Try our new research platform with insights from 80,000+ expert users

Contrast Security Assess vs OpenText Dynamic Application Security Testing comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Contrast Security Assess
Average Rating
8.8
Reviews Sentiment
7.2
Number of Reviews
11
Ranking in other categories
Application Security Tools (29th), Static Application Security Testing (SAST) (27th)
OpenText Dynamic Applicatio...
Average Rating
7.2
Reviews Sentiment
6.1
Number of Reviews
22
Ranking in other categories
Dynamic Application Security Testing (DAST) (3rd), DevSecOps (8th)
 

Mindshare comparison

While both are Application Lifecycle Management solutions, they serve different purposes. Contrast Security Assess is designed for Static Application Security Testing (SAST) and holds a mindshare of 1.0%, up 0.4% compared to last year.
OpenText Dynamic Application Security Testing, on the other hand, focuses on Dynamic Application Security Testing (DAST), holds 11.3% mindshare, up 9.7% since last year.
Static Application Security Testing (SAST) Mindshare Distribution
ProductMindshare (%)
Contrast Security Assess1.0%
SonarQube17.7%
Checkmarx One10.4%
Other70.9%
Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST) Mindshare Distribution
ProductMindshare (%)
OpenText Dynamic Application Security Testing11.3%
Veracode17.2%
Checkmarx One16.4%
Other55.1%
Dynamic Application Security Testing (DAST)
 

Featured Reviews

reviewer1605099 - PeerSpot reviewer
Director of Threat and Vulnerability Management at a consultancy with 10,001+ employees
We're gathering vulnerability data from multiple environments in real time, fundamentally changing how we identify issues in applications
The solution is very accurate in identifying vulnerabilities. In cases where we are performing application assessment using Contrast Assess, and also using legacy application security testing tools, Contrast successfully identifies the same vulnerabilities that the other tools have identified but it also identifies significantly more. In addition, it has visibility into application components that other testing methodologies are unaware of. Assess also provides the option of helping developers incorporate security elements while they're writing code. It depends on whether individual developers decide to utilize the information that's provided to them from the solution, but it definitely gives them visibility into more environments. It gives them an opportunity to remediate vulnerabilities well before production deployments.
AP
Cyber Security Consultant at a tech vendor with 10,001+ employees
Enhancements in manual testing align with reporting and integration features
WebInspect works efficiently with Java-based or .NET based applications. However, it struggles with Salesforce applications, where it requires approximately 20-24 hours to crawl and audit but produces minimal findings, necessitating manual verification. The solution offers customization features for crawling and vulnerability detection. It includes various security frameworks and allows selection of specific vulnerability types to audit, such as OWASP Top 10 or JavaScript-based vulnerabilities. When working with APIs, we can select OWASP API Top 10. The tool also supports custom audit features by combining different security frameworks. For on-premises deployment, the setup is complex, particularly regarding SQL server configuration. Unlike Burp Suite or OpenText Dynamic Application Security Testing, which have simpler setup processes, WebInspect requires SQL server setup to function.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"In our most critical applications, we have a deep dive in the code evaluation, which was something we usually did with periodic vulnerability assessments, code reviews, etc. Now, we have real time access to it. It's something that has greatly enhanced our code's quality. We have actually embedded a KPI in regards to the improvement of our code shell. For example, Contrast provides a baseline where libraries and the usability of the code are evaluated, and they produce a score. We always aim to improve that score. On a quarterly basis, we have added this to our KPIs."
"When we access the application, it continuously monitors and detects vulnerabilities."
"It is a stable solution...Contrast Security Assess is one of the first players in this market, so they have experience and customers, especially abroad. Overall, it's a good product."
"No other tool does the runtime scanning like Contrast does. Other static analysis tools do static scanning, but Contrast is runtime analysis, when the routes are exercised. That's when the scan happens. This is a tool that has a very unique capability compared to other tools. That's what I like most about Contrast, that it's runtime."
"Assess has an excellent API interface to pull APIs."
"The most valuable feature is the continuous monitoring aspect: the fact that we don't have to wait for scans to complete for the tool to identify vulnerabilities. They're automatically identified through developers' business-as-usual processes."
"By far, the thing that was able to provide value was the immediate response while testing ahead of release, in real-time."
"The solution is very accurate in identifying vulnerabilities. In cases where we are performing application assessment using Contrast Assess, and also using legacy application security testing tools, Contrast successfully identifies the same vulnerabilities that the other tools have identified but it also identifies significantly more. In addition, it has visibility into application components that other testing methodologies are unaware of."
"There are lots of small settings and tools, like an HTTP editor, that are very useful."
"Good at scanning and finding vulnerabilities."
"The solution's technical support was very helpful."
"The solution is easy to use."
"The user interface is ok and it is very simple to use."
"The feature that has been most influential in identifying vulnerabilities is its ability to crawl the website, understand the structure, and analyze the network packets sent and received."
"The accuracy of its scans is great."
"The transaction recorder within WebInspect is easy to use, which is valuable for our team."
 

Cons

"The setup of the solution is different for each application. That's the one thing that has been a challenge for us. The deployment itself is simple, but it's tough to automate because each application is different, so each installation process for Contrast is different."
"Personalization of the board and how to make it appealing to an organization is something that could be done on their end. The reports could be adaptable to the customer's preferences."
"The solution needs to improve flexibility...The scalability of the product is a problem in the solution, especially from a commercial perspective."
"The out-of-the-box reporting could be improved. We need to write our own APIs to make the reporting more robust."
"I think there was activity underway to support the centralized configuration control. There are ways to do it, but I think they were productizing more of that."
"The product's retesting part needs improvement. The tool also needs improvement in the suggestions provided for fixing vulnerabilities. It relies more on documentation rather than on quick fixes."
"The solution should provide more details in the section where it shows that third-party libraries have CVEs or some vulnerabilities."
"Regarding the solution's OSS feature, the one drawback that we do have is that it does not have client-side support. We'll be missing identification of libraries like jQuery or JavaScript, and such, that are client-side."
"One thing I would like to see them introduce is a cloud-based platform."
"The scanner could be better."
"It took us between eight and ten hours to scan an entire site, which is somewhat slow and something that I think can be improved."
"We have had a problem with authentification."
"I want to enhance automation. Currently, Fortify WebInspect can scan and find vulnerabilities, but users with specific skills need to interpret the results and understand how to address them."
"It requires improvement in terms of scanning. The application scan heavily utilizes the resources of an on-premise server. 32 GB RAM is very high for an enterprise web application."
"Creating reports is very slow and it is something that should be improved."
"The initial setup was complex."
 

Pricing and Cost Advice

"It's a tiered licensing model. The more you buy, as you cross certain quantity thresholds, the pricing changes. If you have a smaller environment, your licensing costs are going to be different than a larger environment... The licensing is primarily per application. An application can be as many agents as you need. If you've got 10 development servers and 20 production servers and 50 QA servers, all of those agents can be reporting as a single application that utilizes one license."
"The good news is that the agent itself comes in two different forms: the unlicensed form and the licensed form. Unlicensed gives use of that software composition analysis for free. Thereafter, if you apply a license to that same agent, that's when the instrumentation takes hold. So one of my suggestions is to do what we're doing: Deploy the agent to as many applications as possible, with just the SCA feature turned on with no license applied, and then you can be more choosy and pick which teams will get the license applied."
"For what it offers, it's a very reasonable cost. The way that it is priced is extremely straightforward. It works on the number of applications that you use, and you license a server. It is something that is extremely fair, because it doesn't take into consideration the number of requests, etc. It is only priced based on the number of onboarded applications. It suits our model as well, because we have huge traffic. Our number of applications is not that large, so the pricing works great for us."
"I like the per-application licensing model... We just license the app and we look at different vulnerabilities on that app and we remediate within the app. It's simpler."
"You only get one license for an application. Ours are very big, monolithic applications with millions of lines of code. We were able to apply one license to one monolithic application, which is great. We are happy with the licensing. Pricing-wise, they are industry-standard, which is fine."
"The product's pricing is low. I would rate it a two out of ten."
"The solution is expensive."
"It’s a fair price for the solution."
"This solution is very expensive."
"Our licensing is such that you can only run one scan at a time, which is inconvenient."
"The pricing is not clear and while it is not high, it is difficult to understand."
"Fortify WebInspect is a very expensive product."
"The price is okay."
"Its price is almost similar to the price of AppScan. Both of them are very costly. Its price could be reduced because it can be very costly for unlimited IT scans, etc. I'm not sure, but it can go up to $40,000 to $50,000 or more than that."
report
Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
884,873 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
20%
Manufacturing Company
11%
Computer Software Company
9%
Comms Service Provider
7%
Government
14%
Financial Services Firm
13%
Manufacturing Company
9%
Computer Software Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise3
Large Enterprise6
By reviewers
Company SizeCount
Small Business7
Midsize Enterprise1
Large Enterprise15
 

Questions from the Community

Ask a question
Earn 20 points
What is your experience regarding pricing and costs for Fortify WebInspect?
While I am not directly involved with licensing, I can share that our project's license for 1-9 applications costs between $15,000 to $19,000. In comparison, Burp Suite costs approximately $500 to ...
What needs improvement with Fortify WebInspect?
WebInspect works efficiently with Java-based or .NET based applications. However, it struggles with Salesforce applications, where it requires approximately 20-24 hours to crawl and audit but produ...
What is your primary use case for Fortify WebInspect?
I am currently working with several tools. For Fortify, I use SCA and WebInspect. Apart from that, I use Burp Suite from PortSwigger. For API testing, I use Postman with Burp Suite or WebInspect fo...
 

Also Known As

Contrast Assess
Micro Focus WebInspect, WebInspect
 

Overview

 

Sample Customers

Williams-Sonoma, Autodesk, HUAWEI, Chromeriver, RingCentral, Demandware.
Aaron's
Find out what your peers are saying about Contrast Security Assess vs. OpenText Dynamic Application Security Testing and other solutions. Updated: May 2022.
884,873 professionals have used our research since 2012.