We performed a comparison between Mend and Micro Focus Fortify on Demand based on real PeerSpot user reviews.
Find out in this report how the two Application Security Tools solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The most valuable feature is the static scan that checks for security issues."
"The main feature that I have found valuable is the solution's ability to find issues in static analysis. Additionally, there are plenty of useful tools."
"The dynamic scanning tool is what I like the best. Compared to other tools that I've used for dynamic scanning, it's much faster and easier to use."
"It's comprehensive from a feature standpoint."
"Good static analysis and dynamic analysis."
"The Security Labs [is] where I have the developers training and constantly improving their security, and remembering their security techniques. That way, they are more proactive and make sure things are correct. They're faster because they're doing it in the first place."
"Veracode's technical support is great. They assigned us a TAM and once a week, we have a brief engagement with the TAM to verify that everything's going well. If we have any outstanding issues, they get serviced and addressed."
"I like Veracode's integration with our CI/CD. It automatically scans our code when we do the build. It can also detect any security flaws in our third-party libraries. Veracode is good at pinpointing the sections of code that have vulnerabilities."
"WhiteSource helped reduce our mean time to resolution since the adoption of the product."
"The vulnerability analysis is the best aspect of the solution."
"There are multiple different integrations there. We use Mend for CI/CD that goes through Azure as well. It works seamlessly. We never have any issues with it."
"I am the organizational deployment administrator for this tool, and I, along with other users in our company, especially the security team, appreciate the solution for several reasons. The UI is excellent, and scanning for security threats fits well into our workflow."
"The solution boasts a broad range of features and covers much of what an ideal SCA tool should."
"WhiteSource is unique in the scanning of open-source licenses. Additionally, the vulnerabilities aspect of the solution is a benefit. We don't use WhiteSource in the whole organization, but we use it for some projects. There we receive a sense of the vulnerabilities of the open-source components, which improves our security work. The reports are automated which is useful."
"The inventory management as well as the ability to identify security vulnerabilities has been the most valuable for our business."
"The results and the dashboard they provide are good."
"Fortify supports most languages. Other tools are limited to Java and other typical languages. IBM's solutions aren't flexible enough to support any language. Fortify also integrates with lots of tools because it has API support."
"The most valuable features are the detailed reporting and the ability to set up deep scanning of the software, both of which are in the same place."
"The vulnerability detection and scanning are awesome features."
"It is an extremely robust, scalable, and stable solution."
"Fortify on Demand's best feature is that there's no need to install and configure it locally since it's on the cloud."
"The features that I have found most valuable include its security scan, the vulnerability finds, and the web interface to search and review the issues."
"The user interface is good."
"The most valuable features are the server, scanning, and it has helped identify issues with the security analysis."
"We get some false positives with JavaScript languages like React, TypeScript, and Angular. The problem is rooted in the build process of JavaScript, not the code we are using. This is something we spend lots of time trying to resolve. When we point to a specific library and review that on the code, we can see it is a part of the build that isn't going into production. It's only a part of the build because JavaScript has a different build process."
"The zip file scanning has room for improvement."
"One of the most important areas that need improvement for Veracode is its DaaS. Veracode's DAST engines are primitive."
"Their platform is not consistent. It needs a lot of user experience updates. It's slow performing, and they log you out of the system every 15 minutes, so using the platform is challenging from a developer's perspective because you always have to log in."
"Veracode's ease of use could be improved. I would also like to see more online videos and tutorials that could help us understand the product better. It would also be helpful if Veracode created a certification program for DevSecOps staff to learn about their product and get certified. This kind of training would raise the company's profile within the industry."
"The solution could improve the Dynamic Analysis Security Testing(DAST)."
"We are testing Veracode's software composition analysis, but we're having trouble integrating it with SVN. It works out of the box when you use Git but doesn't work as well with other tools like SVN. It's more geared toward Git"
"I've seen slightly better static analysis tools from other companies when it comes to speed and ease of use."
"I would like to see the static analysis included with the open-source version."
"The turnaround time for upgrading databases for this tool as well as the accuracy could be improved."
"The initial setup could be simplified."
"It should support multiple SBOM formats to be able to integrate with old industry standards."
"The solution lacks the code snippet part."
"They're working on a UI refresh. That's probably been one of the pain points for us as it feels like a really old application."
"We have been looking at how we could improve the automation to human involvement ratio from 60:40 to 70:30, or even potentially 80:20, as there is room for improvement here. We are discussing this internally and with Mend; they are very accommodating to us. We think they openly receive our feedback and do their best to implement our thoughts into the roadmap."
"Mend supports most of the common package managers, but it doesn't support some that we use. I would appreciate it if they can quickly make these changes to add new package managers when necessary."
"The UI could be better. Fortify should also suggest new packages in the product that can be upgraded. Currently, it shows that, but it's not visible enough. In future versions, I would like more insights about the types of vulnerabilities and the pages associated with the exact CVE."
"Integration to CI/CD pipelines could be improved. The reporting format could be more user friendly so that it is easy to read."
"Micro Focus Fortify on Demand cannot be run from a Linux Agent. When we are coding the endpoint it will not work, we have to use Windows Agent. This is something they could improve."
"In terms of what could be improved, we need more strategic analysis reports, not just for one specific application, but for the whole enterprise. In the next release, we need more reports and more analytic views for all the applications. There is no enterprise view in Fortify. I would like enterprise views and reports."
"Fortify on Demand could be improved with support in Russia."
"We have some stability issues, but they are minimal."
"There are many false positives identified by the solution."
"It does scanning for all virtual machines and other things, but it doesn't do the scanning for containers. It currently lacks the ability to do the scanning on containers. We're asking their product management team to expand this capability to containers."
More Micro Focus Fortify on Demand Pricing and Cost Advice →
Application security starts with secure code. Find out more about the benefits of using Veracode to keep your software secure throughout the development lifecycle.
Mend is ranked 4th in Application Security Tools with 13 reviews while Micro Focus Fortify on Demand is ranked 12th in Application Security Tools with 19 reviews. Mend is rated 8.2, while Micro Focus Fortify on Demand is rated 7.8. The top reviewer of Mend writes "Easy to use, great for finding vulnerabilities, and simple to set up". On the other hand, the top reviewer of Micro Focus Fortify on Demand writes "High performance, useful security scanning, but cannot operate from a Linux Agent". Mend is most compared with SonarQube, Black Duck, Snyk, Checkmarx and GitLab, whereas Micro Focus Fortify on Demand is most compared with SonarQube, Checkmarx, Fortify WebInspect, Coverity and Snyk. See our Mend vs. Micro Focus Fortify on Demand report.
See our list of best Application Security Tools vendors.
We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
