Try our new research platform with insights from 80,000+ expert users
Fortify Application Defender Logo

Fortify Application Defender Reviews

Vendor: OpenText
3.9 out of 5
Leave a review

What is Fortify Application Defender?

Micro Focus Security Fortify Application Defender is a runtime application self-protection (RASP) solution that helps you manage and mitigate risk from homegrown or third-party applications. It provides centralized visibility into application use and abuse while protecting from software vulnerability exploits and other violations in real time.

Get the Application Security Tools Buyer's Guide and find out what your peers are saying about Fortify Application Defender, SonarQube Server (formerly SonarQube), Snyk and more!
Fortify Application Defender is the #25 ranked solution in application security solutions. PeerSpot users give Fortify Application Defender an average rating of 7.8 out of 10. Fortify Application Defender is most commonly compared to SonarQube Server (formerly SonarQube): Fortify Application Defender vs SonarQube Server (formerly SonarQube). Fortify Application Defender is popular among the large enterprise segment, accounting for 72% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 17% of all views.
Buyer's Guide
Application Security Tools
August 2025
Get the category report
Helped 866,218 peers since 2012

Featured Fortify Application Defender reviews

Read more reviews

Fortify Application Defender mindshare

As of August 2025, the mindshare of Fortify Application Defender in the Application Security Tools category stands at 0.8%, up from 0.7% compared to the previous year, according to calculations based on PeerSpot user engagement data.
Application Security Tools Market Share Distribution
ProductMarket Share (%)
Fortify Application Defender0.8%
SonarQube Server (formerly SonarQube)22.4%
Checkmarx One10.3%
Other66.5%
Application Security Tools
 
 
Key learnings from peers

Valuable Features

Fortify Application Defender's most valuable features include real-time data analysis, security defect identification, simple user interface, static code analysis, automatic vulnerability notifications, machine learning algorithms, and rule customization. It integrates easily with code repositories and CI/CD pipelines and offers fast scanning. The tool provides specific application defense, helpful information for issue resolution, and software composition analysis, enhancing security assessments and saving cost and time. Its rule configuration and default code packages are also appreciated.
  • "I find the configuration of rules in Fortify Application Defender useful. Its integration is also easy."
  • "The tool's most valuable feature is software composition analysis. This feature works well with my .NET applications, providing a better understanding of library vulnerabilities."
  • "The product saves us cost and time."

Room for Improvement

Fortify Application Defender lacks support for older compilers and IDEs, limiting its compatibility with legacy systems. It struggles with performance, complex licensing, and offers inadequate technical support. The tool's false positive rate is high, especially for Python. It lacks support for additional programming languages and platforms like Python and GRAAS. It should integrate better with code review tools and improve scanning speed. Integration with Azure DevOps Marketplace would enhance usability.
  • "The product should integrate industry-standard code review tools internally with its system. This would streamline the coding process, as developers wouldn't need multiple tools for code review and security checks. Many independent and open-source tools are available, from Apache to various libraries. Using multiple DevOps pipeline tools can slow the turnaround time."
  • "I encountered many false positives for Python applications."
  • "The false positive rate should be lower."

Pricing

Enterprise users report that Fortify Application Defender's base licensing costs $900 USD per application annually. Pricing may vary significantly based on company size and project type, ranging from $10,000 to over $200,000, with some companies paying around 50 lakhs. Complexity in licensing is highlighted, with the tool being described as expensive compared to competitors. Pricing ratings from users range between five and seven out of ten, often pointing to higher costs despite available trial periods.
  • "I rate the solution's pricing a five out of ten. It comes as an annual cloud subscription. The tool's pricing is around 50 lakhs."
  • "The product’s price is much higher than other tools."
  • "Fortify Application Defender is very expensive."

Popular Use Cases

Fortify Application Defender is utilized by organizations for static code analysis across various environments like Altera, Xilinx, Linux, and Windows. Teams employ the system to ensure security in banking projects by checking code for exposed IPs and passwords. It serves as an additional layer for application-specific threat blocking and is integrated into DevOps pipelines. Companies use it for large-scale code scanning, assessing security defenses, and supporting agile development processes.

Service and Support

Customer service and support for Fortify Application Defender show mixed feedback. Some find technical support helpful and responsive, while others note the need for improvement, citing issues since the acquisition by HP. Communication and resolution speed are areas for enhancement. Some rely on partners and find the documentation comprehensive. Several appreciate the vendor's willingness to address technical challenges, although many feel that support lacks sufficient expertise. Senior management is aware and working on resolving these issues.

Deployment

Initial setup experiences with Fortify Application Defender are generally straightforward, requiring collaboration between security and operations teams for successful deployment. In development environments, deployment may take five minutes, while pre-production and production can require more time due to maturity needs. Companies find the setup easy, rating it between six to eight out of ten. Deployments can take from four hours to a week, depending on integration complexities. Maintenance typically requires minimal staff involvement.

Scalability

Fortify Application Defender demonstrates good scalability for many users and projects. Some note that proper infrastructure enhances scalability. Concerns arise with increasing code complexity and licensing issues. Scalability ratings range from three to eight out of ten. The tool is actively used in cloud-based environments integrating various tests, but issues with handling numerous lines of code and licensing limitations have been highlighted by users. Generally, scalability is viewed positively with a few reservations.

Stability

Users consistently find Fortify Application Defender stable, describing it as robust and reliable. Many express satisfaction with its performance, noting minimal issues impacting dependability. It is often viewed as a "deploy it and forget it" type system, suggesting long-term reliability. Ratings for its stability frequently include perfect scores, such as ten out of ten, with several users considering it excellent and dependable, highlighting their positive assessment of its long-term functionality and effectiveness.
These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.
Download our Application Security Tools Buyer's Guide for additional reliable information.

Review data by company size

By reviewers
Company SizeCount
Small Business3
Midsize Enterprise1
Large Enterprise6
By reviewers
By visitors reading reviews
Company SizeCount
Small Business19
Midsize Enterprise24
Large Enterprise112
By visitors reading reviews

Top industries

By visitors reading reviews
Financial Services Firm
17%
Manufacturing Company
15%
Computer Software Company
12%
Government
9%
University
6%
Healthcare Company
5%
Comms Service Provider
5%
Retailer
4%
Performing Arts
3%
Energy/Utilities Company
3%
Insurance Company
3%
Real Estate/Law Firm
3%
Media Company
2%
Educational Organization
2%
Non Profit
2%
Transportation Company
2%
Aerospace/Defense Firm
2%
Non Tech Company
1%
Recreational Facilities/Services Company
1%
Renewables & Environment Company
1%
Outsourcing Company
1%
Logistics Company
1%
Engineering Company
1%
Leisure / Travel Company
1%
Construction Company
1%
Wholesaler/Distributor
1%

Compare Fortify Application Defender with alternative products

Go!

Learn more about Fortify Application Defender

Fortify Application Defender was previously known as HPE Fortify Application Defender, Micro Focus Fortify Application Defender.

Fortify Application Defender customers

ServiceMaster, Saltworks, SAP

Related questions

  • 679
What is the Biggest Difference Between Checkmarx and Fortify?
  • 278
If you had to both encrypt and compress data during transmission, which would you do first and why?
  • 14
When evaluating Application Security, what aspect do you think is the most important to look for?
  • 78
What are the Top 5 cybersecurity trends in 2022?
  • 110
What are the threats associated with using ‘bogus’ cybersecurity tools?
  • 29
We're evaluating Tripwire, what else should we consider?
  • 7
Which application security solutions include both vulnerability scans and quality checks?
  • 734
Is SonarQube the best tool for static analysis?
  • 8
Why Do I Need Application Security Software?
  • 57
Which Email Security enterprise solution would you choose: Cisco Secure Email vs Forcepoint Email Security vs Barracuda Email Security Gateway?

Product Categories

Product Categories
Application Security Tools

Popular Comparisons

Popular Comparisons
SonarQube Server (formerly SonarQube) vs Fortify Application Defender Logo
SonarQube Server (formerly SonarQube) vs Fortify Application Defender
Snyk vs Fortify Application Defender Logo
Snyk vs Fortify Application Defender
Checkmarx One vs Fortify Application Defender Logo
Checkmarx One vs Fortify Application Defender
Veracode vs Fortify Application Defender Logo
Veracode vs Fortify Application Defender
Mend.io vs Fortify Application Defender Logo
Mend.io vs Fortify Application Defender
GitHub Advanced Security vs Fortify Application Defender Logo
GitHub Advanced Security vs Fortify Application Defender
OpenText Core Application Security vs Fortify Application Defender Logo
OpenText Core Application Security vs Fortify Application Defender
Qualys Web Application Scanning vs Fortify Application Defender Logo
Qualys Web Application Scanning vs Fortify Application Defender
Tenable.io Web Application Scanning vs Fortify Application Defender Logo
Tenable.io Web Application Scanning vs Fortify Application Defender
Digital.ai Application Security vs Fortify Application Defender Logo
Digital.ai Application Security vs Fortify Application Defender
Blue Cedar vs Fortify Application Defender Logo
Blue Cedar vs Fortify Application Defender
See all alternatives
 
Fortify Application Defender Reviews Summary
Author infoRatingReview Summary
CTO at Abcl3.5We use Fortify Application Defender for fast code review within our DevOps pipeline. Its easy integration and configuration of rules are valuable. It could improve by integrating industry-standard code review tools. We switched from Checkmarx due to Fortify's better support and pricing.
Senior Security Analyst (AppSec) at ELETROBRAS4.5I use Fortify Application Defender to analyze .NET projects. It excels in software composition analysis and integrates easily with GitLab and CI/CD pipelines, though I encounter many false positives with Python applications. Checkmarx previously offered fewer false positives.
Software Development Engineer 3 at a consultancy with 10,001+ employees3.0I use Fortify Application Defender to test our products' defenses but find the machine learning, real-time remediation, and automatic notifications valuable. However, it generates many false positives without showing ROI, prompting a switch from HCL AppScan.
Department Manger at Hitachi Channel3.0We use Fortify Application Defender to prevent cyberattacks. It efficiently identifies software vulnerabilities, saving us cost and time. However, it struggles with Java coding and has a high false positive rate. Improved licensing options and costs would be beneficial.
System Quality Assurance Manager at AIS - Advanced Info Services Plc.3.5No summary available
Director of Security at Merito4.0No summary available
DevOps Engineer at a energy/utilities company with 10,001+ employees4.5No summary available
Senior Manager Technical Operations at NeuStar3.5No summary available