment model with comprehensive customer support, addressing diverse operational requirements effectively.
Pricing and ROI: OpenText delivers budget-friendly solutions with quick ROI potential, appealing to short-term budget-conscious projects. Harness demands a higher initial investment, but its advanced features and scalability promise greater long-term ROI, making it appealing for businesses seeking extensive functionality.
The AI features that they have and with which we can rewrite the pipeline and troubleshoot issues significantly saved time.
By adopting templates and various different pipelines across our own IDP platform, we have saved upwards of 30 to 40% of development time.
With Harness, the release process decreased from three or four hours to one or two hours, making deployments much quicker.
There is definitive ROI if OpenText Core Application Security is deployed properly; it substantially reduces efforts in securing the solution while averting various application-related risks.
We have rarely faced issues with Harness tech support.
We have not faced any customer support issues, with tickets resolved in less than a four-day SLA.
There was an instance when I faced issues with third-party plugins, and after raising a support ticket, they responded in a few hours with a documentation link that resolved my issue.
Support tickets often stay open for one month to three months, which leads to customer frustration.
I had direct interaction with them, which facilitated how we onboarded Fortify.
The technical support from OpenText is very good.
Our entire organization uses it with hundreds of applications, and it supports this scale effectively.
It is able to work on our infrastructure side, which is EKS, and we are able to handle our organization growth effectively for an enterprise use case.
When I integrated Harness to more than 20 applications in one place, it becomes less stable.
If a customer wants to know the tools and the technology used for their application to scan their application, they provide less information on that.
OpenText Core Application Security is highly scalable; it is running on the cloud, and elasticity is one of the best points of a cloud environment.
Fortify is superior to many solutions because of its scalability and that it does not require massive compute capabilities for its SAST and sandboxing features.
Harness is completely stable, and we are using it in production without facing any stability issues at all.
We have rarely faced issues with Harness tech support.
Harness is decently stable.
OpenText Core Application Security is stable and has minimal downtime, benefitting from AWS cloud availability.
There is not a lot of good support for pipeline as code, and I often find myself not using pipeline as code the way other platforms such as GitHub Actions or Jenkins integrate pipeline as code.
Improved documentation and onboarding tutorials would help accelerate adoption.
Harness can be improved by providing more clarity on the credits it issues for Harness Cloud, as it has a tiered pricing structure involving license and credit costs, which can get confusing.
It would be beneficial if Fortify could check for CVEs (Common Vulnerabilities and Exposures) in third-party libraries, which I currently use a separate dependency checker tool for.
One thing I would highlight is if Fortify can focus more on the centralized dashboard of the tools because nowadays, tools such as SentinelOne also exist for identifying security issues, but they have a centralized dashboard that merges their cloud solution and application security side solution together.
I would say OpenText Core Application Security is not very user-friendly in terms of price; it is quite high.
From what I understand with respect to Harness, licensing and setup costs were relatively low for an enterprise, and the pricing was more catered toward enterprises who would invest in the technology.
The licensing cost is a little bit too high.
Harness uses AI to suggest errors in case of deployment failures.
The platform also supports cloud-native environments and Kubernetes deployments, making pipeline management easier, and its automation capabilities significantly improve speed and reliability.
If something goes wrong, I can use AI troubleshooting to build or test my fails and analyze the logs, suggesting the fixes.
Fortify helps me find serious issues, such as developers inadvertently leaving access tokens, including API access tokens, in the source code.
On demand you have two levels of reports: the first from the tool, which is the same as we can get from Fortify on-premises, and a next level reporting made by experts from OpenText, leading to a more condensed and precise report as level three.
Additionally, you can integrate Fortify in CICD pipeline, so you get real-time updates about the security issues in your pipeline.
| Product | Mindshare (%) |
|---|---|
| Harness | 0.7% |
| OpenText Core Application Security | 3.2% |
| Other | 96.1% |

| Company Size | Count |
|---|---|
| Small Business | 4 |
| Midsize Enterprise | 1 |
| Large Enterprise | 10 |
| Company Size | Count |
|---|---|
| Small Business | 18 |
| Midsize Enterprise | 8 |
| Large Enterprise | 46 |
Harness offers a comprehensive toolset for automating deployment processes and enhancing software update efficiency. It's lauded for its CI/CD capabilities, feature flagging, and real-time deployment monitoring. Key features include an intuitive UI, secret management, and robust rollback functionalities, all contributing to improved productivity and reduced errors in DevOps environments.
OpenText Core Application Security offers robust features like static and dynamic scanning, real-time vulnerability tracking, and seamless integration with development platforms, designed to enhance code security and reduce operational costs.
OpenText Core Application Security is a cloud-based, on-demand service providing accurate and deep scanning capabilities with detailed reporting. Its integrations with development platforms ensure an enhanced security layer in the development lifecycle, benefiting users by lowering operational costs and facilitating efficient remediation. The platform addresses needs for intuitive interfaces, API support, and comprehensive vulnerability assessments, helping improve code security and accelerate time-to-market. Despite its strengths, challenges exist around false positives, report clarity, and language support, alongside confusing pricing and package options. Enhancements are sought in areas like CI/CD pipeline configuration, report visualization, scan times, and integration with third-party tools such as GitLab, container scanning, and software composition analysis.
What features define OpenText Core Application Security?Industries like mobile applications, e-commerce, and banking leverage OpenText Core Application Security for its ability to identify vulnerabilities such as SQL injections. Integrating seamlessly with DevSecOps and security auditing processes, this tool supports developers in writing safer code, ensuring secure application deployment and enhancing software assurance.
We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.