OWASP Zap vs OpenText Core Application Security comparison

OpenText and OWASP are both solutions in the Static Application Security Testing (SAST) category. OpenText is ranked #12 with an average rating of 7.3, while OWASP is ranked #10 with an average rating of 8.0. OpenText holds a 3.2% mindshare in SAST, compared to OWASP’s 4.3% mindshare. Additionally, 89% of OpenText users are willing to recommend the solution, compared to 88% of OWASP users who would recommend it.

OpenText Core Application S...

Read 62 OpenText Core Application Security reviews

6,541 Views
4,971 Comparison Views

89% willing to recommend

OWASP Zap

Read 41 OWASP Zap reviews

7,405 Views
6,813 Comparison Views

88% willing to recommend

OpenText Core Application S...

OWASP Zap

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Dec 28, 2025

OpenText Core Application Security and OWASP Zap compete in application security testing. OpenText Core Application Security seems to have the upper hand due to its comprehensive feature set and enterprise-grade alignment, whereas OWASP Zap stands out for ease of use and cost-effectiveness.

Features: OpenText Core Application Security is acclaimed for its in-depth static and dynamic analysis, seamless CI/CD integration, and expert-reviewed vulnerability results. It offers comprehensive dashboards with remediation guidance. Meanwhile, OWASP Zap is valued for its open-source accessibility, simple UI, and essential security scanning capabilities, which are advantageous for smaller setups.

Room for Improvement: OpenText Core Application Security could benefit from enhanced visual reporting, better false positive management, and expanded language support. OWASP Zap's documentation and advanced integration capabilities need enhancement. Improvements in support for complex architectures and reduction of false positives are also needed.

Ease of Deployment and Customer Service: OpenText Core Application Security supports multiple cloud deployments with flexible enterprise options. Its customer service is proficient but could improve response times. OWASP Zap is straightforward for individual setups, mainly deployed on-premises, but requires more technical expertise for large-scale implementations. Its community-driven support is a strong compensatory factor.

Pricing and ROI: OpenText Core Application Security is perceived as costly, posing a barrier for smaller companies. Nonetheless, its extensive features justify the investment for enterprises with stringent security needs, offering significant ROI through reduced security incidents. In contrast, OWASP Zap, as a free open-source solution, is an attractive choice for cost-effective security testing in smaller teams.

To learn more, read our detailed OWASP Zap vs. OpenText Core Application Security Report (Updated: December 2025).

Buyer's Guide

OWASP Zap vs. OpenText Core Application Security

December 2025

Download the complete report

Helped 879,259 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

OpenText Core Application S...

Ranking in Static Application Security Testing (SAST)

12th

Average Rating

8.0

Reviews Sentiment

6.7

Number of Reviews

Ranking in other categories

Application Security Tools (13th)

OWASP Zap

Ranking in Static Application Security Testing (SAST)

10th

Average Rating

7.6

Reviews Sentiment

7.3

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of December 2025, in the Static Application Security Testing (SAST) category, the mindshare of OpenText Core Application Security is 3.2%, down from 5.0% compared to the previous year. The mindshare of OWASP Zap is 4.3%, down from 4.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST) Market Share Distribution
Product	Market Share (%)
OWASP Zap	4.3%
OpenText Core Application Security	3.2%
Other	92.5%

Static Application Security Testing (SAST)

Featured Reviews

Himanshu_Tyagi

Lead Cybersecurity at TBO

Supports secure development pipelines and improves issue detection but limits internal visibility and needs broader dashboard integration

If you have an internal team and you want your internal team to validate false positives, basically to determine whether it's a valid issue or an invalid issue, then I wouldn't recommend it much. That was the only reason we migrated from Fortify on Demand to another solution. Fortify has another tool which is Fortify WebInspect. On Demand is the outsourcing solution, and WebInspect you can use with your in-house team, which is basically the product developed by the Fortify team. For automated scanning, Fortify helps a lot. Regarding the visibility for the internal team, everyone is moving toward the DevSecOps side, and Fortify team has made good progress that you can integrate into your CICD pipeline. One thing I would highlight is if Fortify can focus more on the centralized dashboard of the tools because nowadays, tools such as SentinelOne also exist for identifying security issues, but they have a centralized dashboard that merges their cloud solution and application security side solution together. If you have one tool that works for different solutions, it helps a lot. They are doing good, but they should invest more on the AI side as well because AI security is evolving these days. On the cloud side, they have already made good progress, but I believe they should explore the new area related to AI security as well.

Read full review

Prasant Pokarnaa

Delivery Head - DevOps at Datamato Technologies

Effective vulnerability identification enhances security scans but AI-driven enhancements are needed

OWASP is only meant for two or three different types of scans. It is a tool which will scan the code for security for vulnerabilities We were able to convince the customers to really remove those rules when GitLab was able to show the results. Customers should be aware that GitLab is not just a…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The solution is user-friendly."

"It is a very easy tool for developers to use in parallel while they're doing the coding. It does auto scanning as we are progressing with the CI/CD pipeline. It has got very simple and efficient API support."

"The most valuable feature of Micro Focus Fortify on Demand is the information it can provide. There is quite a lot of information. It can pinpoint right down to where the problem is, allowing you to know where to fix it. Overall the features are easy to use, you don't have to be a coder. You can be a manager, or in IT operations, et cetera, anyone can use it. It is quite a well-rounded functional solution."

"The solution scans our code and provides us with a dashboard of all the vulnerabilities and the criticality of the vulnerabilities. It is very useful that they provide right then and there all the information about the vulnerability, including possible fixes, as well as some additional documentation and links to the authoritative sources of why this is an issue and what's the correct way to deal with it."

"The UL is easy to use compared to that of other tools, and it is highly reliable. The findings provide a lower number of false positives."

"Micro Focus WebInspect and Fortify code analysis tools are fully integrated with SSC portals and can instantly register to error tracking systems, like TFS and JIRA."

"Provides good depth of scanning and we get good results."

"Fortify on Demand's best feature is that there's no need to install and configure it locally since it's on the cloud."

More OpenText Core Application Security pros

"The best feature is the Zap HUD (Heads Up Display) because the customers can use the website normally. If we scan websites with automatic scanning, and the website has a web application firewall, it's very difficult."

"You can run it against multiple targets."

"We use the solution for security testing."

"They offer free access to some other tools."

"The solution has tightened our security."

"It has improved my organization with faster security tests."

"It's great that we can use it with Portswigger Burp."

"Fuzzer and Java APIs help a lot with our custom needs."

More OWASP Zap pros

Cons

"Reporting could be improved."

"Integration to CI/CD pipelines could be improved. The reporting format could be more user friendly so that it is easy to read."

"New technologies and DevOps could be improved. Fortify on Demand can be slow (slower than other vendors) to support new technologies or new software versions."

"In terms of what could be improved, we need more strategic analysis reports, not just for one specific application, but for the whole enterprise. In the next release, we need more reports and more analytic views for all the applications. There is no enterprise view in Fortify. I would like enterprise views and reports."

"It does scanning for all virtual machines and other things, but it doesn't do the scanning for containers. It currently lacks the ability to do the scanning on containers. We're asking their product management team to expand this capability to containers."

"The UI could be better. Fortify should also suggest new packages in the product that can be upgraded. Currently, it shows that, but it's not visible enough. In future versions, I would like more insights about the types of vulnerabilities and the pages associated with the exact CVE."

"They have very good support, but there is always room for improvement."

"We have some stability issues, but they are minimal."

More OpenText Core Application Security cons

"When comparing OWASP Zap and Burp Suite, the main difference besides pricing is that OWASP Zap has limitations with reporting levels and UI, which affects its reporting capabilities, whereas Burp Suite is already advancing with new AI features and scanning capabilities that OWASP Zap seems to be lacking."

"Zap could improve by providing better reports for security and recommendations for the vulnerabilities."

"There are too many false positives."

"There isn't too much information about it online."

"I prefer Burp Suite to SWASP Zap because of the extensive coverage it offers."

"The work that it does in the limited scope is good, but the scope is very limited in terms of the scanning features. The number of things it tests or finds is limited. They need to make it a more of a mainstream tool that people can use, and they can even think about having it on a proprietary basis. They need to increase the coverage of the scan and the results that it finds. That has always been Zap's limitation. Zap is a very good tool for a beginner, but once you start moving up the ladder where you want further details and you want your scan to show more in-depth results, Zap falls short because its coverage falls short. It does not have the capacity to do more."

"There's very little documentation that comes with OWASP Zap."

"Lacks resources where users can internally access a learning module from the tool."

More OWASP Zap cons

Pricing and Cost Advice

"The pricing can be improved because it is complex when compared to the competition."

"The product's cost depends on the type of license."

"Buying a license would be feasible for regular use. For intermittent use, the cloud-based option can be used (Fortify on Demand)."

"I believe the rental license is not too expensive, but it provides a lot of information about the vulnerabilities."

"There are different costs for Micro Focus Fortify on Demand depending on the assessments you want to use. There is only a standard license needed to use the solution."

"Despite being on the higher end in terms of cost, the biggest value lies in its abilities, including robust features, seamless integration, and high-quality findings."

"Fortify on Demand is affordable, and its licensing comes with a year of support."

"Their subscriptions could use a little bit of a reworking, but I am very happy with what they're able to provide."

More OpenText Core Application Security pricing and cost advice

"The tool is open-source."

"OWASP ZAP is a free tool provided by OWASP’s engineers and experts. There is an option to donate."

"It's free. It's good for us because we don't know what the extent of our use will be yet. It's good to start with something free and easy to use."

"This app is completely free and open source. So there is no question about any pricing."

"This is an open-source solution and can be used free of charge."

"OWASP Zap is free to use."

"It is open source, and we can scan freely."

"We have used the freeware version. I believe Zap only has freeware."

More OWASP Zap pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

879,259 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

18%

Manufacturing Company

14%

Computer Software Company

Government

Computer Software Company

14%

Financial Services Firm

University

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	17
Midsize Enterprise	8
Large Enterprise	44

By reviewers
Company Size	Count
Small Business	11
Midsize Enterprise	11
Large Enterprise	21

Questions from the Community

What do you like most about Micro Focus Fortify on Demand?

It helps deploy and track changes easily as per time-to-time market upgrades.

See all answers

What is your experience regarding pricing and costs for Micro Focus Fortify on Demand?

In comparison with other tools, they're competitive. It is not more expensive than other solutions, but their pricing is competitive. The licenses for Fortify On Demand are generally bought in unit...

See all answers

What needs improvement with Micro Focus Fortify on Demand?

See all answers

Is OWASP Zap better than PortSwigger Burp Suite Pro?

OWASP Zap and PortSwigger Burp Suite Pro have many similar features. OWASP Zap has web application scanning available with basic security vulnerabilities while Burp Suite Pro has it available with ...

See all answers

What do you like most about OWASP Zap?

The best feature is the Zap HUD (Heads Up Display) because the customers can use the website normally. If we scan websites with automatic scanning, and the website has a web application firewall, i...

See all answers

What is your experience regarding pricing and costs for OWASP Zap?

OWASP might be cost-effective, however, people prefer to use the free edition available as open source.

See all answers

Comparisons

SonarQube vs OpenText Core Application Security

Compared 15% of the time

Checkmarx One vs OpenText Core Application Security

Compared 12% of the time

Coverity Static vs OpenText Core Application Security

Compared 9% of the time

Veracode vs OpenText Core Application Security

Compared 8% of the time

DerScanner vs OpenText Core Application Security

Compared 3% of the time

More OpenText Core Application Security Competitors

SonarQube vs OWASP Zap

Compared 19% of the time

Acunetix vs OWASP Zap

Compared 14% of the time

Checkmarx One vs OWASP Zap

Compared 9% of the time

Veracode vs OWASP Zap

Compared 9% of the time

OpenText Dynamic Application Security Testing vs OWASP Zap

Compared 3% of the time

More OWASP Zap Competitors

Product Reports

Buyer's Guide

OpenText Core Application Security

December 2025

OpenText Core Application Security report

Download OpenText Core Application Security product report

Buyer's Guide

OWASP Zap

December 2025

Download OWASP Zap product report

Also Known As

Micro Focus Fortify on Demand

No data available

Overview

OpenText Core Application Security offers robust features like static and dynamic scanning, real-time vulnerability tracking, and seamless integration with development platforms, designed to enhance code security and reduce operational costs.

OpenText Core Application Security is a cloud-based, on-demand service providing accurate and deep scanning capabilities with detailed reporting. Its integrations with development platforms ensure an enhanced security layer in the development lifecycle, benefiting users by lowering operational costs and facilitating efficient remediation. The platform addresses needs for intuitive interfaces, API support, and comprehensive vulnerability assessments, helping improve code security and accelerate time-to-market. Despite its strengths, challenges exist around false positives, report clarity, and language support, alongside confusing pricing and package options. Enhancements are sought in areas like CI/CD pipeline configuration, report visualization, scan times, and integration with third-party tools such as GitLab, container scanning, and software composition analysis.

What features define OpenText Core Application Security?

Static and Dynamic Scanning: Offers thorough analysis to identify vulnerabilities during development.
Real-time Vulnerability Tracking: Continuously updates and monitors potential security threats.
Seamless Development Platform Integration: Enhances security processes without disrupting workflows.
Cloud-Based Service: Provides flexible, on-demand security capabilities with accurate results.
API Support: Allows smooth integration and automation within existing systems.

What benefits should users look for in reviews?

Reduced Operational Costs: Optimizes resources by lowering costs associated with security management.
Efficient Remediation: Speeds up the process of identifying and resolving vulnerabilities.
Enhanced Code Security: Strengthens overall application security during the development lifecycle.
Accelerated Time-to-Market: Streamlines development stages by integrating essential security tools.

Industries like mobile applications, e-commerce, and banking leverage OpenText Core Application Security for its ability to identify vulnerabilities such as SQL injections. Integrating seamlessly with DevSecOps and security auditing processes, this tool supports developers in writing safer code, ensuring secure application deployment and enhancing software assurance.

OpenText

OWASP Zap is a free and open-source web application security scanner.

The solution helps developers identify vulnerabilities in their web applications by actively scanning for common security issues.

With its user-friendly interface and powerful features, Zap is a popular choice among developers for ensuring the security of their web applications.

OWASP

Sample Customers

SAP, Aaron's, British Gas, FICO, Cox Automative, Callcredit Information Group, Vital and more.

1. Google 2. Microsoft 3. IBM 4. Amazon 5. Facebook 6. Twitter 7. LinkedIn 8. Netflix 9. Adobe 10. PayPal 11. Salesforce 12. Cisco 13. Oracle 14. Intel 15. HP 16. Dell 17. VMware 18. Symantec 19. McAfee 20. Citrix 21. Red Hat 22. Juniper Networks 23. SAP 24. Accenture 25. Deloitte 26. Ernst & Young 27. PwC 28. KPMG 29. Capgemini 30. Infosys 31. Wipro 32. TCS

Buyer's Guide

OWASP Zap vs. OpenText Core Application Security

December 2025

Free Report: OWASP Zap vs. OpenText Core Application Security

Find out what your peers are saying about OWASP Zap vs. OpenText Core Application Security and other solutions. Updated: December 2025.

DOWNLOAD NOW

879,259 professionals have used our research since 2012.

See our OWASP Zap vs. OpenText Core Application Security report.

See our list of best Static Application Security Testing (SAST) vendors.

We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.