No more typing reviews! Try our Samantha, our new voice AI agent.

HackerOne vs OpenText Core Application Security comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 29, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
5.6
HackerOne enhances security and efficiency with varied ROI; larger entities benefit more than smaller ones, citing cost savings.
Sentiment score
3.7
OpenText Core Application Security automates scans, enhances security, reduces costs, and is essential for minimizing risks and data leaks.
HackerOne provides strong value by helping organizations find vulnerabilities faster and reduce the higher costs associated with security breaches.
Senior software engineer at Simplify vms
We receive rewards without needing to invest any money, so the return on investment is substantial.
dApp Auditor at Hacken
For someone who is starting or in the middle, it is very difficult because you can spend 20 hours sending 20 reports but none of them gets anything.
QA Engineering Lead at kintsugi
There is definitive ROI if OpenText Core Application Security is deployed properly; it substantially reduces efforts in securing the solution while averting various application-related risks.
Co-Founder at Insecsys Technologies Private Limited
 

Customer Service

Sentiment score
6.9
HackerOne's customer support is generally proactive and responsive, though some users have noted slower responses and communication issues.
Sentiment score
7.0
Customer service is praised for responsiveness, but technical support experiences vary, with both effective assistance and unresolved issues.
We have priority support because we are a higher tier, and with high report volumes, the turnaround time is very good.
Senior software engineer at Simplify vms
Technical support at HackerOne has slowed down considerably compared to four years ago.
dApp Auditor at Hacken
The ease of collaboration with ethical hackers on HackerOne has been quite good.
Senior Security Professional at Oportun, Inc.
Support tickets often stay open for one month to three months, which leads to customer frustration.
Chief Innovation Officer at SAGGA
I had direct interaction with them, which facilitated how we onboarded Fortify.
Lead Cybersecurity at TBO
The technical support from OpenText is very good.
Co-Founder at Insecsys Technologies Private Limited
 

Scalability Issues

Sentiment score
7.6
HackerOne's scalable design efficiently supports growth and adaptability, accommodating large user bases and varying security needs effectively.
Sentiment score
7.2
OpenText Core Application Security scales effectively in the cloud but faces pricing and scan-related challenges across industries.
It is a large platform with many programs and clients.
dApp Auditor at Hacken
HackerOne is very scalable because we can put bounties for any number of hackers at the same time and test thoroughly.
Senior software engineer at Simplify vms
It maintains a high signal-to-noise ratio and addresses scalability through infrastructure, triage services, and AI automation.
Consultant at a manufacturing company with 10,001+ employees
If a customer wants to know the tools and the technology used for their application to scan their application, they provide less information on that.
Lead Cybersecurity at TBO
OpenText Core Application Security is highly scalable; it is running on the cloud, and elasticity is one of the best points of a cloud environment.
Cloud Security Manager at T-Systems International GmbH
Fortify is superior to many solutions because of its scalability and that it does not require massive compute capabilities for its SAST and sandboxing features.
Co-Founder at Insecsys Technologies Private Limited
 

Stability Issues

Sentiment score
8.2
HackerOne generally receives praise for stability and reliability, despite occasional reports of minor bugs and downtime.
Sentiment score
8.7
OpenText Core Application Security is reliable with minor resource concerns, consistent updates, and occasional JavaScript-related performance issues.
HackerOne was down for some time and the response was not good.
QA Engineering Lead at kintsugi
OpenText Core Application Security is stable and has minimal downtime, benefitting from AWS cloud availability.
Co-Founder at Insecsys Technologies Private Limited
 

Room For Improvement

Users seek cost predictability, faster responses, better integrations, improved triaging, communication, invite guidelines, and flexible payouts.
OpenText Core Application Security faces efficiency, integration, and usability challenges, prompting calls for improvements in AI, interfaces, and pricing.
More advanced AI capabilities would help prioritize reports, reduce false positives, and speed up the validation.
Senior software engineer at Simplify vms
There are no clear guidelines for being invited to programs and conferences.
dApp Auditor at Hacken
Sometimes new users don't receive invites just because they are new, despite potentially being very skilled hackers, so I feel new users should get more chances and opportunities.
Senior ICT Security Consultant at Applied Principles Limited
It would be beneficial if Fortify could check for CVEs (Common Vulnerabilities and Exposures) in third-party libraries, which I currently use a separate dependency checker tool for.
Lead Developer at a legal firm with 1,001-5,000 employees
One thing I would highlight is if Fortify can focus more on the centralized dashboard of the tools because nowadays, tools such as SentinelOne also exist for identifying security issues, but they have a centralized dashboard that merges their cloud solution and application security side solution together.
Lead Cybersecurity at TBO
I would say OpenText Core Application Security is not very user-friendly in terms of price; it is quite high.
Co-Founder at Insecsys Technologies Private Limited
 

Setup Cost

HackerOne is cost-effective for hunters, typically funded by companies, with a 20% fee on awards, making it affordable.
OpenText Core Application Security is considered costly, but features and integration often justify the price for users.
The cost is rated as one since there is no need to pay anything, not even a fee or commission.
dApp Auditor at Hacken
I have not experienced any costs since I use HackerOne independently, just logging into the site, hunting bugs, and submitting them without any expenses.
Senior ICT Security Consultant at Applied Principles Limited
 

Valuable Features

HackerOne excels in vulnerability tracking, researcher engagement, and integration, enhancing security through a global ethical hacker community.
OpenText Core Application Security is valued for vulnerability detection, DevOps integration, comprehensive scanning, customization, and enterprise scalability.
It has a very simple user interface, and it gives you a quick response—if you submit a bug, someone reaches out to you within minutes, telling you they will verify the bug, and it can be verified in just a few days, sometimes even less than a day, which stands out for me.
Senior ICT Security Consultant at Applied Principles Limited
HackerOne is a very good platform with the trust of different companies including Shopify, PayPal, and Uber.
Senior software engineer at Simplify vms
I find bug bounty programs most valuable for our organization because they invite researchers from around the globe to find bugs in our environment, allowing us to fix various severity vulnerabilities or bugs that, if left unaddressed, could lead to losing customers.
Consultant at a manufacturing company with 10,001+ employees
Fortify helps me find serious issues, such as developers inadvertently leaving access tokens, including API access tokens, in the source code.
Lead Developer at a legal firm with 1,001-5,000 employees
On demand you have two levels of reports: the first from the tool, which is the same as we can get from Fortify on-premises, and a next level reporting made by experts from OpenText, leading to a more condensed and precise report as level three.
Chief Innovation Officer at SAGGA
Additionally, you can integrate Fortify in CICD pipeline, so you get real-time updates about the security issues in your pipeline.
Lead Cybersecurity at TBO
 

Categories and Ranking

HackerOne
Ranking in Application Security Tools
19th
Average Rating
8.4
Reviews Sentiment
6.9
Number of Reviews
11
Ranking in other categories
Vulnerability Management (35th), Bug Bounty Platforms (2nd), Penetration Testing Services (2nd), Attack Surface Management (ASM) (5th), AI Observability (17th)
OpenText Core Application S...
Ranking in Application Security Tools
11th
Average Rating
8.0
Reviews Sentiment
7.0
Number of Reviews
64
Ranking in other categories
Static Application Security Testing (SAST) (9th)
 

Mindshare comparison

As of September 2026, in the Application Security Tools category, the mindshare of HackerOne is 0.9%, up from 0.2% compared to the previous year. The mindshare of OpenText Core Application Security is 3.3%, down from 4.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools Mindshare Distribution
ProductMindshare (%)
OpenText Core Application Security3.3%
HackerOne0.9%
Other95.8%
Application Security Tools
 

Featured Reviews

NitishKumar - PeerSpot reviewer
Consultant at a manufacturing company with 10,001+ employees
Crowdsourced security has strengthened our bug discovery and improved vulnerability response
HackerOne is already doing well, although I believe implementing stricter SLAs for the time to first response and time to bounty would help prevent researchers' burnout, especially regarding duplicate submissions. I suggest systematic bug rewards because currently, if a researcher finds one bug in multiple places, they often only get paid for one. Improving the handling of systemic vulnerabilities would encourage deeper research. Additionally, improving multi-currency and crypto payout options would help make the platform more accessible globally.
Himanshu_Tyagi - PeerSpot reviewer
Lead Cybersecurity at TBO
Supports secure development pipelines and improves issue detection but limits internal visibility and needs broader dashboard integration
If you have an internal team and you want your internal team to validate false positives, basically to determine whether it's a valid issue or an invalid issue, then I wouldn't recommend it much. That was the only reason we migrated from Fortify on Demand to another solution. Fortify has another tool which is Fortify WebInspect. On Demand is the outsourcing solution, and WebInspect you can use with your in-house team, which is basically the product developed by the Fortify team. For automated scanning, Fortify helps a lot. Regarding the visibility for the internal team, everyone is moving toward the DevSecOps side, and Fortify team has made good progress that you can integrate into your CICD pipeline. One thing I would highlight is if Fortify can focus more on the centralized dashboard of the tools because nowadays, tools such as SentinelOne also exist for identifying security issues, but they have a centralized dashboard that merges their cloud solution and application security side solution together. If you have one tool that works for different solutions, it helps a lot. They are doing good, but they should invest more on the AI side as well because AI security is evolving these days. On the cloud side, they have already made good progress, but I believe they should explore the new area related to AI security as well.
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
913,683 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
13%
Manufacturing Company
11%
Financial Services Firm
10%
Outsourcing Company
7%
Financial Services Firm
12%
Outsourcing Company
11%
Manufacturing Company
9%
Construction Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business7
Midsize Enterprise1
Large Enterprise7
By reviewers
Company SizeCount
Small Business18
Midsize Enterprise8
Large Enterprise46
 

Questions from the Community

What is your experience regarding pricing and costs for HackerOne?
I'm not very sure about pricing, setup costs, and licensing, as those are managed by our management team.
What needs improvement with HackerOne?
HackerOne can be improved, and the insights can be a little better. I chose a nine for my rating because it has very great features such as a large research community, workflow integration, analyti...
What is your primary use case for HackerOne?
My main use case for HackerOne is bug bounties and getting paid through that platform. Companies like Fastify and Oracle create bug bounties and vulnerability disclosure programs on HackerOne. Ethi...
What needs improvement with Micro Focus Fortify on Demand?
Areas for improvement should be contextualized post the OpenText acquisition, but back when I was working with Micro Focus, they focused heavily on enterprise-centric solutions. Now, after the acqu...
What is your primary use case for Micro Focus Fortify on Demand?
For OpenText Core Application Security, I currently support a couple of my clients who are using Fortify on Demand for their web application, CRM, and sales platform. Many good features of Fortify ...
What advice do you have for others considering Micro Focus Fortify on Demand?
I use Fortify on Demand for monitoring up to a certain extent; it provides monitoring and helps analyze and identify issues that could propagate in the application. When used in conjunction with Ar...
 

Also Known As

HackerOne Assets, HackerOne Pentesting Services, HackerOne Security Assessments, HackerOne Vulnerability Management
Micro Focus Fortify on Demand
 

Overview

 

Sample Customers

Anthropic, Crypto.com, General Motors, GitHub, Goldman Sachs, Uber, and the U.S. Department of Defense
SAP, Aaron's, British Gas, FICO, Cox Automative, Callcredit Information Group, Vital and more.
Find out what your peers are saying about HackerOne vs. OpenText Core Application Security and other solutions. Updated: September 2026.
913,683 professionals have used our research since 2012.