Try our new research platform with insights from 80,000+ expert users
Fortify WebInspect Logo

Fortify WebInspect Reviews

Vendor: OpenText
3.6 out of 5
Badge Leader
149 followers
Start review

What is Fortify WebInspect?

Fortify WebInspect is an automated DAST solution that helps security professionals and QA testers uncover security vulnerabilities and configuration concerns by providing complete vulnerability detection. This is accomplished by mimicking real-world external security attacks on a live application in order to discover and prioritize concerns for root-cause study. Fortify WebInspect provides a number of REST APIs for easier integration, as well as the ability to be maintained via an intuitive UI or totally automated.

Get the Fortify WebInspect Buyer's Guide and find out what your peers are saying about Fortify WebInspect, GitLab, Snyk and more!
Fortify WebInspect is the #3 ranked solution in top Dynamic Application Security Testing (DAST) solutions and #10 ranked solution in top DevSecOps solutions. PeerSpot users give Fortify WebInspect an average rating of 7.2 out of 10. Fortify WebInspect is most commonly compared to GitLab: Fortify WebInspect vs GitLab. Fortify WebInspect is popular among the large enterprise segment, accounting for 70% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 17% of all views.
Buyer's Guide
Fortify WebInspect
May 2025
Get the report
Helped 853,831 peers since 2012

Featured Fortify WebInspect reviews

Read more reviews

Fortify WebInspect mindshare

Product category:
Dynamic Application Security Testing ...
As of June 2025, the mindshare of Fortify WebInspect in the Dynamic Application Security Testing (DAST) category stands at 22.8%, down from 31.3% compared to the previous year, according to calculations based on PeerSpot user engagement data.
Dynamic Application Security Testing (DAST)

PeerResearch reports based on Fortify WebInspect reviews

TypeTitleDate
CategoryDynamic Application Security Testing (DAST)Jun 1, 2025Download
ProductReviews, tips, and advice from real usersJun 1, 2025Download
ComparisonFortify WebInspect vs HCL AppScanJun 1, 2025Download
ComparisonFortify WebInspect vs Rapid7 InsightAppSecJun 1, 2025Download
ComparisonFortify WebInspect vs InvictiJun 1, 2025Download
Suggested products
TitleRatingMindshareRecommending
GitLab4.3N/A97%84 interviewsAdd to research
Snyk4.0N/A100%45 interviewsAdd to research
 
 
Key learnings from peers

Valuable Features

Fortify WebInspect offers valuable features like the Guided Scan option, centralized dashboard, scalability, and static analysis. Users appreciate its ease of use, accurate scans, and wide vulnerability detection. Reporting, user authentication scanning, and integration with Fortify code scanner are highlights. It's especially good for enterprise-level organizations, with tools such as HTTP editor and FPA facilitating detailed vulnerability management. Adept at scanning applications early in development and removing false positives, it aligns with top security standards.
  • "The transaction recorder within WebInspect is easy to use, which is valuable for our team."
  • "The tool provides comprehensive vulnerability assessments which help ensure our deliverables are as free from vulnerabilities as possible. It has also streamlined our web application vulnerability assessments, assisting us in delivering secure applications to our clients."
  • "It is easy to use, and its reporting is fairly simple."

Room for Improvement

Fortify WebInspect faces challenges with user-friendliness, scalability, and integration, particularly with cloud services like Azure. Authentication issues persist, and automation for vulnerability interpretation is lacking. It's considered expensive, especially in Korea, with its cost being a major concern. Localization, streamlined installation, and improved scanning speed are desired. Users encounter compatibility and deployment difficulties, excessive resource usage, and frequent freezes. Enhanced file extension scanning, report generation, and reduced false positives are needed improvements.
  • "The main area for improvement in Fortify WebInspect is the price, as it is too high compared to the market rate."
  • "I would like WebInspect's scanning capability to be quicker."
  • "There are some file extensions, like .SER, that Fortify WebInspect doesn't scan."

ROI

Fortify WebInspect significantly improved security assessment efficiency, leading to faster detection and remediation of vulnerabilities. Users reported enhanced application security, reducing potential costs associated with breaches. Cost savings from automated scans and comprehensive testing exceeded initial investment. Through its detailed analytics, companies experienced better compliance with security standards, ultimately achieving a strong return on investment.

Pricing

Fortify WebInspect pricing is often viewed as expensive, especially when compared to competitors like Acunetix. While pricing clarity can be a challenge, it's typically bundled with other Fortify solutions. Many users find it similar in cost to IBM's AppScan. Although pricing is high, some justify it due to the tool's reliability and stability. It can reach up to $50,000, making it more accessible for medium to large enterprises rather than smaller clients.
  • "Fortify WebInspect is a very expensive product."
  • "This solution is very expensive."
  • "The price is okay."

Popular Use Cases

Fortify WebInspect is used by teams for dynamic web application scanning, focusing on identifying vulnerabilities and enhancing security. It is deployed both on the cloud and on-premise, allowing users to scan, test, and analyze applications in various environments. QA and security teams integrate it for security assessments, code and performance testing, especially in BFSI sectors, ensuring applications are secure before release. Customers utilize it for proactive security evaluations across multiple applications.

Service and Support

Fortify WebInspect's customer service and support receive mixed feedback. Some users find technical support satisfactory, citing prompt responses and effective issue resolution. Others note delays in response times and a lack of remote assistance. Many do not interact directly, relying on internal teams. The support level varies, with some reporting it as knowledgeable and helpful, while others find less responsiveness. Despite occasional delays, remote assistance is not immediate but most issues are eventually resolved effectively.

Deployment

Many users found Fortify WebInspect's initial setup straightforward or manageable, while others described it as complex, needing significant resources and taking days or weeks to complete. It often requires skills in database handling and log maintenance. Preparation of servers or virtual machines is necessary, and installation may demand manual updates. Users noted that experience with the tool influences ease, highlighting variability in difficulty based on user expertise and specific deployment situations.

Scalability

Fortify WebInspect offers scalability for various organizations, with users ranging from 10 to over 80. It performs well with multiple servers and integrations with other products enhance its scalability. While some report challenges in scanning larger sites or multiple applications, the cloud version scales easily. Ratings on scalability vary but generally indicate strong performance, particularly in serving banks, telecoms, and SMEs. Some have faced challenges due to licensing and installation constraints.

Stability

Fortify WebInspect is generally considered stable with reports indicating reliability, though some users experience issues with scanning errors and bugs, especially in new versions. There may be performance concerns, like high CPU usage and occasional false negatives. Users suggest improvements for handling complex websites. Many find it stable and rate it highly, appreciating its capacity for vulnerability management, while others report needing manual oversight for intricate projects, rating stability between five and nine out of ten.
These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.
Download our Fortify WebInspect Buyer's Guide for additional reliable information.

Review data by company size

By reviewers
By visitors reading reviews

Top industries

By visitors reading reviews
Financial Services Firm
17%
Government
14%
Manufacturing Company
12%
Computer Software Company
12%
Healthcare Company
5%
Insurance Company
4%
Real Estate/Law Firm
3%
Retailer
3%
Educational Organization
3%
Media Company
3%
University
3%
Consumer Goods Company
2%
Comms Service Provider
2%
Performing Arts
2%
Energy/Utilities Company
2%
Construction Company
2%
Wholesaler/Distributor
2%
Non Profit
1%
Aerospace/Defense Firm
1%
Hospitality Company
1%
Transportation Company
1%
Pharma/Biotech Company
1%
Outsourcing Company
1%
Recreational Facilities/Services Company
1%
Logistics Company
1%
Leisure / Travel Company
1%

Compare Fortify WebInspect with alternative products

Go!

Learn more about Fortify WebInspect

Fortify WebInspect may be used as a completely automated solution to suit DevOps and scaling requirements, and it integrates seamlessly with the SDLC. REST APIs aid in closer integration by automating scans and ensuring that compliance standards are satisfied. Users can make use of pre-built integrations for Micro Focus Lifecycle Management (ALM) and Quality Center, as well as other security testing and management platforms.

Teams may reuse current scripts and tools thanks to powerful connectors. Any Selenium script can be simply integrated with Fortify WebInspect. Fortify WebInspect supports Swagger and OData formats via the WISwag command line tool, allowing it to work with any DevOps workflow. A scan template can be pre-configured by ScanCentral Admin and sent to users to scan their apps, with zero security knowledge required.

Fortify WebInspect Features

Fortify WebInspect has many valuable key features. Some of the most useful ones include:

  • Security testing of functional applications (FAST): FAST can use all of the functional tests in the same way as IAST does, but it will continue crawling. FAST will not miss anything that a functional test misses.
  • Insights from a hacker's perspective: View discoveries such as client-side frameworks and version number. These are findings that, if not addressed, could lead to vulnerabilities.
  • Workflow macros HAR files: Fortify WebInspect can scan workflows with HAR files, ensuring that crucial content is not missed.
  • Management of compliance: Preconfigured policies and reports for all key online application security compliance regulations, such as PCI DSS, DISA STIG, NIST 800-53, ISO 27K, OWASP, and HIPAA.
  • Horizontal scaling can help you speed up your work: Using Kubernetes, horizontal scaling creates little versions of WebInspect that only process JavaScript. This allows the scans to run in parallel, resulting in significantly faster scans.
  • Scan any API for better accuracy: Get the complete picture on APIs, including SOAP, Rest, Swagger, OpenAPI, and Postman.
  • Managing the security of enterprise applications: To meet DevOps requirements, monitor trends within an application and take action on the most critical issues first.
  • Deployment options: With the flexibility of on-premise, SaaS, or AppSec-as-a-service, you can get started immediately and scale as needed.

Fortify WebInspect Benefits

There are many benefits to implementing Fortify WebInspect. Some of the biggest advantages the solution offers include:

  • Vulnerabilities are discovered faster and earlier.
  • Automation and agent technology can help you save time.
  • Users can utilize crawl web technologies and modern frameworks.
  • ScanCentral DAST helps you manage enterprise app security risk.

Reviews from Real Users

Fortify WebInspect stands out among its competitors for a number of reasons. One major one is its robust centralized dashboard, which gives insight into all vulnerabilities.

Milin S., an Information Security Architect at a real estate/law firm, writes of the product, “Reporting, centralized dashboard, and bird's eye view of all vulnerabilities are the most valuable features. The vulnerability management part of it is very easy. We can suppress or comment on each vulnerability and assign a vulnerability to an individual risk owner, which makes the work easy.”

Fortify WebInspect was previously known as Micro Focus WebInspect, WebInspect.

Fortify WebInspect customers

Aaron's

Related questions

  • 51
What alternatives are there for Fortify WebInspect and Fortify SCA?
  • 17
Which solution do you prefer: Fortify WebInspect or HCL AppScan?
  • 8
When evaluating Dynamic Application Security Testing (DAST), what aspect do you think is the most important to look for?
  • 5
Why is Dynamic Application Security Testing (DAST) important for companies?

Product Categories

Product Categories
Dynamic Application Security Testing (DAST)
DevSecOps

Popular Comparisons

Popular Comparisons
GitLab vs Fortify WebInspect Logo
GitLab vs Fortify WebInspect
Snyk vs Fortify WebInspect Logo
Snyk vs Fortify WebInspect
Checkmarx One vs Fortify WebInspect Logo
Checkmarx One vs Fortify WebInspect
Acunetix vs Fortify WebInspect Logo
Acunetix vs Fortify WebInspect
Aqua Cloud Security Platform vs Fortify WebInspect Logo
Aqua Cloud Security Platform vs Fortify WebInspect
HCL AppScan vs Fortify WebInspect Logo
HCL AppScan vs Fortify WebInspect
Invicti vs Fortify WebInspect Logo
Invicti vs Fortify WebInspect
Rapid7 InsightAppSec vs Fortify WebInspect Logo
Rapid7 InsightAppSec vs Fortify WebInspect
PortSwigger Burp Suite Enterprise Edition vs Fortify WebInspect Logo
PortSwigger Burp Suite Enterprise Edition vs Fortify WebInspect
WhiteHat Dynamic vs Fortify WebInspect Logo
WhiteHat Dynamic vs Fortify WebInspect
Check Point CloudGuard Code Security vs Fortify WebInspect Logo
Check Point CloudGuard Code Security vs Fortify WebInspect
Appknox vs Fortify WebInspect Logo
Appknox vs Fortify WebInspect
StackHawk vs Fortify WebInspect Logo
StackHawk vs Fortify WebInspect
See all alternatives
 

Fortify WebInspect reviews

Sort by:
PeerSpot user
Senior Customer Solutions at a media company with 5,001-10,000 employees
Verified user of Fortify WebInspect
Apr 11, 2025
Functionality meets team needs but high costs require careful budgeting

Pros

"The transaction recorder within WebInspect is easy to use, which is valuable for our team."

Cons

"The main area for improvement in Fortify WebInspect is the price, as it is too high compared to the market rate."

What is our primary use case?

I used Fortify WebInspect for inspecting web pages in production testing, oriented towards financial services.

What is most valuable?

In the beginning, the functionality of Fortify WebInspect was clear and uncomplicated. The transaction recorder within WebInspect is easy to use, which is valuable for our team.

*Disclosure: I am a real user, and this review is based on my own experience and opinions.
Read full review (271 words)
Navin N - PeerSpot user
Global ISO 27001 Program Lead at a tech vendor with 10,001+ employees
Verified user of Fortify WebInspect
Sep 16, 2024
Product version discussed: Fortify version would be n minus one or n minus two.
Effective scanning of diverse file extensions with fast reporting and issue resolution

Pros

"It is easy to use, and its reporting is fairly simple. "

Cons

"There are some file extensions, like .SER, that Fortify WebInspect doesn't scan. "

What is our primary use case?

We develop software packages for clients, and these clients are mostly in the BFSI sector. The packages need to be scanned, and we engage Fortify WebInspect for this. 

Customers typically perform their own application pen tests, but in some cases, we have engagements where customers want us to scan the dynamic codes, which is where we use WebInspect.

How has it helped my organization?

The automated scanning capabilities of Fortify WebInspect allow us to generate immediate reports for customers, providing faster detection and fixing of issues.

*Disclosure: My company has a business relationship with this vendor other than being a customer: reseller
Read full review (511 words)
Buyer's Guide
Fortify WebInspect
Download free report
Find out what your peers are saying about Fortify WebInspect. Updated May 2025
853,831 professionals have used our research since 2012.
RaviGupta4 - PeerSpot user
Services Project Lead, Information Technology at IGT Solutions
Verified user of Fortify WebInspect
Oct 31, 2024
Its ability to detect even complex vulnerabilities is invaluable

Pros

"The tool provides comprehensive vulnerability assessments which help ensure our deliverables are as free from vulnerabilities as possible. It has also streamlined our web application vulnerability assessments, assisting us in delivering secure applications to our clients."

Cons

"I would like WebInspect's scanning capability to be quicker. "

What is our primary use case?

Mostly, we use Fortify WebInspect to scan our applications. This includes whatever applications we are delivering to our customers. We aim to find out security vulnerabilities and other issues, so we can identify and fix them before releasing to the customer. This is the use case, as we strive to deliver applications free from vulnerabilities.

How has it helped my organization?

Fortify WebInspect contributes significantly to improving our Security Development Life Cycle (SDLC) security posture. The tool provides comprehensive vulnerability assessments which help ensure our deliverables are as free from vulnerabilities as possible. It has also streamlined our web application vulnerability assessments, assisting us in delivering secure applications to our clients.

*Disclosure: I am a real user, and this review is based on my own experience and opinions.
Read full review (557 words)
Kibeom Kim - PeerSpot user
General Manager at Inexion Co.
Verified user of Fortify WebInspect
Aug 24, 2023
A powerful tool catering to multiple use cases that provides reasonably good technical support

Pros

"The solution's technical support was very helpful. "

Cons

"Fortify WebInspect's shortcoming stems from the fact that it is a very expensive product in Korea, which makes it difficult for its potential customers to introduce the product in their IT environment."

What is our primary use case?

My company sells Fortify WebInspect to our customers.

What is most valuable?

The most valuable feature of the solution is that it is a powerful tool that has many customers with multiple use cases.

*Disclosure: My company has a business relationship with this vendor other than being a customer:
Read full review (518 words)
TN
Director at Eguardian lanka
Verified user of Fortify WebInspect
Jun 23, 2024
Scans web applications with user-authentication ability to crawl the website, understand the structure, and analyze the network packets sent and received

Pros

"The feature that has been most influential in identifying vulnerabilities is its ability to crawl the website, understand the structure, and analyze the network packets sent and received."

Cons

"I want to enhance automation. Currently, Fortify WebInspect can scan and find vulnerabilities, but users with specific skills need to interpret the results and understand how to address them. "

What is our primary use case?

Customers use Fortify WebInspect to scan web applications and get results with recommendations. After running scans, customers often have questions and need my support or recommendations to understand how to fix the issues identified. This includes understanding what vulnerabilities were found and what they mean.

What is most valuable?

The most valuable feature of Fortify WebInspect for me is the ability to scan with user authentication, like login credentials. This is crucial when scanning web applications because we need to input information like usernames and passwords to uncover vulnerabilities that appear after logging in. This feature helps identify more vulnerabilities on the website.

The feature that has been most influential in identifying vulnerabilities is its ability to crawl the website, understand the structure, and analyze the network packets sent and received.

*Disclosure: My company has a business relationship with this vendor other than being a customer: reseller
Read full review (668 words)
FP
Senior Manager - IT Security & ISMS at Ericsson
Verified user of Fortify WebInspect
Apr 30, 2023
Great at scanning and detecting vulnerabilities

Pros

"Good at scanning and finding vulnerabilities. "

Cons

"Not sufficiently compatible with some of our systems. "

What is our primary use case?

This is a scanning tool. We carried out a POC with the aim of taking a proactive approach to scanning the applications and remediating the vulnerabilities in the development environment. We have 15-18 applications currently using Fortify. We'll be testing additional applications in the coming months. 

What is most valuable?

WebInspect has the ability to scan an application and find vulnerabilities in the early stages of development. It also integrates with some of the applications as a part of the developing tool itself. It's a very good feature. 

*Disclosure: I am a real user, and this review is based on my own experience and opinions.
Read full review (518 words)
Ilyas Sadibekov - PeerSpot user
Consulting Engineer at a consultancy with 11-50 employees
Verified user of Fortify WebInspect
Mar 26, 2023
Easy to set up with responsive support and lots of customization

Pros

"There are lots of small settings and tools, like an HTTP editor, that are very useful."

Cons

"We have had a problem with authentification."

What is our primary use case?

Most of the time, it is used to access the current state of a client's web application. Sometimes it's used to test in the test environment, and sometimes in the enterprise environment, for example, the published environment. It mainly scans and checks for critical vulnerabilities. 

It can also check the differences between the web application, between the crawled URLs. It's not the main functionality, however, it is possible to use it in that manner. 

What is most valuable?

We like that we can see the request and response and create our own requests and see those responses. 

There are lots of small settings and tools, like an HTTP editor, that are very useful.

It is mostly stable. 

Support is very helpful. 

The setup is easy.

Depending on the deployment type, it can scale. 

*Disclosure: My company has a business relationship with this vendor other than being a customer: Integrator
Read full review (590 words)
PeerSpot user
Security Analyst at a retailer with 10,001+ employees
Verified user of Fortify WebInspect
Aug 8, 2022
Not user-friendly, highly complex, but scalable

Pros

"Fortify WebInspect is a scalable solution, it is good for a lot of applications."

Cons

"Fortify WebInspect could improve user-friendliness. Additionally, it is very bulky to use."

What is our primary use case?

Fortify WebInspect can be deployed on the cloud or on-premise.

Fortify WebInspect is used as a vulnerability scanner for applications.

What needs improvement?

Fortify WebInspect could improve user-friendliness. Additionally, it is very bulky to use.

*Disclosure: I am a real user, and this review is based on my own experience and opinions.
Read full review (170 words)