Try our new research platform with insights from 80,000+ expert users

OpenText Core Application Security vs Qualys Web Application Scanning comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 21, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

OpenText Core Application S...
Ranking in Application Security Tools
13th
Ranking in Static Application Security Testing (SAST)
11th
Average Rating
8.0
Reviews Sentiment
7.8
Number of Reviews
60
Ranking in other categories
No ranking in other categories
Qualys Web Application Scan...
Ranking in Application Security Tools
17th
Ranking in Static Application Security Testing (SAST)
14th
Average Rating
7.6
Reviews Sentiment
6.3
Number of Reviews
40
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of November 2025, in the Application Security Tools category, the mindshare of OpenText Core Application Security is 3.6%, down from 5.0% compared to the previous year. The mindshare of Qualys Web Application Scanning is 2.0%, up from 1.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools Market Share Distribution
ProductMarket Share (%)
OpenText Core Application Security3.6%
Qualys Web Application Scanning2.0%
Other94.4%
Application Security Tools
 

Featured Reviews

Jonathan Steyn - PeerSpot reviewer
Source code analyzer, FPR file generation, reduction of false positives and generates compliance reports, for in-depth analysis
Not challenges with the product itself. The product is very reliable. It does have a steep learning curve. But, again, one thing that Fortify or OpenText does very well is training. There are a lot of free resources and training in the community forums, free training as well as commercial training where users can train on how to use the back-end systems and the scanning engines and how to use command-line arguments because some of the procedures or some of the tools do require a bit of a learning curve. That's the only challenge I've really seen for customers because you have to learn how to use the tool effectively. But Fortify has, in fact, improved its user interface and the way users engage the dashboards and the interfaces. It is intuitive. It's easy to understand. But in some regards, the cybersecurity specialist or AppSec would need a bit of training to engage the user interface and to understand how it functions. But from the point of the reliability index and how powerful the tool is, there's no challenge there. But it's just from a learning perspective; users might need a bit more skill to use the tool. The user interface isn't that tedious. It's not that difficult to understand. When I initially learned how to use the interfaces, I was able to master it within a week and was able to use it quite effectively. So training is required. All skills are needed to learn how to use the tool. I would like to see more enhancements in the dashboards. Dashboards are available. They do need some configuration and settings. But I would like to see more business intelligence capabilities within the tool. It's not particularly a cybersecurity function, but, for instance, business impact analysis or other features where you can actually use business intelligence capabilities within your security tool. That would be remarkable because not only do you have a cybersecurity tool, but you also have a tool that can give you business impact analysis and some other measurements. A bit more intelligence in terms of that from a cybersecurity perspective would be remarkable.
AnkitSharma13 - PeerSpot reviewer
Web scanning needs improvement but offers good vulnerability detection
The downside of Qualys Web Application Scanning is that it cannot crawl automatically. If I provide an IP address and a login form, it does basic testing, but it doesn't go deep as IBM AppScan does. If Qualys Web Application Scanning could improve its crawling capability, it would be more user-friendly. Qualys Web Application Scanning does IP-level testing, requiring direct input of credentials, and can only scan a few pages to provide known generic vulnerabilities, which isn't as beneficial from my point of view. The Vulnerability Management also relies heavily on version numbers and will flag vulnerabilities based on the component version, but it doesn't check if a real fix exists, leading to flags on components that actually have workarounds available.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It improves future security scans."
"The user interface is good."
"Each bank may have its own core banking applications with proprietary support for different programming languages. This makes Fortify particularly relevant and advantageous in those cases."
"The source code analyzer is the most effective for identifying security vulnerabilities."
"The most valuable feature of Micro Focus Fortify on Demand is the information it can provide. There is quite a lot of information. It can pinpoint right down to where the problem is, allowing you to know where to fix it. Overall the features are easy to use, you don't have to be a coder. You can be a manager, or in IT operations, et cetera, anyone can use it. It is quite a well-rounded functional solution."
"The UL is easy to use compared to that of other tools, and it is highly reliable. The findings provide a lower number of false positives."
"What stands out to me is the user-friendliness of each feature."
"Fortify supports most languages. Other tools are limited to Java and other typical languages. IBM's solutions aren't flexible enough to support any language. Fortify also integrates with lots of tools because it has API support."
"Automated scanning has significantly improved our web application security management by reducing manual work."
"The most valuable feature is that we are able to scan the services and put credentials like a user ID password. We can verify the vulnerability level."
"The vulnerability management feature is a strong one. And also the patch management feature."
"With our vulnerabilities under control, it's putting our services in compliance and minimizing our risk for exposure."
"The simplicity of exporting reports and the simplicity and clarity of the reports included with the product are good."
"The tool links vulnerabilities with DDIs and gives a complete overview of the application. The continuous monitoring capability is good."
"Qualys Web Application Scanning is robust and mature from industry standards."
"Qualys' process of updating signatures is something we really appreciate, and it's way ahead of its industry peers."
 

Cons

"There were some regulated compliances, which were not there."
"Micro Focus Fortify on Demand cannot be run from a Linux Agent. When we are coding the endpoint it will not work, we have to use Windows Agent. This is something they could improve."
"Takes up a lot of resources which can slow things down."
"There are lots of limitations with code technology. It cannot scan .net properly either."
"In terms of communication, they can integrate a few more third-party tools. It would be great if we can have more options for microservice communication. They can also improve the securability a bit more because security is one of the biggest aspects these days when you are using the cloud. Some more security features would be really helpful."
"They could provide features for artificial intelligence similar to other vendors."
"It would be highly beneficial if Fortify on Demand incorporated runtime analysis, similar to how Contrast Security utilizes agents for proactive application security."
"The UI could be better. Fortify should also suggest new packages in the product that can be upgraded. Currently, it shows that, but it's not visible enough. In future versions, I would like more insights about the types of vulnerabilities and the pages associated with the exact CVE."
"The scanner reports a lot of false positives, which is something that needs to be improved."
"The authenticated scanning feature could be improved by adding support for real-time scanning tokens and authorization tokens."
"It should have better automatic reporting."
"The pricing does not seem to be competitive."
"They should try to include business logic vulnerabilities in the scanner testing."
"The area of false positives could be improved. There are quite a number of false positives as compared to other solutions. They could probably fine tune the algorithm to be able to reduce the number of false positives being detected."
"I have dealt with Qualys's technical support, and any enhancements are challenging. I would rate them a five out of ten."
"The support could be faster."
 

Pricing and Cost Advice

"The licensing was good because the licenses have the heavy centralized server."
"I'd rate it an eight out of ten in terms of pricing."
"We are still using the trial version at this point but I can already see from the trial version alone that it is a good product. For others, I would say that Fortify on Demand might look expensive at the beginning, but it is very powerful and so you shouldn't be put off by the price."
"The price is fair compared to that of other solutions."
"Fortify on Demand is more expensive than Burpsuite. I rate its pricing a nine out of ten."
"If I exceed one million lines of code, there might be an extra cost or a change in the pricing bracket."
"The product's cost depends on the type of license."
"The subscription model, on a per-scan basis, is a bit expensive. That's another reason we are not using it for all the apps."
"Pricing was reasonable and competitive. It was not too far above the other products."
"The cost is $30,000 USD for one year to cover WAS (Web Application Security) and the VM (Virtual Machine) security in a company with 200 employees."
"The product pricing is fair and reasonably priced."
"​It is best to be an institutional buyer and directly contact the sales team, as they can provide over-the-top discounts for bulk orders​."
"Try the free trial of the product to understand the basic working mechanisms.​"
"There are different options available with respect to licensing."
"It is an expensive platform."
"The product has a very good licensing model."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
873,085 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
19%
Manufacturing Company
15%
Computer Software Company
10%
Government
8%
Computer Software Company
13%
Financial Services Firm
13%
Manufacturing Company
12%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business16
Midsize Enterprise8
Large Enterprise43
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise6
Large Enterprise27
 

Questions from the Community

What do you like most about Micro Focus Fortify on Demand?
It helps deploy and track changes easily as per time-to-time market upgrades.
What is your experience regarding pricing and costs for Micro Focus Fortify on Demand?
In comparison with other tools, they're competitive. It is not more expensive than other solutions, but their pricing is competitive. The licenses for Fortify On Demand are generally bought in unit...
What needs improvement with Micro Focus Fortify on Demand?
There are frequent complaints about false positives from Fortify. One day it may pass a scan with no issues, and the next day, without any code changes, it will report vulnerabilities such as passw...
What do you like most about Qualys Web Application Scanning?
The vulnerability management feature is a strong one. And also the patch management feature.
What is your experience regarding pricing and costs for Qualys Web Application Scanning?
Regarding pricing, I think for personal use, it is costly, but if organizations are ready to pay, then it is fine as they are using it.
What needs improvement with Qualys Web Application Scanning?
The downside of Qualys Web Application Scanning is that it cannot crawl automatically. If I provide an IP address and a login form, it does basic testing, but it doesn't go deep as IBM AppScan does...
 

Also Known As

Micro Focus Fortify on Demand
Qualys WAS
 

Overview

 

Sample Customers

SAP, Aaron's, British Gas, FICO, Cox Automative, Callcredit Information Group, Vital and more.
BskyB, Cartagena, ClearPoint Learning Systems, Connect Group, du, Fortrex Technologies, HBOR, HDI, Highlights for Children, The Lithuanian State Enterprise Centre of Registers, City of Miami Beach, Microsoft, MidlandHR, MSCI Inc., Northern Arizona University, Ofgem, Olympus Europa, PhoneFactor, RTL Nederland, ThousandEyes, VGZ Organisatie B.V.
Find out what your peers are saying about OpenText Core Application Security vs. Qualys Web Application Scanning and other solutions. Updated: November 2025.
873,085 professionals have used our research since 2012.