Fortify Static Code Analyzer Reviews

The solution has been quite stable over the years.

We've found the documentation to be very good.

When there are issues, there is a lot of explanation about what they are and how to solve problems. Communication is very clear. 

The pricing is a bit high. 

We have not enough for really sharing between with editor. Therefore, we have to use an older version of a product.

We've used the solution for 12 or so years at this point. It's been well over a decade. We've used it for quite a while.

The stability of the solution is pretty good. There are no bugs or glitches. It doesn't crash or freeze. It's pretty reliable. 

Technical support is good. When we put in requests, we get feedback and results. Older requests get treated with priority, and newer requests go into a queue. 

The pricing of the solution is a bit high. It would be nice if it was more competitive.

While we do want to continue to use the product, we want to negotiate with Microsoft about the licensing. in the meantime, we will likely evaluate a few other options.

We're just an end-user and a customer. We don't have a business relationship with Fortify.

We are not using the latest version of the solution right now. We're waiting for the Fortify version with PCI DSS 4.0.

I'd rate the solution at a six out of ten.

We use the tool for web-based applications. 

Integrating the Fortify Static Code Analyzer into our software development lifecycle was straightforward. It highlights important information beyond just syntax errors. It identifies issues like password credentials and access keys embedded in the code.

I have integrated the solution with GitLab, Jira, and ITSM. 

The product shows false positives for Python applications. 

I haven't customized many rules, but some customizations that have been applied have been particularly useful in our pipeline. For instance, if our application is found to be very vulnerable, we don't proceed with deployment. We utilize static analysis, and the pipeline is halted until the vulnerabilities are addressed. Similarly, I've applied this approach in Fortify Static Code Analyzer and Checkmark SCA to stop the execution pipeline for highly vulnerable applications.

I utilize validation in the code to manage false positives in the results. In this case, the application helps identify false positives, and I spend extra time validating them. 

I would recommend Fortify Static Code Analyzer for .NET applications and not for Python ones. I rate it an eight out of ten.