Try our new research platform with insights from 80,000+ expert users

JFrog Xray vs OpenText Static Application Security Testing comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
3.5
JFrog Xray improved efficiency, security, and compliance, reduced downtime, and sped up release cycles with enhanced vulnerability detection and reporting.
Sentiment score
6.8
OpenText Static Application Security Testing received mixed reviews, praising cost savings and partnerships, but highlighting challenges in quantifying ROI.
 

Customer Service

Sentiment score
4.0
JFrog Xray's customer service is generally well-received, with positive technical support, though not all users engage directly.
Sentiment score
6.7
Generally positive with dedicated teams, though some seek improvements in ticket system and responsiveness for OpenText support.
When we need clarifications, we contact our account manager, and they arrange demos.
Development Senior at a financial services firm with 5,001-10,000 employees
On a scale of 1 to 10, I would rate the technical support of JFrog Xray an eight because they are very knowledgeable.
DevSecOps Engineer at a tech services company with 501-1,000 employees
The technical support has been good because we always received answers to our questions.
Manager at DTEK
The customer service and support for Fortify Static Code Analyzer are better than those for LoadRunner.
CTO at Marco Technology
 

Scalability Issues

Sentiment score
6.8
JFrog Xray is scalable and suitable for multiple applications, despite PostgreSQL limitations and some performance challenges.
Sentiment score
7.8
OpenText SAST is scalable for various project sizes but needs improvement in speed and infrastructure management.
According to my use case, it is highly scalable.
DevOps Engineer at Syvora
Fortify Static Code Analyzer integrates well and is scalable.
CTO at Marco Technology
 

Stability Issues

Sentiment score
7.6
JFrog Xray is praised for stability and security, compared favorably to competitors, with minor concerns about PostgreSQL support.
Sentiment score
7.5
OpenText Static Application Security Testing is reliable and stable, with improvements since version 19.10, and benefits from proper training.
I use JFrog Xray primarily for security purposes, and I find it reliable.
DevOps Engineer at Syvora
We did experience crashes, downtimes, and performance issues with JFrog Xray.
DevSecOps Engineer at a tech services company with 501-1,000 employees
I would rate the product stability as an eight.
Lead Information Security Analyst at a financial services firm with 10,001+ employees
The stability of Fortify Static Code Analyzer is generally good.
CTO at Marco Technology
 

Room For Improvement

Users demand better reporting, documentation, UI, site performance, API limits, custom reports, vulnerability management, and integration support.
OpenText SAST faces high costs, complex use, false positives, and needs better integration, language support, and feature enhancements.
somehow you need to adapt your GitLab pipeline and turn them into JFrog pipeline, and this is something they don't really advertise at first—you're obliged to use the JFrog CLI.
DevSecOps Engineer at a tech services company with 501-1,000 employees
When we have given a very long tag, it doesn't work as expected and requires excessive scrolling.
DevOps Engineer at Syvora
X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL.
Development Senior at a financial services firm with 5,001-10,000 employees
We would appreciate if the AI could give us more information about improvements and reduce the number of false positives, but this solution doesn't have this function yet.
Manager at DTEK
It would be really helpful to include trending vulnerabilities and how to manage them.
Lead Information Security Analyst at a financial services firm with 10,001+ employees
It should be easier to install, perhaps through a container-based approach where everything is combined into one image or pack of containers.
CTO at Marco Technology
 

Setup Cost

Enterprise users find OpenText Static Application Security Testing's pricing high but consider it economical compared to other major solutions.
JFrog Xray provides a free trial of 14 days.
DevOps Engineer at Syvora
The basic scanning capabilities come with Artifactory, however, curation requires additional licenses.
Development Senior at a financial services firm with 5,001-10,000 employees
The pricing of Fortify Static Code Analyzer is good, with a flexible model that allows customers to choose a setup that suits their needs.
CTO at Marco Technology
My experience with the pricing, setup costs, and licensing has been good.
Lead Information Security Analyst at a financial services firm with 10,001+ employees
 

Valuable Features

JFrog Xray offers deep scanning, seamless integration with Artifactory, robust vulnerabilities management, flexible deployment, and attractive pricing.
OpenText SAST enhances security by automating vulnerability detection, integrating across tools, and providing detailed remediation and compliance guidance.
The policy-driven approach of JFrog Xray helped me maintain security standards by integrating it in the development pipeline.
DevSecOps Engineer at a tech services company with 501-1,000 employees
The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features.
Development Senior at a financial services firm with 5,001-10,000 employees
With other registries such as ECR, we can use the images only in the AWS cloud. With JFrog, we can use this registry from any cloud or work locally as well.
DevOps Engineer at Syvora
Fortify Static Code Analyzer has the capability of giving fewer false positives compared to other tools.
Lead Information Security Analyst at a financial services firm with 10,001+ employees
The most impactful feature of Fortify Static Code Analyzer in identifying vulnerabilities is the ratio of total number of vulnerabilities to false positives.
Manager at DTEK
The most valuable feature of Fortify Static Code Analyzer is its extensive language support, covering many languages from legacy ones to the newest.
CTO at Marco Technology
 

Categories and Ranking

JFrog Xray
Average Rating
7.8
Reviews Sentiment
6.3
Number of Reviews
10
Ranking in other categories
Vulnerability Management (39th), Container Security (14th), Software Composition Analysis (SCA) (5th), Software Supply Chain Security (1st)
OpenText Static Application...
Average Rating
8.2
Reviews Sentiment
6.9
Number of Reviews
19
Ranking in other categories
Static Code Analysis (4th)
 

Mindshare comparison

While both are Security Software solutions, they serve different purposes. JFrog Xray is designed for Vulnerability Management and holds a mindshare of 1.4%, down 1.5% compared to last year.
OpenText Static Application Security Testing, on the other hand, focuses on Static Code Analysis, holds 6.4% mindshare, down 11.0% since last year.
Vulnerability Management Market Share Distribution
ProductMarket Share (%)
JFrog Xray1.4%
Wiz6.6%
Tenable Nessus5.1%
Other86.9%
Vulnerability Management
Static Code Analysis Market Share Distribution
ProductMarket Share (%)
OpenText Static Application Security Testing6.4%
Veracode13.6%
Checkmarx One10.5%
Other69.5%
Static Code Analysis
 

Featured Reviews

Anand Nanwana - PeerSpot reviewer
DevOps Engineer at Syvora
Offers flexibility across clouds and easy credential management while interface improvements are needed
For JFrog Xray, the Artifactory and package repositories are valuable features. There are many benefits from JFrog Xray. For example, with other registries such as ECR, we can use the images only in the AWS cloud. With JFrog, we can use this registry from any cloud or work locally as well. JFrog can support multiple packages, such as NuGet package, pip, and other technologies. It can be used for Terraform as well. The credential management is very easy in JFrog. For instance, when using GitHub action as a CI/CD tool, I just need to create a token and set up JFrog CLI there and give access to the repository. With multiple repositories, I can generate a token for a specific repository, add that token in the GitHub secret, fetch from the CI/CD, run the command JFrog CLI, and authenticate through the token. Then we can push the images into JFrog.
DK
Lead Information Security Analyst at a financial services firm with 10,001+ employees
Focuses on detailed scans to find critical vulnerabilities while ensuring minimal false positives
I think Fortify Static Code Analyzer could be improved by updating the number of rule packs according to the latest vulnerabilities we find each year. We have updated to a version that is one less than the current latest version. It would be really helpful to include trending vulnerabilities and how to manage them. While it includes all the OWASP top factors, AI has come into the picture, so those updates should also be considered. I haven't thought much about additional features for improvement since I am using it daily. Most of our work revolves around scanning and providing the results, which sometimes feels like a crunch. However, I believe rule pack updates should be implemented. It feels easy to upgrade to the latest version as well.
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
881,707 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
25%
Manufacturing Company
12%
Computer Software Company
9%
Government
5%
Financial Services Firm
28%
Computer Software Company
11%
Manufacturing Company
9%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business1
Midsize Enterprise3
Large Enterprise6
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise3
Large Enterprise11
 

Questions from the Community

What do you like most about JFrog Xray?
JFrog Xray shows us a list of vulnerabilities that can impact our code.
What needs improvement with JFrog Xray?
I would assess the integration of JFrog Xray with CI/CD tools as the weak point. You have two means to do that: one is using the API, or the other is using the command line from JFrog. That part is...
What is your primary use case for JFrog Xray?
For JFrog Xray product, you can use it for two main goals: compliance and security. You can use it to check if your licenses are compliant, and you can check if your dependencies you want to use ar...
What do you like most about Fortify Static Code Analyzer?
Integrating the Fortify Static Code Analyzer into our software development lifecycle was straightforward. It highlights important information beyond just syntax errors. It identifies issues like pa...
What is your experience regarding pricing and costs for Fortify Static Code Analyzer?
My experience with the pricing, setup costs, and licensing has been good. We have the scan machines, and we are planning to request more from Micro Focus now. We have calls every month or every oth...
What needs improvement with Fortify Static Code Analyzer?
I think Fortify Static Code Analyzer could be improved by updating the number of rule packs according to the latest vulnerabilities we find each year. We have updated to a version that is one less ...
 

Also Known As

JFrog Security Essentials
Fortify Static Code Analysis SAST
 

Overview

 

Sample Customers

google, amazon, cisco, netflix, oracle, vmware, facebook
Information Not Available
Find out what your peers are saying about Wiz, Tenable, Qualys and others in Vulnerability Management. Updated: January 2026.
881,707 professionals have used our research since 2012.