OpenText Static Application Security Testing Reviews

Our main use cases for Fortify Static Code Analyzer typically involve trying to figure out the critical vulnerabilities. It depends on the type of scans that we are doing, whether it is a release scan or an agile scan, so that affects the amount of data we give them and the timeline for those severity levels. Therefore, it contains all sorts of vulnerabilities.

In terms of Fortify Static Code Analyzer's automation capabilities, it has been fine. I have used it in some projects. We haven't onboarded all the projects yet, since we have a very large number of applications in my company. We have only taken the proprietary code for that matter and are running dry runs periodically. We consume reports from disaster control and SSCP. It basically saves us from needing to run multiple scans and not having to provide every time the development team asks for it. We have set it up in a way where they can log in and see the open issues, saving our time by not requiring extra effort.

We have utilized Fortify Static Code Analyzer's remediation guidance feature. It has helped our development team effectively address vulnerabilities by allowing us to forward the remediation information to them. We create reports and outline how the issues were created and found, detailing the analysis trace and all. We draft the remediation steps in a single report and provide it to them, utilizing Fortify's features.

Fortify Static Code Analyzer has the capability of giving fewer false positives compared to other tools. Since I have come across tools from Synopsis and other SCA tools, Fortify can really give fewer of these false positives, saving the effort of auditing, finding true positives, and reporting it.

We check for injection flaws and cryptographic issues. The tool does report many issues which we need to audit. For example, if we audit 50 reported SQL injections, I try to find 10 to 15 that are true positives, while the rest might be false positives. Even for cryptographic issues, when the tool sees in the code what algorithm has been used, it is often a true positive, highlighting issues such as using MD5 or SHA1 algorithms.

I think Fortify Static Code Analyzer could be improved by updating the number of rule packs according to the latest vulnerabilities we find each year. We have updated to a version that is one less than the current latest version. It would be really helpful to include trending vulnerabilities and how to manage them. While it includes all the OWASP top factors, AI has come into the picture, so those updates should also be considered.

I haven't thought much about additional features for improvement since I am using it daily. Most of our work revolves around scanning and providing the results, which sometimes feels like a crunch. However, I believe rule pack updates should be implemented. It feels easy to upgrade to the latest version as well.

I have been using Fortify Static Code Analyzer in this company for almost three years, but I have used it in my former company as well.

We are currently having some problems with setting this up and are in talks with the Fortify team, specifically the team from Micro Focus, who are trying to help us with that. We are in the middle of that process.

I would rate the product stability as an eight. Since we are focusing more on the static side, we are on the verge of using more of its features, such as CI/CD and DAST in the near future.

Its scalability is okay.

My experience with the technical support has been good.

Before this product, I have not used anything similar.

My initial setup of Fortify Static Code Analyzer was good. Since we are using it for the past five years and comparing it with the other tools in the market, Fortify has consistently outperformed the competition. It is a win-win for us.

Currently, my team, which includes four to six people, is using Fortify Static Code Analyzer. In addition to my team, the development side of the company is also using it, so it's hard to tell their exact numbers. Overall, from my side, about six or seven people are using it on a daily basis.

I have not seen a return on investment with Fortify Static Code Analyzer.

My experience with the pricing, setup costs, and licensing has been good. We have the scan machines, and we are planning to request more from Micro Focus now. We have calls every month or every other month, and the Micro Focus team has been helping us set that up as well.

I would definitely recommend Fortify Static Code Analyzer to others. In our company, there are people recommending Veracode for the same purpose, but we always support Fortify since we have used it in the past and continue to use it. From my understanding, Fortify is a better tool than Veracode.

Fortify is the tool that we use daily, and it is more useful to us for all these scans. Veracode is our second-most-used tool since we have automated the whole SCA scan process. The development team uses it more, and we are just going through the reports and trying to deliver them to the proper team, assigning them accordingly.

I have hands-on experience with Veracode and Fortify, rather than being more of a consultant or reseller. We are just using Fortify Static Code Analyzer. I rate this solution 9 out of 10.

We are still working with Fortify solution. Everything is all right with Fortify On Demand and Software Security Center, Application Defender. We are satisfied with this solution. We are using dynamic scanning and static scanning from this vendor. We utilize Static Code Analyzer and dynamic DAST with WebInspect.

The most impactful feature of Fortify Static Code Analyzer in identifying vulnerabilities is the ratio of total number of vulnerabilities to false positives. All solutions of this class are very similar, and the difference between solutions is mainly in price and interface.

I'm not sure if Fortify Static Code Analyzer has AI capabilities. Currently, this solution doesn't quite have what we need. For example, it cannot build a vulnerability rating using AI based on our data. We would appreciate if the AI could give us more information about improvements and reduce the number of false positives, but this solution doesn't have this function yet.

ChatGPT can already perform code analysis. If we insert the code to ChatGPT, we get answers, so integration with Fortify would be beneficial. However, there are questions of confidentiality and AI deployment. We are not ready to transfer our code without control to AI instruments.

I would appreciate seeing simplified integration with Active Directory and integration with AI instruments in the future.

We have been using Fortify Static Code Analyzer for three to four years.

The installation of Fortify Static Code Analyzer was not easy. We utilized technical support, local support, and internet searching for answers to our questions.

The most difficult aspect of implementation was managing certificates for connecting modules with each other, particularly with Active Directory authorization. This was not a simple process.

The technical support has been good because we always received answers to our questions. We work with one Fortify engineer based in Georgia who was employed by our local partners. We always have short calls and get answers to our questions. Sometimes we receive answers from technical support, though this is not frequent.

Positive

I would recommend this instrument. This is one of the best solutions in this class, but everything will depend on the price and discount, which vary significantly across regions. On a scale of 1-10, I rate Fortify Static Code Analyzer an 8.

Neutral

We manage the overall software development security organization, encompassing assistance to all developers across our organization worldwide. Our 10,000 developers help identify vulnerabilities in their code. We use Fortify Static Code Analyzer to explore methods to expedite vulnerability detection and remediation through a self-service pipeline.

Initially, we utilized Just Cloud, but subsequently, we developed our on-premises tools over the ensuing year. This resulted in substantial cost savings, as on-premises security solutions are generally more economical than their cloud-based counterparts.

Fortify Software Security Center, often abbreviated as SSC, offers both an on-premises and cloud-based version. The cloud-based version is called Fortify On Demand or FOD. FOD is a popular choice for organizations that want a flexible and scalable solution, while the on-premises version is preferred by organizations that require more control over their security infrastructure. OpenText, the vendor of Fortify, offers various consumption models for its solutions. Users can pay per scan or opt for an annual subscription with unlimited scans. However, annual subscriptions can be expensive, with some organizations paying millions of dollars per year. Using the on-premises tools can provide significant cost savings compared to cloud-based solutions, but it also requires a dedicated team of IT professionals to manage and maintain the infrastructure. If an organization lacks the resources to manage on-premises tools, FOD is often the most affordable and robust solution available. In comparison, competitors like Synopsys and Checkmarx typically charge even more for their cloud-based solutions.

The Fortify portal is well-suited for managing and tracking risks associated with the open-source components used in our software projects. The increasing availability of open-source options has been beneficial. OpenText's acquisition of Debricked a couple of years ago has further enhanced its capabilities in this domain. They continue to utilize Sonatype within the FOD, providing customers with a choice. For existing Sonatype customers who have been using the tool as Micro Focus' and OpenText's partner for FOD for many years, continuing with Sonatype remains a viable option. However, for new users or those seeking an alternative to Sonatype, Debricked, now OpenText's open-source security tool, is an excellent choice, seamlessly integrated into FOD.

Utilizing Fortify to identify vulnerabilities has become remarkably effortless. Based on my experience, I've observed a significant increase in user satisfaction with the tool. Over the years, we've acquired several companies that initially held negative perceptions of Fortify, stemming from its previous reputation as a cumbersome and resource-intensive tool. However, with the introduction of FOD and the enhanced capabilities of the on-premises tools, we've witnessed a dramatic shift. The availability of lightweight on-premises tools, coupled with seamless IDE plugins for Visual Studio, Eclipse, and other intelligent IDEs, alongside integrations into Azure and Jenkins pipelines, has significantly empowered users to conduct self-service vulnerability scans in minutes, a stark contrast to the time-consuming hours it previously required.

Fortify enhances our vulnerability remediation efforts by providing more reliable results. Secure Code Warrior integration plays a significant role by providing developers with access to secure coding training, which I believe positions them better to identify and resolve issues promptly. Many companies lack access to this level of guidance and often rely on standard verbiage. I appreciate that users can leverage Secure Code Warrior's guidance for their Fortify findings. This capability is not offered by any other company in the space. Additionally, they have recently partnered with MAB to offer automated code remediation solutions. Automated code remediation means that if I'm a developer and Fortify identifies a vulnerability, instead of manually fixing it, MAB, their partner, can automatically resolve the issue by providing a prebuilt fix and incorporating it into our build pipeline.

Fortify enables our developers to build secure code from the beginning. I can speak with confidence that without Fortify, we wouldn't have fixed thousands of vulnerabilities, and it is helping to streamline that process for developers, whereas Many other security teams rely on traditional PAN testers, Fortify has given our developers the confidence to be able to find, fix, and remediate issues, and a fully self-service mechanism that few other companies have.

Both Fortify and Sonatype have excellent integrations with compliance frameworks such as GDPR, PCI, and DSS, providing comprehensive reporting capabilities that help us meet regulatory requirements. These integrations enable us to stay abreast of evolving regulatory requirements and ensure that our vendor partners promptly address any changes. For example, when the OWASP categories were updated two years ago, both Fortify and Sonatype quickly released support for the updated categories, allowing us to seamlessly update our reporting without delay.

Fortify mitigates risk exposure in applications by identifying vulnerabilities and weaknesses. It pinpoints all the issues that developers need to address and provides comprehensive guidance for remediation.

It provides robust details about the issues, along with comprehensive insights into what needs to be fixed. The ability to see all of the different versions in Sonatype results has been particularly helpful as an indicator.

Fortify's expansion into shift-left security for cloud-native applications has been an exciting development. I wasn't expecting them to venture into this area, but I'm pleasantly surprised by their progress. It appears that they are well-positioned to gain significant market share.

Fortify has helped free up our staff time for other projects by improving our automation capabilities. As a result, we have been able to significantly reduce our turnaround time for remediation tasks. This has allowed our developers to focus on more strategic initiatives, such as automation and engineering, instead of being bogged down with manual remediation work. We have saved over $40 million in headcount expenses by automating these tasks. It would have taken over 100 years to fix all of these issues manually, using our previous processes. In other words, Fortify has automated millions of hours of work, equivalent to the work of hundreds of thousands of people over decades. This is one of the most significant automation projects we have ever undertaken.

Identifying vulnerabilities using Fortify early in the software development life cycle has resulted in significant cost savings compared to discovering them later on. Fortify has enabled us to detect and remediate these types of issues at the beginning of the SDLC. As a result, we can prevent potential problems from reaching the production stage.

Fortify integrates seamlessly with other solutions, which is a significant advantage in our opinion. As I mentioned earlier, Synopsys has struggled with third-party integrations. In contrast, Fortify has taken the lead in collaborating with Secure Code Warrior, reconciled, and MOB to facilitate these integrations. This has allowed us to establish an ecosystem of solutions from various providers that are at the forefront of innovation.

We have integrated Fortify with Sonatype, Secure Code Warrior, and MOB. The integrations take no more than a few hours.

The Software Security Center, which is often overlooked, stands out as the most effective feature. This on-premises portal, included with their primary SaaS offering, streamlines the process of triaging our results. With thousands of daily active users, the Software Security Center serves as a centralized platform, consolidating results from various tools, including Sonatype, WebInspect's DAST results, and Pen Test findings from our internal team. This unified view eliminates the need for developers to log into multiple portals to access code vulnerabilities, open-source issues, web app scans, and Pen Test results. Instead, they can access everything they need from a single, convenient location.

Secure Code Warrior is an invaluable integration and partnership for us. Fortify consistently collaborates with top-tier companies to deliver cutting-edge solutions. For instance, if a developer encounters a common code vulnerability, such as a path manipulation vulnerability in their Java website, and is unsure of how to resolve it, Fortify provides some guidance and standard response protocols. However, for more in-depth information and assistance, they direct us to Secure Code Warrior. Upon providing information on the vulnerability type and language, Secure Code Warrior offers tailored training courses, such as how to fix path manipulations in Java-based applications. This remediation technique, which is unmatched by any other provider, has proven to be incredibly effective.

Fortify's software security center needs a design refresh. It has maintained the same design for the entirety of our five years of use, making it feel outdated compared to its FOD portal, which receives regular bi-monthly updates. This area is a prime candidate for improvement in the future.

Fortify needs to move to a more frequent release cycle Currently, they only release two updates per year, which is considerably slower than their peers, so I would very much like to see that improve.

I have been using Fortify Static Code Analyzer for five years.

Fortify Static Code Analyzer stability has improved and I would give it a ten out of ten.

The scalability of the Fortify Static Code Analyzer is a ten out of ten.

We have a weekly call with their technical support team. Their service has improved dramatically since they allocated a dedicated premium support team to us. We now have a point person who works closely with us to address our concerns.

The support itself is very good. They are always responsive and present, and they're willing to work with us on challenges. I would give them a ten out of ten for their responsiveness and presence. However, for issues that require product enhancement, I would give them a lower score. These issues often require us to wait for someone on their product team to implement something, which can be frustrating.

Positive

We have previously used Synopsys, Coverity, and Checkmarx. Fortify stands out for its comprehensive language support, which is a major reason for our satisfaction with their product. For example, Fortify is the only tool that supports mainframes and COBOL. It's encouraging to see their turnaround in this area, and they now support over 30 languages. Checkmarx excels in the design simplicity of its open-source integration in FOD, a new feature, and its cloud-native capability. Checkmarx boasts a sleek user interface that is highly intuitive for new users, while Fortify may require some time to get accustomed to. Coverity used to be a top contender, known for its accuracy and effectiveness. However, their quality and execution speed significantly deteriorated following the Synopsys acquisition. Synopsys has shifted some of its engineers to other projects, negatively impacting the quality of its Coverity product. Despite these drawbacks, Checkmarx remains a strong competitor to Fortify in terms of quality. While Synopsys invests heavily in marketing, its product no longer meets the standards of a robust enterprise tool.

Initial deployment of the SaaS SOD solution was straightforward to get started with. However, on-premises deployment took a bit longer. It took us several months to get that piece up and running.

The initial deployment required seven people.

We did work with a third party to help us facilitate the buildout. That third party was Saltworks Security.

Through our ongoing partnership with Fortify and their commitment to working closely with us, we have experienced a significant return on investment, with benefits ranging from ten to twenty times our initial investment. Additionally, the continuous introduction of new features over the years has further reinforced our assessment of Fortify's value.

From our standpoint, we are significantly better off with Fortify due to the favorable pricing we secured five years ago. I'm unable to comment on their current pricing; however, I am aware that switching to a different vendor like Checkmarx would result in considerably higher costs. It appears that we're paying a premium for the robustness of their design rather than being able to benefit from the pricing that was previously negotiated.

I would rate Fortify Static Code Analyzer ten out of ten.

It is incumbent upon any security leader to incorporate automation and self-service into any initiative, regardless of whether it pertains to identity and access management or software development security. The goal is to simplify security and make it an enabler rather than a hindrance. Organizations should strive to provide cybersecurity controls as intuitive solutions, not as complex configurations that require extensive effort to understand and implement.

We have close to 20 people who support Fortify full-time.

I recommend doing a POC and confirming that the automated integrations work for the organization before implementation.

We use Fortify SCA or SAST for scanning the source code, and we use Sonatype Nexus to scan libraries for any vulnerabilities. We get secure code and libraries by combining these two solutions. If we find any issues, we can fix them.

We use Fortify SAST to scan our code. It is used for the static code and not the running code. It finds vulnerabilities, and it finds bad practices. If you are using something that can be exploited in the code, it highlights that and gives you recommendations on that. It gives you ideas on how to fix that.

We have a more secure code because it is based on top security standards. Before we moved to Fortify SAST, we already had code running in production. When we moved to Fortify SAST, we had to rescan our code running in production. We got more and more vulnerabilities, which made people upset, but overall, our security was enhanced. It also enhanced the knowledge of our developers. Our developers are learning more. Many developers were frustrated in the beginning because there were many vulnerabilities, but as time went on, they liked its features. They find it straightforward now. They read about it, and they can fix their code easily. Without any back-and-forth communication, they can find the line, the recommendation, and what to do about it in one place. That is awesome.

Fortify Software Security Center gives a good overview of how the application is implemented, but it is not a 360-degree view. Sometimes we have false positives, and sometimes, it does not catch the design flows. It will mark something as vulnerable because it does not have the full picture. The highlighted code might be a part of another module, so it cannot see the full picture, but it is a very good tool. It is better than the ones we had before.

I have not yet used Fortify Software Security Center for managing and tracking risks associated with the open-source components used in our software project. We recently started to use Fortify SAST and are still exploring and discovering things. We usually do that through Sonatype Nexus, but I have seen it catching vulnerabilities. Some users have scanned the library by mistake, and I have seen it catching vulnerable code in the library. It points out why we wrote the code this way, and the code should have been that way. If there is a variable that has a sensitive name, such as a key, password, or something else, it catches that. After we have integrated it with Sonatype, we will have more exposure, but we are not yet at that stage.

I really like Fortify Software Security Center. We can scan the code and push the results. I can also see all the applications. I know the portfolio of the applications that we have. I can see all the information about the organizations, the code, and the developers in one spot. It is good for the management and also for the development teams. If their supervisors want to know the security status of their applications, they can go there straight away and check that information. It is very good in this aspect.

Fortify SAST has helped in the remediation of potential vulnerabilities by using accurate and reliable results. I like that they use standards such as OWASP Top 10 or SANS Top 25. They are very good at this. When it finds any vulnerabilities, it shows you by the rank. You can filter by so many standards. It gives you a description of the vulnerability as well as recommendations on how to fix it. It also gives you some references if you want to read more. It is very good.

Fortify SAST has helped a lot to enable developers to build secure code from the start. We have many developers. They have the development skills, but they do not have security skills. Now, there is something that tells them how to write the code properly. For instance, they use a function, and then they get the recommendation to use another function. They do not know the other function. They go ahead and use it, and the code still runs as before, but it is safer. With time, people avoid these issues. It is like a spelling checker. You get recommendations while writing the code.

Fortify and Sonatype solutions help to maintain compliance with applicable regulations. Fortify SAST is built on top of very high standards such as OWASP Top 10, SANS Top 25, PCI DSS, etc. These are very repeatable security standards. It includes over a thousand vulnerability categories. It covers a lot of vulnerabilities.

Fortify SAST helps us reduce our risk exposure on applications through the discovery of vulnerabilities and weaknesses. They have something called rulepacks that are the guidelines. There are rulepacks for different languages. They are the security standards that the code will follow. These rulepacks are updated frequently by the Fortify team themselves, and we just have to feed them into Fortify Software Security Center so that it has updated information about vulnerabilities, and it can discover more. The more you discover and fix, the more secure and resilient code you will have.

Fortify SAST provides real-time feedback on security issues. When you scan, you get the results instantly. Sometimes, for certain code languages, it takes a little more time to scan, which can be frustrating, but it provides real-time feedback. You get a small description, and you also have the details. There is one tab for recommendations, and there is also a tab for references.

We recently had this activity where we wanted to integrate the tool with a pipeline. We are using Azure DevOps, and we managed to integrate that. It was straightforward. You get a plugin or an extension, and the code is pushed and scanned, and you get the results. It is straightforward. I can see it functional for such deployments. We are ready for the cloud and automation, but we are still in the testing phase.

Fortify SAST has helped free up our staff for other projects or tasks. Because it is very informative and clear, we have a lot fewer issues for which people come back to us. They come back to us if they think it is a false positive or if they need a waiver because they cannot fix it due to some limitations, but in the majority of cases, they can control and learn, and they can do it on their own. It helped us a lot in this aspect, but I do not have the metrics. We have been using it only for a few months, and we have a shortage of people. It has saved the communication time that we were spending on emails and reporting. We now have less of that. We all go to one place. Instead of sending me an email or having a phone call, developers now go to Fortify Software Security Center and put in what they think. For example, they will say that it is a false positive because of this and that. They will send it to me, and I will go to Fortify Software Security Center. I will read it and review it, and if I find it okay, I will give the go-ahead to get rid of it. Otherwise, we would need more discussion. It improves communication big time for me.

I like Fortify Software Security Center or Fortify SSC. This tool is installed on each developer's machine, but Fortify Software Security Center combines everything. We can meet there as security professionals and developers. The developers scan their code and publish the results there. We can then look at them from a security perspective and see whether they fixed the issues. We can agree on whether something is a false positive and make decisions. I like Fortify Software Security Center. It was not the way we had before. We used to have another tool, and it did not have this feature. I also like the fact that it supports many languages. It supports more than 30 languages. It covers a lot of what we do. Its configuration is a little bit tricky, but after you configure it, it is intuitive.

I also like the integration capability. It can integrate with many IDEs, such as IntelliJ, Eclipse, VS Code, etc. It integrates with all the main ones. It also can integrate with Nexus. It can integrate with Secure Code and Azure DevOps. This is really good to have something that can work with many vendors. It gives you versatility and flexibility.

We have integrated it with Azure DevOps for the pipeline, and we have integrated it with Secure Code. It is not a major integration. We have a plan to integrate it with Sonatype. I like to have everything in one place. All the integrations happen in the IDEs. We have people using Eclipse, IntelliJ, Visual Studio, VS Code, etc. We have integrated it with all the IDEs that we have here. The integration with IDEs was straightforward. You just install the plugin, add it to the IDE, and add your configuration. For Azure DevOps, we needed to add the binary, and it took a day or two because people were not familiar with it. For Secure Code, it was straightforward again. It is not hard to integrate. Its integration is easy.

One downside to it is that it is costly. I can see it only for enterprises. I cannot see it for small businesses or for individual use.

The configuration part is a little bit tricky. There is a learning curve there because it has multiple components. If someone has used another type of scanner, they would not think of the configuration intuitively. The configuration part can be better. Installation is straightforward, but the configuration can be better. It can be improved. 

There is a learning curve. Before we started using this tool, I did a lot of sessions with the vendors themselves to give an overview to the people. I also did a small documentation on how to install it because there are many components here and there. You need to understand how everything is put together. They can integrate it or make it a simpler process.

During the short experience that we have had with it, we have noticed that some of the languages such as JavaScript and TypeScript consume high resources. They take a longer time to scan. Memory consumption is also very high for those languages. We are working with Fortify to find ways to optimize the scan. I noticed this with these types of languages. By nature, they take time.

It can be tricky if you want to exclude some files from scanning. For instance, if you do not want to scan and push testing files to Fortify Software Security Center, that is tricky with some IDEs, such as IntelliJ. We found that there is an Exclude feature that is not working. We reported that to them for future fixing. It needs some work on the plugins to make them consistent across IDEs and make them easier.

For integration with IDEs, they have so many plugins. For example, they have something called security analysis, and they have something called remediation. As a user, I would love to have them as one. Why should we have two plugins in the same IDE? Just give me one plugin that I can hook to the tool and use it. This is one thing. Some of the features in these plugins also need more testing. They are not consistent across all the IDEs. From what I saw, there are different options in these tools. For example, if you install it with IntelliJ, it will be different from VS Code. Some options are different, or one tool has more options than others. They can invest more in making them consistent.

We are a big company. We have different organizations. For our organization, we started using this solution this year, but other organizations have been using it for two years.

From what I have seen so far, it is very stable. It is a browser-based solution. You just log in to the website and see all your applications. From your machine, you can just push, and it will be published there. You click a scan, and your results will be in Fortify Software Security Center. It is straightforward and easy to use.

It is being used at multiple locations and in multiple buildings. The security requirements are very high in our environment, so not everything will work as you expect it because not everything is open. We struggle a bit, but it is required. We have around 60 people who use Fortify SAST.

We have not tested it yet, but they have something called ScanCentral. Currently, developers scan the code on their machines, and then they push it to Fortify Software Security Center. ScanCentral is a feature that we will start to experiment with soon where we offload the scan to a server. It will not utilize developers' resources. It will just initiate a scan, and it will use another system to scan. I have heard that you can have many of them implemented. I have not experienced it yet, but it seems like a cool feature to free the resources for developers because they need to deploy, compile, and fix. If it frees up their resources, it will be good.

I am very satisfied with their support. They are very nice people, and they are very helpful. I would rate their support a ten out of ten.

Positive

We were using IBM Appscan. We switched because of limitations and support. We found that developers were able to tweak it and play with it. They could play with the results. Its support had also ended, and it supported fewer languages. There were multiple reasons, and this is why we had to switch to something else.

I needed their help with the setup. It was mainly because our environment is a little bit strict. It is not the easiest environment to work in. It is not only applicable to Fortify; it is applicable to many other vendors, but with their help and support, it was doable. We have a very restricted environment. If you read a document and follow it, it should work, but because of our environment, we need to open this or that. We had access issues at the beginning, but once we resolved them, it was fine.

It took weeks because of the access issues that we had. We had to reach out to the vendor and ask them why it is behaving this way.

In terms of maintenance, we need to update rulepacks. We need to take care of the licenses. In the beginning, we used licenses from a neighbor until we got ours. We need to take care of the routine activities related to licensing and patching. If we find any vulnerability with the tool itself, we need to do patching. It is like any other tool.

We had people from the cloud team. We had people from the administration team. We had people from the database team. Overall, we had four or five people involved but not always together. When you configure the database, you will be with the database team. When you configure the cloud, you will be with the cloud team.

It is too early to say whether we have seen an ROI, but we have had a great communication and learning experience.

Identifying vulnerabilities using Fortify SAST early in the development lifecycle saves costs versus discovering vulnerabilities later in the software development lifecycle (SDLC). If you discover a vulnerability early, it is helpful. For instance, if you are writing Java code and you know that there is a limitation or vulnerability in that version of Java, it helps to plan your journey of development earlier. You get to know that your server does not support this version of Java. It helps you make decisions earlier in the process. Time is money. The earlier you handle things, the better it is.

There is a licensing fee, and if you bring them to the company and you want them to do the installation and the implementation in the beginning, there is a separate cost. Similarly, if you want consultation or training, there is a separate cost.

I see it as suitable only for enterprises. I do not see it suitable for a small business or individual use. In the future, if they have other versions for smaller organizations or individuals who want to install it on their machines and use it, it would be good.

To someone whose company is still using manual methods to find vulnerabilities, I would say that when you automate it, you control it. You give more power to people, especially from a security point of view.

I would recommend Fortify SAST if you have money and multiple teams. It is useful for multiple teams, but for a small company with one team of two to three people, I would not recommend it. If you have a big community with many organizations and many development teams, it is worth it. 

Overall, I would rate Fortify SAST an eight out of ten.

We use Fortify Static Code Analyzer and Sonatype in conjunction with Azure DevOps to view all code processes, from scheduling to deployment in production. This is typically included in the build. Therefore, when a colleague performs a build, all scans are automatically done, and they can see the results through the Fortify and Sonatype web portals.

Fortify Static Code Analyzer enables developers to identify and fix broken references within the code. We sought to understand how to write secure code by design.

Finding vulnerabilities using Fortify SAST is not difficult.

Fortify SAST helps our remediation of potential vulnerabilities with accurate and reliable results. While this practice does not allow our developers to build secure code from the outset, as they are currently notified of issues only after the initial build, it does facilitate the creation of secure code before deployment to the customer environment and production.

Fortify SAST has been instrumental in our growth. As a result, I now have a team that consistently writes more secure code without relying on scans. By addressing the same issues repeatedly, we learn to write code correctly the first time, fostering a culture of knowledge sharing. This is facilitated by our weekly meetings where the team discusses key issues and collaborates on solutions.

I can use the dashboard and portal to see our compliance in real-time and address any compliance issues before they become a problem.

The Fortify SAST portal helps me identify vulnerabilities and weaknesses to reduce our risk exposure.

Real-time feedback isn't necessary for us because we receive scan results once a week or on demand. However, the feedback has been incredibly valuable. I can perform a scan and immediately see our current situation. This allows me to quickly assess if our coding practices are effective or if we need to stop and address any issues before they become bigger problems.

Fortify SAST has helped free up around 20 percent of our employees' time to work on other projects.

Fortify SAST's ability to identify vulnerabilities early in the development lifecycle has helped us save significant costs equalling around 40 percent as well as time, as it allows us to catch issues before they reach production. Before using Fortify SAST, we could only identify problems manually, which often resulted in code being deployed with vulnerabilities.

Integrating Fortify SAST is simple and takes around two hours.

The reference provided for each issue is extremely helpful. It allows our team to understand the rationale behind resolving the issue and the specific type of security problem we are facing. This information is crucial for improving our security skills and coding practices. The ability to review and approve each scan before deploying to production is vital. This ensures that our product is free of bugs and complies with our security policies.

The price can be improved.

I have been using Fortify Static Code Analyzer for two years.

I would rate the stability of Fortify SAST ten out of ten.

Fortify SAST perfectly fits our organization's size.

The technical support is good.

Positive

The initial deployment is straightforward. The integration is part of our DevSecOps process and it is completely transparent.

Whether or not the Fortify SAST deployment is done separately will affect its complexity.

The deployment takes about one week and involves ten people.

Although I am not responsible for the budget, Fortify SAST is expensive.

I would rate Fortify Static Code Analyzer a nine out of ten.

Currently, we don't utilize Secure Center. Instead, we have a dedicated server that collects scan data. Fortify scans are conducted on the server hosting DevOps, which then transmits the results to the Fortify server. Due to our organization's size, Secure Center implementation is not currently necessary.

Organizations that are still relying on manual methods to identify vulnerabilities should consider transitioning to SAST for improved efficiency and professionalism.

We have Fortify SAST deployed in one department and we have 14 users.

Fortify SAST's reliance on Java necessitates maintenance due to our predominant use of Microsoft technologies.

I recommend implementing Fortify SAST for enhanced security, as a SAST solution is crucial to ensuring comprehensive security.

We use the product as a SaaS analysis tool. We review static code. It allows you to find vulnerabilities.

The value that combining Fortify and Sonatype is that we use Fortify as a SaaS analysis tool. We review static code and Sonatype allows you to find vulnerabilities. 

I use it as a security center. I review it for any kind of issues, whether for proof or to deny, the source code, the findings, and then the enterprise can go back and provide their recommendation for how to fix the issue. It is used to scan the code base. 

As a security analyst, I like the management view. From there, you can review the code and review findings in order to approve, deny, or recommend. Their Software Security Center, which acts as a portal, is quite useful. It's a good overview. You can really see what's happening after you've developed something.

Fortify's AppSec testing is great for application portfolio inventory and project releases. It works both at a portfolio level and also at a project level.

They also give you the capability to click train of all your vulnerabilities that happened within Apache Crossroads support. You give them a history to keep track of them, how they've been developed, how they've been saved, to give you a way of tracking your issues and how they get resolved.

It's pretty easy to find vulnerabilities. Then, you go to the source. It is very good at tracking to see where the data or the issue enters into your source code so you can track it or go back to where it started.

Fortify helps remediate potential vulnerabilities by using more accurate, reliable results. They offer recommended remediation. I can go to the website tools to resolve issues and search for remediations. This helps our developers to build more secure code from the start.

It has reduced vulnerabilities. We've never had issues when we ran our scans. We're notified, and we're able to identify most of our vulnerabilities and fix them before anything goes to production. If you're running this on your CI/CD pipeline, notifications are in real-time.

The level of detail is very informative. It provides you with recommendations on how to fix items. And they provide you with other resources available for how to address the issues. You can also see the root cause.

It works well with cloud-native applications.

Fortify helped us to free up staff time since it helps us resolve issues faster. 

It's helped us save costs as, if we catch a vulnerability faster, it's easier to fix than later. 

Fortify and Sonatype help maintain compliance with the applicable regulations. We mostly use Sonatype for compliance and licenses. By combining both solutions together, it enables you to solve a lot of issues that may occur in the future.

It would be nice if they had a version suitable for single developers that could be more cost-effective and maybe faster to learn.

I've been Fortify for two or more years.

I've never had an issue with the solution crashing. 

I've never had issues with scaling. 

I've never had to contact technical support.

I was not involved with the initial deployment.

We only integrated the product with one other solution. It was easy to do so. 

There is some general maintenance needed, such as adding or removing users and projects and things of that nature. 

Their licensing is expensive. 

I do not use the open-source components of Fortify. However, we use other tools for open-source stuff.

I'd advise people who are still using manual methods to find vulnerabilities to adopt some sort of scanner to cut the time spent by 100%.

I'd rate the solution ten out of ten. 

I would advise other potential users that you need to make sure your source code can work with Fortify.

Fortify SAST performs static code analysis, which means it reviews the source code or compiled binary code without executing the application. This helps in identifying vulnerabilities, coding errors, and security issues within the codebase.
Fortify SAST supports a wide range of programming languages, including popular ones like Java, C/C++, C#, Python, and more. This broad language support makes it suitable for various development environments.

It comes with a comprehensive set of security rules and patterns to identify vulnerabilities, including issues related to OWASP Top Ten, CWE (Common Weakness Enumeration), and other industry standards

Fortify integrates with various development environments and tools, such as IDEs (Integrated Development Environments) and CI/CD pipelines. This allows developers to scan code seamlessly.

The generation of false positives should be reduced. Although it provides mechanisms to help reduce false positives, ensuring that the reported vulnerabilities are genuine security concerns.

I have been using Fortify Static Code Analyzer for a few years.

It is a stable solution, however, the stability of Fortify SAST can depend on the hardware and network infrastructure it's running on. Make sure your infrastructure meets the system requirements recommended by Micro Focus.

You need to properly train your development and security teams on how to use Fortify SAST effectively. Knowledgeable users are more likely to obtain stable and accurate results.

It is scalable, can handle large codebases, and is suitable for projects of varying sizes, from small applications to complex enterprise-level software.

The technical support team is decent.

Neutral

Setting up Fortify Static Application Security Testing (SAST) involves several steps to ensure that the tool is correctly configured and integrated into your development workflow, for example: installation, license activation, user access and permissions, integration with the development environment, project configuration, custom rules and policies, etc.

The initial setup is very easy. I have used the enterprise version and a standalone version. The enterprise version definitely takes an ample amount of time to deploy because it needs to have a server, other logistics, and a proper RBAC in place. The enterprise version would take an ample amount of time, but the standard version is just a few clicks.

A team of four to five people is required for the maintenance, and frequent updates are required to keep all the signatures up to date.

I would rate the setup a nine out of ten.

Fortify SAST is a valuable tool for organizations committed to ensuring the security of their software applications. It helps prevent security vulnerabilities from making their way into production code, reducing the risk of data breaches and other security incidents. However, the effectiveness of Fortify SAST depends on proper configuration, rule selection, and integration into the development process.

I would rate the overall solution an eight out of ten.

Fortify SAST performs static code analysis, which means it reviews the source code or compiled binary code without executing the application. This helps in identifying vulnerabilities, coding errors, and security issues within the codebase.
Fortify SAST supports a wide range of programming languages, including popular ones like Java, C/C++, C#, Python, and more. This broad language support makes it suitable for various development environments.

It comes with a comprehensive set of security rules and patterns to identify vulnerabilities, including issues related to OWASP Top Ten, CWE (Common Weakness Enumeration), and other industry standards

Fortify integrates with various development environments and tools, such as IDEs (Integrated Development Environments) and CI/CD pipelines. This allows developers to scan code seamlessly.

The generation of false positives should be reduced. Although it provides mechanisms to help reduce false positives, ensuring that the reported vulnerabilities are genuine security concerns.

I have been using Fortify Static Code Analyzer for a few years. 

It is a stable solution but the stability of Fortify SAST can depend on the hardware and network infrastructure it's running on. Make sure your infrastructure meets the system requirements recommended by Micro Focus.

Properly train your development and security teams on how to use Fortify SAST effectively. Knowledgeable users are more likely to obtain stable and accurate results.

It is scalable, can handle large codebases, and is suitable for projects of varying sizes, from small applications to complex enterprise-level software.

The technical support team is decent. 

Neutral

Setting up Fortify Static Application Security Testing (SAST) involves several steps to ensure that the tool is correctly configured and integrated into your development workflow say for instance Installation, License Activation, User Access and Permissions, Integration with Development Environment, Project Configuration, Custom Rules and Policies, etc.

The initial setup is very easy, have used the enterprise version and a standalone version. The enterprise version definitely takes an ample amount of time to deploy because it needs to have a server along with other logistics in place along with a proper RBAC. The enterprise version would take an ample amount of time, but the standard version is just a few clicks.

A team of four to five people is required for the maintenance and frequent updates are required to keep all the signatures up to date. 

I would rate the setup a nine out of ten. 

Fortify SAST is a valuable tool for organizations committed to ensuring the security of their software applications. It helps prevent security vulnerabilities from making their way into production code, reducing the risk of data breaches and other security incidents. However, the effectiveness of Fortify SAST depends on proper configuration, rule selection, and integration into the development process.

I would rate the overall solution an eight out of ten.

We use Fortify Static Code Analyzer to analyze our code for security vulnerabilities. It helps us identify and address potential issues, ensuring our software is secure.

Fortify Static Code Analyzer's most valuable features are its ability to provide best practices for fixing code and its examples and capabilities to address security problems in the code. It effectively identifies security vulnerabilities by analyzing the code and offering insights on improving it.

False positives need improvement in the future. Fortify's vulnerability remediation guidance helps improve code security, but I think they need to improve the focus of the solution, as it still

Contains many bugs and needs a thorough review.

I have been using Fortify Static Code Analyzer for the past three months.

For stability, I would rate it as an eight out of ten. The stability has been reliable since using this solution, and I haven't encountered any issues.

I would rate the scalability of Fortify Static Code Analyzer as seven out of ten. It is easy to scale, but on-premises cases require scaling the server to deploy it.

About ten to twenty users in my company are using Fortify Static Code Analyzer once a month. We do not plan to increase its usage in the future.

I don't work with the support directly, and I have only seen the results of their intervention, which are satisfactory.

Positive

Before using the Fortify Static Code Analyzer, I used Sonar. We switched because Fortify was better at fixing issues. We didn't evaluate other vendors and went straight with Fortify.

It took about fifteen minutes to deploy Fortify. I would rate the initial setup of Fortify Static Code Analyzer as eight out of ten, as it was relatively easy to set up. 

I rate the pricing of Fortify Static Code Analyzer as a seven out of ten since it is a bit expensive.

For someone considering Fortify Static Code Analyzer, I'd recommend checking other options like Checkmarx, as it might be a better fit depending on their use case. 

Overall, I would rate the product a five out of ten.