- A broad enterprise code-to-runtime AppSec program is required: The portfolio combines SAST, DAST, software-composition analysis, API and mobile testing routes, centralized findings, policy, and reporting.
- Deployment flexibility or managed expert testing matters: OpenText documents SaaS, single-tenant private cloud, and customer-managed options, plus managed assessments and manual validation through Core Application Security.
Security & Privacy / Application Security Testing Software
OpenText Fortify Application Security Testing Review, Pricing, Pros & Cons
OpenText Fortify Application Security Testing is a modular enterprise AppSec portfolio and governance platform spanning static, dynamic, open-source, API, mobile, and managed testing workflows.
Research by Global Tool Radar Research SystemEvidence checked: Aug 12, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Buying snapshot
Quick buying snapshot
A compact view of who this tool fits, what it costs, and what to confirm before choosing it.
- Procurement requires a self-service core-platform price: The three core suite editions are quote-based, and public AWS amounts belong to the related managed SaaS route rather than the core suite.
- One low-tier entitlement must include SAST, DAST, and full software-composition analysis: Express and Premium split dynamic and static testing, while full software-composition analysis has its own product and plan ladder.
- Three application-based, custom-quoted suite editions with named-user or scanning-user limits; adjacent products and managed-service routes are licensed separately.
- Security Fortify Express Edition Suite · Requires quote · custom quote
- No permanent free edition or time-limited trial is publicly established for the full Fortify Application Security Testing target. The separate OpenText Core Software Composition Analysis product advertises Free, Premium, and Enterprise plans and a trial.
Product scope
Product functionality and purchase scope
The target is the current Fortify enterprise application-security portfolio and shared governance platform. Its exact core plan ladder is the three Fortify Application Security Suite editions. Individual scanners, managed services, AI modules, and software-composition-analysis plans retain their own commercial boundaries.
Product checked: Aug 12, 2026
- Security Fortify Express Edition Suite
- Security Fortify Premium Edition Suite
- Security Fortify Ultimate Edition Suite
- Fortify Application Security centralized governance and reporting
- OpenText Core Application Security, formerly Fortify on Demand, as a separate managed SaaS product and purchase route
- OpenText Fortify Software Composition Analysis and its Free, Premium, and Enterprise plans
- Standalone OpenText SAST, OpenText DAST, and starter or flexible-deployment licenses
- SAST Aviator, DAST Aviator, Remediation Aviator, Secure Code Warrior, and other optional modules or services
Pricing checked: Aug 12, 2026
- Fortify Application Security Suite direct licensing: OpenText licenses the Express, Premium, and Ultimate suite editions through a quotation governed by its software-license terms.
- OpenText Core Application Security: The managed SaaS product formerly branded Fortify on Demand supplies assessment subscriptions and services across SAST, DAST, MAST, SCA, and IAST; it is not a Fortify suite edition.
- OpenText Core Application Security on AWS Marketplace: AWS Marketplace sells 12-month assessment-unit offers for the related OpenText managed SaaS service. These offers do not set the starting price of the three core suite editions.
- $996 USD · per assessment unit · per year · 4 to 98 assessment units · one-year commitment · minimum 4 assessment units · At least 4 and less than 99 assessment units
- $864 USD · per assessment unit · per year · 100 or more assessment units · one-year commitment · 100 or more assessment units with managed support
- $14190 USD · per 15 Static AU · per year · 15 static applications, single assessments · one-year commitment · 15 static applications with single security assessments
- $54360 USD · per 60 Static AU · per year · 15 static application subscriptions · one-year commitment · 15 static applications with security assessment subscriptions
- $9960 USD · per 10 Mobile AU · per year · 10 mobile applications, single assessments · one-year commitment · 10 mobile applications with single security assessments
- $37840 USD · per 40 Mobile AU · per year · 10 mobile application subscriptions · one-year commitment · 10 mobile applications with security assessment subscriptions
- $28380 USD · per 30 Dynamic AU · per year · 15 dynamic websites, single assessments · one-year commitment · 15 dynamic websites with single security assessments
- $81540 USD · per 90 Dynamic AU · per year · 15 dynamic website subscriptions · one-year commitment · 15 dynamic websites with security assessment subscriptions
- $18920 USD · per 20 API AU · per year · 10 dynamic APIs, single assessments · one-year commitment · 10 dynamic APIs with single security assessments
- $54360 USD · per 60 API AU · per year · 10 dynamic API subscriptions · one-year commitment · 10 dynamic APIs with security assessment subscriptions
- OpenText Application Security Private Cloud: OpenText can host and operate the application-security environment as a single-tenant private cloud.
Pricing plans
OpenText Fortify Application Security Testing pricing table
Pricing checked: Aug 12, 2026
Official factConfidence 96%2 linked sources
Express packages dynamic testing for ten applications and one WebInspect named user. Premium packages static testing and central management for ten applications and five scanning users. Ultimate combines the Premium static scope with unlimited dynamic applications. Direct numeric suite prices, payment timing, commitment, renewal terms, and implementation amounts are not public. Managed OpenText Core Application Security, AWS Marketplace assessment bundles, and Private Cloud are distinct routes rather than suite plans.
Official pricing pageCommercial scope needs confirmation
Current official sources describe an offer or purchase route differently. The page remains usable, but affected price schema is withheld until the scope is resolved.
- The AWS dimension label says 1 AU (>100), while its description says 100+ Assessment Units with Managed Support. The high-volume offer is retained with the exact description, but no numeric minimum is asserted.
PlanPriceKey differencesBest for
Security Fortify Express Edition Suite
- Requires quote · custom quote
- Licensed applications: 10 applications.
- WebInspect named users: 1 named users; Dynamic scanning for the licensed applications.
Security Fortify Premium Edition Suite
- Requires quote · custom quote
- Licensed applications: 10 applications; Static-analysis suite.
- Fortify scanning users: 5 scanning users; Named users authorized to initiate scans.
Security Fortify Ultimate Edition Suite
- Requires quote · custom quote
- Licensed static applications: 10 applications; Static-analysis scope.
- Licensed dynamic applications: Unlimited applications; Dynamic scans conducted via sensors.
- Fortify scanning users: 5 scanning users; Named users authorized to initiate scans.
Plan upgrade triggers
Verified plan boundaries that can change the required edition.
Choose Ultimate when the deployment needs both static and dynamic analysis with centralized management rather than the Express dynamic-only package.
Supporting pricing evidenceChoose Ultimate when the Premium static-analysis stack must add WebInspect Enterprise and unlimited dynamic applications.
Supporting pricing evidenceWhat is included, connected, or sold separately
Product scope
What is included, connected, or sold separately
Material capabilities are separated by their verified relationship to the target product.
AI-assisted SAST auditing through an optional moduleRelationship not verified
The managed-service description explicitly identifies SAST Aviator as an add-on; suite-edition availability is not publicly mapped.
OpenText SAST Aviator
AI-generated code-fix suggestions through a separate Fortify productRelationship not verified
The family page lists Remediation Aviator as a featured product; no core-suite inclusion is assumed.
OpenText Fortify Remediation Aviator
Central application-security management in Premium and UltimateRelationship not verified
Premium and Ultimate include Software Security Center, now named OpenText Application Security.
Plan: Security Fortify Express Edition Suite: Not verified · Security Fortify Premium Edition Suite: Not verified · Security Fortify Ultimate Edition Suite: Not verifiedOpenText Application Security
Dynamic analysis in Express and UltimateRelationship not verified
Express includes WebInspect for ten applications; Ultimate includes WebInspect Enterprise and unlimited dynamic applications.
Plan: Security Fortify Express Edition Suite: Not verified · Security Fortify Premium Edition Suite: Not verified · Security Fortify Ultimate Edition Suite: Not verifiedOpenText Dynamic Application Security Testing
Full open-source composition analysis through a separate productRelationship not verified
The SCA product has its own Free, Premium, and Enterprise plan ladder and is not treated as a Fortify suite edition.
OpenText Fortify Software Composition Analysis
Managed SAST, DAST, MAST, SCA, and IAST servicesRelationship not verified
The managed SaaS service is a separate product and purchase route, not a core suite plan.
OpenText Core Application Security
Static analysis in Premium and UltimateRelationship not verified
The licensing matrix includes the Fortify Static Code Analyzer static engine in Premium and Ultimate, not Express.
Plan: Security Fortify Express Edition Suite: Not verified · Security Fortify Premium Edition Suite: Not verified · Security Fortify Ultimate Edition Suite: Not verifiedOpenText Static Application Security Testing
How the score is calculated
Scoring method
How the score is calculated
The score uses the category-specific buying dimensions below and their displayed weights.
This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.
- Evidence confidence
- 76%
- AI claim confidence
- 98%
- Required-field evidence status
- 100%
- Evidence freshness
- 54%
- Field traceability
- 100%
- Model agreement
- 90%
Why this confidence level
- Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
- Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
- 8 of 8 weighted claims have evidence links.
- 0 A1 documentary official sources and 10 A2 official product sources are linked.
- 0 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
- 4 weighted claims are past the review window.
- 1 non-blocking commercial scope issue requires confirmation.
Accuracy and validation18%
79Managed assessments and manual validation support result checking in the broader AST motion, but the public facts do not establish identical validation depth for all testing modes or all plan routes.
Testing scope and depth18%
89The AST portfolio includes SAST and DAST, with DAST for web applications, services, and major API description and protocol formats, so it covers a broad testing surface, although the exact entitlement depends on edition.
Developer workflow15%
83IDE, repository, CI/CD, and issue-remediation workflows support developer adoption of AST findings, but the quoted SKU must be checked for the specific integrations and user limits that apply.
Remediation quality14%
77Issue-remediation workflows can help teams route findings into fix processes, but the facts do not establish automated fix quality or depth beyond the workflow support itself.
Risk prioritization13%
79Policy enforcement, centralized correlation, and executive reporting help place vulnerabilities in program context, but the facts do not establish a full risk-scoring model or every prioritization rule.
Governance and integrations12%
83The platform supports policy and governance workflows alongside integration into IDE, repository, and CI/CD environments, but buyers still need to verify the exact quoted entitlement and any separate commercial boundary for adjacent products.
Support and total cost10%
59The core suite is quote-based and the public facts do not establish pricing, payment timing, commitment, renewal terms, or implementation amounts, so total cost requires direct commercial review before purchase.
OpenText Fortify Application Security Testing tag profile
Company size
- Enterprise
- Mid-market
- Small business
OpenText Fortify Application Security Testing core capabilities
- SAST across more than 44 languages and 350 frameworks
- DAST for running web applications, services, and major API description and protocol formats
- Secrets and infrastructure-as-code analysis in the SAST workflow
- Centralized finding correlation, policy enforcement, and executive reporting
- IDE, repository, CI/CD, and issue-remediation workflows
- Managed assessments, manual validation, private-cloud hosting, and customer-managed deployment options
Detailed strengths and purchase cautions
Why it is worth considering
- The portfolio supports centralized finding correlation, policy enforcement, and executive reporting, which can help AppSec teams standardize triage and governance across multiple testing motions.
- The product supports IDE, repository, CI/CD, and issue-remediation workflows, which can fit development teams that want security findings to enter existing engineering processes.
- The suite includes both static and dynamic testing paths across named editions, which lets buyers match the edition to a bounded use case instead of assuming one entitlement covers every testing motion.
What to confirm before buying
- Commercial terms for the core suite require a quote, and the public facts do not establish payment timing, commitment term, renewal terms, or implementation amounts.
- Express, Premium, and Ultimate are different modality packages, so buyers need to verify which testing rights and user limits are included in the exact edition they are buying.
- Managed Core Application Security, AWS Marketplace assessment bundles, private-cloud hosting, and adjacent products have separate commercial boundaries, so the quote must name the exact route and SKU.
Cross-model buying perspectives
Multi-AI review
Cross-model buying perspectives
Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.
AI assessment updated: Sep 22, 2026
Score comparisonGeminiGPTxAIRange
Accuracy and validation84807212
Testing scope and depth9288875
Developer workflow8682824
Remediation quality82797012
Risk prioritization83817310
Governance and integrations8584814
Support and total cost70584822
appsec testing coverage depth9088882
appsec finding accuracy prioritization85847411
appsec developer workflow fit8882836
appsec policy release governance8786825
appsec program visibility8585805
- Support and total cost: 48–70 (22-point range)
- Accuracy and validation: 72–84 (12-point range)
- Remediation quality: 70–82 (12-point range)
GeminiAI-assisted buyer perspective85
OpenText Fortify offers deep enterprise application security testing across static, dynamic, and API modalities, but buyers must carefully map their specific workflow requirements to navigate its custom-quoted suites and separate modular boundaries.
- Review confidence
- 85/100
Model details
- Strengths
- Delivers extensive testing coverage with static analysis supporting over 44 languages and 350 frameworks alongside dynamic scanning for web applications and major API protocols.
- Accommodates strict compliance and data-sensitivity needs by offering SaaS, private-cloud, and customer-managed deployment options.
- Streamlines security administration by correlating findings, enforcing policies, and delivering executive reporting from a centralized platform.
- Cautions
- Lacks transparent, self-service pricing and does not offer a permanent free edition or trial for the core testing suites.
- Siloes testing modalities on lower tiers, forcing buyers to choose between a dynamic focus on the Express plan or a static focus on the Premium plan.
- Complicates budget planning by excluding software-composition analysis, training products, and managed assessments from the core suite licenses.
GPTAI-assisted buyer perspective81
OpenText Fortify Application Security Testing fits enterprise AppSec teams that want a quote-based portfolio spanning static, dynamic, policy, and governance workflows, but buyers need to check the exact SKU, deployment route, and module entitlement because pricing and plan boundaries are not self-serve.
- Review confidence
- 81/100
Model details
- Strengths
- The portfolio supports centralized finding correlation, policy enforcement, and executive reporting, which can help AppSec teams standardize triage and governance across multiple testing motions.
- The product supports IDE, repository, CI/CD, and issue-remediation workflows, which can fit development teams that want security findings to enter existing engineering processes.
- The suite includes both static and dynamic testing paths across named editions, which lets buyers match the edition to a bounded use case instead of assuming one entitlement covers every testing motion.
- Cautions
- Commercial terms for the core suite require a quote, and the public facts do not establish payment timing, commitment term, renewal terms, or implementation amounts.
- Express, Premium, and Ultimate are different modality packages, so buyers need to verify which testing rights and user limits are included in the exact edition they are buying.
- Managed Core Application Security, AWS Marketplace assessment bundles, private-cloud hosting, and adjacent products have separate commercial boundaries, so the quote must name the exact route and SKU.
xAIAI-assisted buyer perspective77
OpenText Fortify Application Security Testing fits enterprise AppSec programs that need multi-modality SAST and DAST coverage plus centralized policy and reporting, provided the buyer can work through custom quotes and select the correct edition for static versus dynamic scope.
- Review confidence
- 77/100
Model details
- Strengths
- SAST covers more than 44 languages and 350 frameworks and includes secrets and infrastructure-as-code analysis inside the static workflow, which can reduce tool sprawl for polyglot codebases.
- DAST covers running web applications, services, and major API description and protocol formats, and Ultimate adds unrestricted dynamic-application coverage via sensors.
- Centralized finding correlation, policy enforcement, and executive reporting support a single governance layer across testing results.
- IDE, repository, CI/CD, and issue-remediation workflows let security checks and fix hand-off sit inside existing development pipelines.
- Cautions
- Express, Premium, and Ultimate are custom-quoted application-based packages with no public self-service price list, so total cost, payment timing, commitment, and renewal terms are only known after a sales cycle.
- Express packages dynamic testing while Premium packages static testing
- buyers that need both modalities must move to Ultimate or combine routes rather than treating the editions as a simple feature ladder.
- Software-composition analysis, OpenText Core Application Security managed assessments, Aviator capabilities, and training products sit on separate commercial boundaries from the core suite editions.
Research transparency
How this page was researched
A compact record of the evidence used, what was not tested, and which conclusions still need verification.
- Official sources
- 10
- Broad product review sources
- 0
- Marketplace and app-store sources
- 0
- Editorial sources
- 0
- Latest evidence check
- Aug 12, 2026
Research basis
Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.
Conflict handlingUnresolved evidence is disclosed on the page; affected deterministic calculations and price schema are withheld when the conflict is blocking.
View research methodologyVerified findingsNo permanent free edition or time-limited trial is publicly established for the full Fortify Application Security Testing target. The separate OpenText Core Software Composition Analysis product advertises Free, Premium, and Enterprise plans and a trial.
- Three application-based, custom-quoted suite editions with named-user or scanning-user limits; adjacent products and managed-service routes are licensed separately.
- SAST across more than 44 languages and 350 frameworks DAST for running web applications, services, and major API description and protocol formats Secrets and infrastructure-as-code analysis in the SAST workflow Centralized finding correlation, policy enforcement, and executive reporting IDE, repository, CI/CD, and issue-remediation workflows Managed assessments, manual validation, private-cloud hosting, and customer-managed deployment options
- Requires quote
- Express packages dynamic testing for ten applications and one WebInspect named user. Premium packages static testing and central management for ten applications and five scanning users. Ultimate combines the Premium static scope with unlimited dynamic applications. Direct numeric suite prices, payment timing, commitment, renewal terms, and implementation amounts are not public. Managed OpenText Core Application Security, AWS Marketplace assessment bundles, and Private Cloud are distinct routes rather than suite plans.
Verification notes and unresolved itemsThe AWS dimension label says 1 AU (>100), while its description says 100+ Assessment Units with Managed Support. The high-volume offer is retained with the exact description, but no numeric minimum is asserted.
- The June 22, 2026 licensing document is the adopted authority for core edition names and limits
- no public numeric suite amount, payment timing, commitment term, renewal term, or implementation amount was found.
- The AWS listing indicates twelve dimensions but the accessible public table exposed ten
- only those ten directly captured route offers are retained.
Sources checked
Sources checked
OpenText Fortify Application Security Testing source links
OpenText Core Application Security (Fortify)AWS MarketplaceLevel A2Linked to 3 scored claimsChecked Aug 12, 2026
OpenText Application Security Private CloudOpenTextLevel A2Linked to 0 scored claimsChecked Aug 12, 2026
OpenText Core Application Security (Fortify on Demand) 26.1 Release NotesOpenTextLevel A2Linked to 0 scored claimsChecked Aug 12, 2026
OpenText Core Application Security Standard Service (Fortify on Demand) Service DescriptionOpenTextLevel A2Linked to 1 scored claimChecked Aug 12, 2026
OpenText Fortify on DemandOpenTextLevel A2Linked to 1 scored claimChecked Aug 12, 2026
OpenText Fortify Software Composition AnalysisOpenTextLevel A2Linked to 5 scored claimsChecked Aug 12, 2026
OpenText Fortify Dynamic Application Security TestingOpenTextLevel A2Linked to 1 scored claimChecked Aug 12, 2026
OpenText Fortify Static Application Security TestingOpenTextLevel A2Linked to 1 scored claimChecked Aug 12, 2026
FAQ
OpenText Fortify Application Security Testing FAQ
What is the current product name?
OpenText presents the family as Fortify Application Security Testing. During the naming migration, Fortify on Demand became OpenText Core Application Security, Fortify Static Code Analyzer became OpenText SAST, and Fortify WebInspect became OpenText DAST. Legacy names remain visible in licensing material.
Does SCA always mean software-composition analysis in Fortify material?
No. Current portfolio copy uses SCA for software-composition analysis, while licensing material also uses Fortify Static Code Analyzer, historically abbreviated SCA, for the static-analysis engine. The separate open-source product is OpenText Fortify Software Composition Analysis or OpenText Core SCA.
Which core edition includes both SAST and DAST?
Security Fortify Ultimate Edition Suite includes the Premium static-analysis components and WebInspect Enterprise with unlimited dynamic applications. Express is dynamic-focused; Premium is static-focused.
Is Fortify on Demand a core plan?
No. Fortify on Demand is now OpenText Core Application Security, a related multi-tenant managed SaaS product with assessment subscriptions and services.
Does Fortify have a free full-platform plan?
No public permanent free edition is established for the full target. The Free plan and trial shown by OpenText belong to the separate Core Software Composition Analysis product.
Do the AWS Marketplace prices establish the Fortify suite starting price?
No. They price 12-month assessment-unit bundles for OpenText Core Application Security, the related managed SaaS route, and are not prices for Express, Premium, or Ultimate.
Popular comparisons
Common OpenText Fortify Application Security Testing comparisons
Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.
VS #1
OpenText Fortify Application Security TestingvsGitHub Advanced Security
80Gap 179
Mid-market / Enterprise / Small business
VS #2
OpenText Fortify Application Security TestingvsVeracode Application Risk Management Platform
80Gap 080
Enterprise / Mid-market
VS #3
OpenText Fortify Application Security TestingvsInvicti Platform
80Gap 181
Enterprise / Mid-market