PeerSpot user
Enterprise Systems Analyst at a manufacturing company with 10,001+ employees
Real User
Scans run in the background and security analysts are available if an issue comes up
Pros and Cons
  • "One of the valuable features is the ability to submit your code and have it run in the background. Then, if something comes up that is more specific, you have the security analyst who can jump in and help, if needed."
  • "It's still a little bit too complex for regular developers. It takes a little bit more time than usual. I know static code scan is not the main focus of the tool, but the overall time span to scan the code, and even to set up the code scanning, is a bit overwhelming for regular developers."
  • "If you have a continuous integration in place, for example, and you want it to run along with your build and you want it to be fast, you're not going to get it. It adds to your development time."

What is our primary use case?

We use it for externally exposed applications that we want to scan before releasing them to production. As you can imagine, it's important to make sure they're secure and that we will not be exposed. For internal apps, we use other static code scanning, primarily SonarQube. But Fortify on Demand is for externally exposed applications.

How has it helped my organization?

Because of the kind of products we deal with, and the kind of customers we have, we have really specific security requirements and practices we need to follow, specifically applying to our SDLC. Our SDLC dictates that we have security scanning, and that improves our code quality. Thankfully, we have never had any kind of serious security flaw or any kind of deviation of the process. We can certainly account for that because of the security tools and analysis that we have prior to moving code to production.

What is most valuable?

One of the valuable features is the ability to submit your code and have it run in the background. Then, if something comes up that is more specific, you have the security analyst who can jump in and help, if needed. I think that's really useful.

What needs improvement?

It's still a little bit too complex for regular developers. It takes a little bit more time than usual. I know static code scan is not the main focus of the tool, but the overall time span to scan the code, and even to set up the code scanning, is a bit overwhelming for regular developers. That's one of the reasons we don't use it throughout the company and for all our applications, only for the ones we judge to be most important.

Also, if you have a continuous integration in place, for example, and you want it to run along with your build and you want it to be fast, you're not going to get it. It adds to your development time. 

And it's too expensive to afford to run it for every application all the time. That's certainly something that requires improvement.

Buyer's Guide
Fortify on Demand
April 2024
Learn what your peers think about Fortify on Demand. Get advice and tips from experienced pros sharing their opinions. Updated: April 2024.
768,066 professionals have used our research since 2012.

For how long have I used the solution?

Three to five years.

What do I think about the stability of the solution?

I haven't really encountered any issues with stability.

What do I think about the scalability of the solution?

No issues with scalability. It has been able to handle all our workload so far.

How are customer service and support?

Our experience with tech support has been good. We haven't needed support that much but whatever we needed we were able to find on their website. There were a couple of things regarding the licensing and payment that we had to get some help with. But it was quick and easy.

Which solution did I use previously and why did I switch?

We didn't have a previous solution. We researched a couple of the tools, but we ended up using Fortify because of the comprehensive scans they have, and mainly because they are focused on the kind of apps that we have and the kind of requirements we have. They are able to cover most of the standards and practices that we need to adhere to.

How was the initial setup?

The initial setup was straightforward. We had onsite training from HPE to help set up the local environment and first scans, and that was helpful.

What's my experience with pricing, setup cost, and licensing?

The subscription model, on a per-scan basis, is a bit expensive. That's another reason we are not using it for all the apps. That subscription model is probably something that needs improvement.

Which other solutions did I evaluate?

We looked at CheckMarkx and SonarQube Enterprise. As I said, we are currently using SonarQube for other apps, but we use the open-source version. We tried to use the Enterprise version but it didn't cover all the aspects that we needed it to cover.

What other advice do I have?

Understand what you want to get out of it and be sure to fully understand what you will be paying per scan if you go for the subscription model. As I said, having to scan hundreds or thousands of apps using that subscription model and doing that several times a week, or several times a day, may increase your costs. That might be something that you need to look at.

I rate it at nine out of 10. It's not a 10 because of the cost model, it's a bit pricey, and the slowness, it could be a little bit faster. I understand the reasons why but you just need to be aware before you start using it that the local scan won't be as fast as the static code scan.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Fernando Vizer - PeerSpot reviewer
Fernando VizerSenior Information Technology Architect at a computer software company with 11-50 employees
Real User

I did a scan, discovered the default only includes critical and high issues, then when I requested to include medium and low ranked issues, they ask me to pay again for a scan. It is annoying and will force me to look for a competitor. It is this way even if it is the same code I already uploaded.

Harkamal-Singh - PeerSpot reviewer
Solution architect at NTT
Real User
Beneficial functionality, pinpoints issues for resolution, but interface could improve
Pros and Cons
  • "The most valuable feature of Micro Focus Fortify on Demand is the information it can provide. There is quite a lot of information. It can pinpoint right down to where the problem is, allowing you to know where to fix it. Overall the features are easy to use, you don't have to be a coder. You can be a manager, or in IT operations, et cetera, anyone can use it. It is quite a well-rounded functional solution."
  • "Micro Focus Fortify on Demand could improve the user interface by making it more user-friendly."

What is our primary use case?

Micro Focus Fortify on Demand is used for detecting vulnerabilities in code, looking at libraries, and finding where there are vulnerabilities within unpatched code.

What is most valuable?

The most valuable feature of Micro Focus Fortify on Demand is the information it can provide. There is quite a lot of information. It can pinpoint right down to where the problem is, allowing you to know where to fix it. Overall the features are easy to use, you don't have to be a coder. You can be a manager, or in IT operations, et cetera, anyone can use it. It is quite a well-rounded functional solution.

The allocations to different members of a team are good. If you find a problem, you can delegate the task to patch the particular code.

What needs improvement?

Micro Focus Fortify on Demand could improve the user interface by making it more user-friendly.

For how long have I used the solution?

I have been using Micro Focus Fortify on Demand for approximately two years.

What do I think about the stability of the solution?

I have found Micro Focus Fortify on Demand stable.

What do I think about the scalability of the solution?

Micro Focus Fortify on Demand is a scalable solution.

We have several customers using this solution. There are approximately 1,000 developers using the solution.

How are customer service and support?

The support from Micro Focus Fortify on Demand is great. They have been very good to answer our questions. They have their own Fortify on Demand team and they will help you resolve your problems.

How was the initial setup?

The initial setup is straightforward. 

The installation can take a couple of hours depending on what the deployment is, such as, on cloud or on-premise. Additionally, the size of the code that will be put on the system can impact the time, but it does not take long. 

What about the implementation team?

We did the implementation ourselves. I was able to use YouTube to help me with the process, there's quite a lot of information on there with Micro Focus going through tutorials on how to use the solution. 

What's my experience with pricing, setup cost, and licensing?

The pricing model it's based on how many applications you wish to scan.

Which other solutions did I evaluate?

I have evaluated other solutions, such as Contrast Security.

What other advice do I have?

I would recommend Micro Focus Fortify on Demand to others.

I rate Micro Focus Fortify on Demand a seven out of ten.

The reason why I've rated the solution a seven is because there are other solutions, such as Contrast Security which are further developing in IS, and some better technology with current scalability or in the security software area.

Which deployment model are you using for this solution?

Hybrid Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Buyer's Guide
Fortify on Demand
April 2024
Learn what your peers think about Fortify on Demand. Get advice and tips from experienced pros sharing their opinions. Updated: April 2024.
768,066 professionals have used our research since 2012.
GM - Technology at a outsourcing company with 10,001+ employees
Real User
Effective security analysis, stable, but occasional false positives
Pros and Cons
  • "The most valuable features are the server, scanning, and it has helped identify issues with the security analysis."
  • "We typically do our bulk uploads of our scans with some automation at the end of the development cycle but the scanning can take a lot of time. If you were doing all of it at regular intervals it would still consume a lot of time. This could procedure could improve."

What is our primary use case?

We have an application sending service that we are providing to our customers and we are using Micro Focus Fortify on Demand to ensure our applications are secure. 

What is most valuable?

The most valuable features are the server, scanning, and it has helped identify issues with the security analysis.

What needs improvement?

We typically do our bulk uploads of our scans with some automation at the end of the development cycle but the scanning can take a lot of time. If you were doing all of it at regular intervals it would still consume a lot of time. This could procedure could improve.

We are receiving false positives. We then have to repeat the scan even though it is a false positive and tell it to ignore some of those issues. Some of the false positives could be a design issue which we will know, but they keep coming up on the report.

I have found the processes a bit cumbersome for the developers.

For how long have I used the solution?

I have been using this solution for approximately eight years.

What do I think about the stability of the solution?

I did not have any problems with the stability of this solution.

What do I think about the scalability of the solution?

The scalability is good.

How are customer service and technical support?

We did have some issues but we did not contact the technical support of Micro Focus.

How was the initial setup?

The initial setup was a medium effort, not too complex. However, the bulk scan uploads took time. Overall it took an average amount of time and it was easy to integrate and work with.

What's my experience with pricing, setup cost, and licensing?

The solution is a little expensive.

What other advice do I have?

I rate Micro Focus Fortify on Demand a six out of ten.

Which deployment model are you using for this solution?

On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Senior System Analyst at Azurian
Real User
Makes it easy to discover hidden vulnerabilities in our open source libraries
Pros and Cons
  • "One of the top features is the source code review for vulnerabilities. When we look at source code, it's hard to see where areas may be weak in terms of security, and Fortify on Demand's source code review helps with that."
  • "During development, when our developer makes changes to their code, they typically use GitHub or GitLab to track those changes. However, proper integration between Fortify on Demand and GitHub and GitLab is not there yet. Improved integration would be very valuable to us."

What is our primary use case?

We create technology solutions for clients and on one project we were requested to use Fortify on Demand after the client had read a good report about it. They sent us the report and recommended its use.

In this case, we were using Java to program the client's solution and so we used Fortify on Demand alongside our Java development operations, for the purpose of improving the application's security.

The work we were doing for the client involved creating a billing system that they would use to manage payments and taxes for other companies in Chile. We've only used Fortify on Demand for this one client so far. 

Because Fortify on Demand was so new to us, we decided to go with the trial version first and figure out the costing at a later stage.

How has it helped my organization?

Fortify on Demand has helped us more easily ensure the security of our client's application, which works with sensitive information such as payments and taxation. Without it, we would have to spend much more time finding hidden weaknesses in our code.

What is most valuable?

One of the top features is the source code review for vulnerabilities. When we look at source code, it's hard to see where areas may be weak in terms of security, and Fortify on Demand's source code review helps with that.

Another reason I like Fortify on Demand is because our code often includes open source libraries, and it's important to know when the library is outdated or if it has any known vulnerabilities in it. This information is important to us when we're developing our solutions and Fortify on Demand informs us when it detects any vulnerable open source libraries.

What needs improvement?

During development, when our developer makes changes to their code, they typically use GitHub or GitLab to track those changes. However, proper integration between Fortify on Demand and GitHub and GitLab is not there yet. Improved integration would be very valuable to us.

Similarly, I would love to see some kind of tracing solution for use in stress testing. So when we stress the application on a certain page or on a certain platform, we would be able to see a complete stress test report which could quickly tell us about weak points or failures in the application. 

Further potential for improvement is that, when we deploy our Java WAR files for review in the QA area, we want to be able to create a report in Fortify on Demand right from within this deployment stage. So it might inspect or check the solution's Java WAR package directly and come up with a report in this crucial phase of QA. 

For how long have I used the solution?

I have been using Fortify on Demand for about a month or so. 

What do I think about the stability of the solution?

Overall, we have not had any issues with stability, although we have not used it for very long.

What do I think about the scalability of the solution?

We have had no problems with scalability in our current use case, which is only one client at the moment. As a cloud service, it has satisfied our requirements well and we haven't had any situations where scalability is an issue.

How are customer service and technical support?

When we sent a question about the product to their support team, we had to wait a while but they did send us a response eventually. I think that they could work on reacting faster to support questions.

Which solution did I use previously and why did I switch?

We have also tried SonarQube, but Fortify on Demand appealed to us more due to their source code review with emphasis on open source vulnerabilities. Fortify seems stronger in that aspect and we like to use many open source libraries in our work. 

How was the initial setup?

The setup is easy and it only takes about 30 minutes to perform a basic code review in Java when dealing with WAR files.

It can get more complicated when you want to fine-tune the reporting interface to give only the details that you want to see. This is because the initial configuration depends on other variables like the scope of the review, the client's preferences, the technician's preferences, and other factors.

When it comes to launching Fortify on Demand and connecting it to our codebase, it's quite easy. Getting quick reviews done on WAR files is a relatively simple procedure.

What about the implementation team?

Our company implements Fortify on Demand ourselves on behalf of our client. When the client requests any changes, we then implement it for them.

What's my experience with pricing, setup cost, and licensing?

We are still using the trial version at this point but I can already see from the trial version alone that it is a good product. For others, I would say that Fortify on Demand might look expensive at the beginning, but it is very powerful and so you shouldn't be put off by the price.

In our case, we are constrained by the client's budget, but others might find that the price is not too bad. It all depends on the budget.

What other advice do I have?

For us, Fortify on Demand is a good quality product that I can recommend for a few reasons, including:

  • Very useful source code review and vulnerability detection.
  • Clear and easy-to-read test results and reports.
  • Good integration with other platforms during development.

I would rate Fortify on Demand a nine out of ten.

Which deployment model are you using for this solution?

Public Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Other
Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
it_user512112 - PeerSpot reviewer
Technical Lead at a tech services company with 10,001+ employees
Real User
Our client uses the audit workbench for on-the-fly defect auditing. .NET code scanning is still dependent on building the code base before running any scan.
Pros and Cons
  • "Audit workbench: for on-the-fly defect auditing."
  • ".NET code scanning is still dependent on building the code base before running any scan. Also, it's dependent on an IDE such as Visual Studio."

How has it helped my organization?

Security defects are captured early in the lifecycle and fixed quicker. Usage of Fortify has made developers more aware about security vulnerabilities and their consequences, as well as various secure programming practices.

What is most valuable?

  • Scan wizard: for configuring large scans
  • Audit workbench: for on-the-fly defect auditing
  • CLI: to integrate the tool into CI/CD

What needs improvement?

.NET code scanning is still dependent on building the code base before running any scan. Also, it's dependent on an IDE such as Visual Studio.

More conventional reporting formats need to be provided.

Also, a provision should be available to generate customized reports.

What do I think about the stability of the solution?

For code bases heavy on JavaScript, the static scan takes a long time (as long as two days). Even then, the scan crashes at times. Increasing system memory doesn't seem to improve the situation (tried with 16/32 GB system memory).

It requires a high-end system with 8/16/32 GB RAM for stable performance.

How are customer service and technical support?

I haven't reached out to HP Support so far.

Which solution did I use previously and why did I switch?

I did not previously use any product for static application security.

How was the initial setup?

Initial setup is quite easy.

What's my experience with pricing, setup cost, and licensing?

Buying a license would be feasible for regular use. For intermittent use, the cloud-based option can be used (Fortify on Demand).

Which other solutions did I evaluate?

Before choosing this product, we evaluated Veracode and Checkmarx (among licensed), and FindBugs and Yasca (among free).

What other advice do I have?

If you are already using HPE tools and services such as ALM, then Fortify is a good option, as it provides out-of-the-box support for these. Scanning capability-wise, the tool is decent enough, and is also easy to use. However, it generates a large number of false positives after a scan, which can be tedious to verify manually.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Jaime Baracaldo - PeerSpot reviewer
Chief Information Officer at Location world
Real User
Top 10
Has good price and support and works very well for web applications
Pros and Cons
  • "We have the option to test applications with or without credentials."
  • "They have very good support, but there is always room for improvement."

What is our primary use case?

We use this solution for our web applications. 

What is most valuable?

We have the option to scan web applications on demand. We have the option to do dynamic analysis. We also have an on-premise solution for static code analysis.

We have the option to test applications with or without credentials.

What needs improvement?

Overall, it's very good. They have very good support, but there is always room for improvement.

For how long have I used the solution?

I've been using this solution for two to three years.

How are customer service and support?

They are helpful, and we have a good relationship with them. I'd rate them an eight out of ten.

How would you rate customer service and support?

Positive

How was the initial setup?

It was straightforward. It took us two or three months because we had to integrate with our DevOps and pipeline solutions. It took a bit of extra time.

In terms of maintenance, we need to update the version. Micro Focus releases new versions every two months or so.

What about the implementation team?

We had our DevOps manager, and then we had two people from IT. We also had the support of the provider. We also worked with a partner to help us to implement faster.

What's my experience with pricing, setup cost, and licensing?

I'd rate it an eight out of ten in terms of pricing.

What other advice do I have?

Overall, I'd rate it a nine out of ten. We are very satisfied with it.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Omar Abdelhamied Ahmed - PeerSpot reviewer
Financial Analyst at Arab Investment Bank
Real User
Top 20
SAST is valuable, but there needs to be improvement in CI integration and with GitLab or Jenkins
Pros and Cons
  • "The SAST feature is the most valuable."
  • "I would like to see improvement in CI integration and integration with GitLab or Jenkins. It needs to be more simple."

What is most valuable?

The SAST feature is the most valuable.

What needs improvement?

I would like to see improvement in CI integration and integration with GitLab or Jenkins. It needs to be more simple.

For how long have I used the solution?

I have been using this solution for three months. I am a DevOps engineer in customer service.

What do I think about the stability of the solution?

It's stable right now.

What do I think about the scalability of the solution?

We have only installed the solution on one server.

How was the initial setup?

The implementation process was complex. The documentation was not clear to me.

Which other solutions did I evaluate?

I'm also evaluating Black Duck and Snyk. I just have a demo – a POC.

What other advice do I have?

I would rate this solution 7 out of 10.

I recommend Fortify, but I need more documentation, especially in integration with CI tools like GitLab and Jenkins. The reporting from Fortify to Jenkins or for GitLab needs to be clarified in documentation.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Alejandro Merida - PeerSpot reviewer
Enterprise Solutions Architect at Contpaqi
MSP
Top 10
Easy deployment, simple to use, and effective application security
Pros and Cons
  • "The most valuable features of Micro Focus Fortify on Demand have been SAT analysis and application security."
  • "Micro Focus Fortify on Demand can improve by having more graphs. For example, to show the improvement of the level of security."

What is our primary use case?

I am using Micro Focus Fortify on Demand for SAT analogies and data analysis.

What is most valuable?

The most valuable features of Micro Focus Fortify on Demand have been SAT analysis and application security.

What needs improvement?

Micro Focus Fortify on Demand can improve by having more graphs. For example,  to show the improvement of the level of security.

For how long have I used the solution?

I have been using Micro Focus Fortify on Demand for approximately six months.

What do I think about the stability of the solution?

Micro Focus Fortify on Demand is stable.

What do I think about the scalability of the solution?

The scalability of Micro Focus Fortify on Demand is good.

We have eight users using this solution. We plan to increase our usage in the future.

How are customer service and support?

The technical support of Micro Focus Fortify on Demand is very good.

How was the initial setup?

The initial setup of Micro Focus Fortify on Demand was simple. The deployment took approximately three or four days.

What about the implementation team?

We have used a consultant for one deployment in the past. We have two people that do the deployment of the solution.

What's my experience with pricing, setup cost, and licensing?

There are different costs for Micro Focus Fortify on Demand depending on the assessments you want to use. There is only a standard license needed to use the solution.

What other advice do I have?

Micro Focus Fortify on Demand is a very easy-to-use solution. You don't need some technical staff. It's very easy to implement and use the application. I don't require assistance I only have my advisories that are users.

I rate Micro Focus Fortify on Demand a nine out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Buyer's Guide
Download our free Fortify on Demand Report and get advice and tips from experienced pros sharing their opinions.
Updated: April 2024
Buyer's Guide
Download our free Fortify on Demand Report and get advice and tips from experienced pros sharing their opinions.