No more typing reviews! Try our Samantha, our new voice AI agent.

OpenText Core Application Security vs Ox Security comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 29, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

OpenText Core Application S...
Ranking in Static Application Security Testing (SAST)
9th
Average Rating
8.0
Reviews Sentiment
7.0
Number of Reviews
64
Ranking in other categories
Application Security Tools (11th)
Ox Security
Ranking in Static Application Security Testing (SAST)
24th
Average Rating
8.6
Reviews Sentiment
7.5
Number of Reviews
2
Ranking in other categories
Software Composition Analysis (SCA) (15th), Software Supply Chain Security (9th), Application Security Posture Management (ASPM) (10th)
 

Mindshare comparison

As of August 2026, in the Static Application Security Testing (SAST) category, the mindshare of OpenText Core Application Security is 3.2%, down from 4.1% compared to the previous year. The mindshare of Ox Security is 1.2%, up from 0.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Static Application Security Testing (SAST) Mindshare Distribution
ProductMindshare (%)
OpenText Core Application Security3.2%
Ox Security1.2%
Other95.6%
Static Application Security Testing (SAST)
 

Featured Reviews

Himanshu_Tyagi - PeerSpot reviewer
Lead Cybersecurity at TBO
Supports secure development pipelines and improves issue detection but limits internal visibility and needs broader dashboard integration
If you have an internal team and you want your internal team to validate false positives, basically to determine whether it's a valid issue or an invalid issue, then I wouldn't recommend it much. That was the only reason we migrated from Fortify on Demand to another solution. Fortify has another tool which is Fortify WebInspect. On Demand is the outsourcing solution, and WebInspect you can use with your in-house team, which is basically the product developed by the Fortify team. For automated scanning, Fortify helps a lot. Regarding the visibility for the internal team, everyone is moving toward the DevSecOps side, and Fortify team has made good progress that you can integrate into your CICD pipeline. One thing I would highlight is if Fortify can focus more on the centralized dashboard of the tools because nowadays, tools such as SentinelOne also exist for identifying security issues, but they have a centralized dashboard that merges their cloud solution and application security side solution together. If you have one tool that works for different solutions, it helps a lot. They are doing good, but they should invest more on the AI side as well because AI security is evolving these days. On the cloud side, they have already made good progress, but I believe they should explore the new area related to AI security as well.
Yossi Shmulevitch - PeerSpot reviewer
Owner at SoftContact
Experience has raised visibility into vulnerabilities but still demands deeper customization options
Regarding threat detection capability, I think that Ox Security is not used for that matter. The CISO mainly focuses on dev sec ops rather than runtime security or real-time security. I figure that the most important metrics for the analytics feature are the critical issues dashboard, which helps understand whether there is a leak of a secret or a very critical vulnerability that is not being used. Another important aspect is the integration with other products like JFrog and X-ray, which shows not all the findings but mostly focuses on what Ox Security considers the most important issues. For instance, we found some issues that were flagged by JFrog, but Ox Security dismissed them, leading to discussions about whether those issues are real, as there are often false positives in the security world, as well as considerations about the attack surface for each vulnerability and whether these are truly critical issues or not. I work extensively with JFrog X-ray, which is my major tool for another customer. I believe that JFrog is more pinpointing, and I have some integration with JFrog with the build system, the CI/CD and X-ray vulnerabilities meter. It's quite useful, but I think that they serve different purposes; JFrog comes mostly from the artifact management side and less from security. Ox Security is mostly focused on the DevSecOps and areas that cannot be detected. In terms of vulnerability management, Ox Security has strong integration, but sometimes there are vulnerabilities that are disputed or dismissed, which creates an interesting intersection between the two products. From what I talked about with the DevOps team, deployment is quite straightforward. My overall review rating for Ox Security is zero.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Because of the kind of products we deal with, and the kind of customers we have, we have really specific security requirements and practices we need to follow, specifically applying to our SDLC."
"The static code analyzers are the most valuable features of this solution."
"It's a stable and scalable solution."
"Fortify is effective in identifying such oversights, making it a really helpful tool despite its problems."
"There is not only one specific feature that we find valuable. The idea is to integrate the solution in DevSecOps which we were able to do."
"Micro Focus WebInspect and Fortify code analysis tools are fully integrated with SSC portals and can instantly register to error tracking systems, like TFS and JIRA."
"Fortify helps us to stay updated with the newest languages and versions coming out."
"Overall, it is a very good tool and it works well for what it is designed for."
"Ox Security has positively impacted my organization by helping to reduce the amount of noise we received from vulnerabilities because of the prioritization scoring it has and all of the context it provides."
"As a service provider, I believe the biggest advantage of Ox Security is its simplicity and the clarity of the issues, along with a very good dashboard showing the state of the company."
 

Cons

"There were some regulated compliances, which were not there."
"Technical support is 6/10. I find the Internet to be more helpful at times than their own tech support in finding answers."
"The reporting capabilities need improvement, as there are some features that we would like to have but are not available at the moment."
"It would be useful if they could integrate secure design reviews, security user stories in Fortify on Demand Portal, and also look for possible options to get just one view of risks for given services (Covering Application, Infrastructure, Pen. Test, etc.)."
"Fortify on Demand could be improved with support in Russia."
"It natively supports only a few languages. The response time from the support team can also be improved."
".NET code scanning is still dependent on building the code base before running any scan. Also, it's dependent on an IDE such as Visual Studio."
"The thing that could be improved is reducing the cost of usage and including some of the most pricey features, such as dynamic analysis and that sort of functionality, which makes the difference between different types of tools."
"My overall review rating for Ox Security is zero."
"The main pain point I have with Ox Security as a tool is the user interface, which can feel quite complex when navigating large datasets."
 

Pricing and Cost Advice

"The solution is expensive and the price could be reduced."
"It's a yearly contract, but I don't remember the dollar amount."
"I believe the rental license is not too expensive, but it provides a lot of information about the vulnerabilities."
"Despite being on the higher end in terms of cost, the biggest value lies in its abilities, including robust features, seamless integration, and high-quality findings."
"The licensing was good because the licenses have the heavy centralized server."
"Buying a license would be feasible for regular use. For intermittent use, the cloud-based option can be used (Fortify on Demand)."
"The subscription model, on a per-scan basis, is a bit expensive. That's another reason we are not using it for all the apps."
"The pricing can be improved because it is complex when compared to the competition."
Information not available
report
Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
909,153 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Manufacturing Company
11%
Construction Company
7%
Outsourcing Company
6%
Financial Services Firm
14%
Manufacturing Company
13%
Computer Software Company
10%
Educational Organization
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business18
Midsize Enterprise8
Large Enterprise46
No data available
 

Questions from the Community

What is your experience regarding pricing and costs for Micro Focus Fortify on Demand?
In comparison with other tools, they're competitive. It is not more expensive than other solutions, but their pricing is competitive. The licenses for Fortify On Demand are generally bought in unit...
What needs improvement with Micro Focus Fortify on Demand?
Areas for improvement should be contextualized post the OpenText acquisition, but back when I was working with Micro Focus, they focused heavily on enterprise-centric solutions. Now, after the acqu...
What is your primary use case for Micro Focus Fortify on Demand?
For OpenText Core Application Security, I currently support a couple of my clients who are using Fortify on Demand for their web application, CRM, and sales platform. Many good features of Fortify ...
What needs improvement with Ox Security?
I'm not sure about flexibility because I didn't try it, so I can't comment on that, but as far as I understand, most of Ox Security is not personalized. I think that most of the tool is quite deter...
What is your primary use case for Ox Security?
I worked with Ox Security as a service provider, not as a representative, but as a user. I use it in my employee capacity, providing services to companies in Israel, and one of them is an insurance...
What advice do you have for others considering Ox Security?
Regarding threat detection capability, I think that Ox Security is not used for that matter. The CISO mainly focuses on dev sec ops rather than runtime security or real-time security. I figure that...
 

Also Known As

Micro Focus Fortify on Demand
No data available
 

Overview

 

Sample Customers

SAP, Aaron's, British Gas, FICO, Cox Automative, Callcredit Information Group, Vital and more.
Information Not Available
Find out what your peers are saying about OpenText Core Application Security vs. Ox Security and other solutions. Updated: August 2026.
909,153 professionals have used our research since 2012.