Fortify WebInspect Reviews

Name: Fortify WebInspect
Brand: OpenText
Rating: 3.6 (21 reviews)

Vendor: OpenText

3.6 out of 5

21 reviews
82% willing to recommend

158 followers

Start review

What is Fortify WebInspect?

Fortify WebInspect is an automated DAST solution that helps security professionals and QA testers uncover security vulnerabilities and configuration concerns by providing complete vulnerability detection. This is accomplished by mimicking real-world external security attacks on a live application in order to discover and prioritize concerns for root-cause study. Fortify WebInspect provides a number of REST APIs for easier integration, as well as the ability to be maintained via an intuitive UI or totally automated.

Get the Fortify WebInspect Buyer's Guide and find out what your peers are saying about Fortify WebInspect, GitLab, Snyk and more!

Fortify WebInspect is the #2 ranked solution in top Dynamic Application Security Testing (DAST) solutions and #8 ranked solution in top DevSecOps solutions. PeerSpot users give Fortify WebInspect an average rating of 7.2 out of 10. Fortify WebInspect is most commonly compared to GitLab: Fortify WebInspect vs GitLab. Fortify WebInspect is popular among the large enterprise segment, accounting for 70% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 17% of all views.

Helped 851,491 peers since 2012

Featured Fortify WebInspect reviews

Navin N

Global ISO 27001 Program Lead at DXC Technology

We develop software packages for clients, and these clients are mostly in the BFSI sector. The packages need to be scanned, and we engage Fortify WebInspect for this. Customers typically perform their own application pen tests, but in some cases, we have engagements where customers want us to scan…

Read full review

RaviGupta4

Services Project Lead, Information Technology at IGT Solutions

I would like WebInspect's scanning capability to be quicker. Specifically, being able to scan a particular flow or part of an application more rapidly would be beneficial. Additionally, the cost of the licensing, particularly for multiple user licenses, could be more relevant, which would improve affordability and distribution among users.

Read full review

Kibeom Kim

General Manager at Inexion Co.

The installation phase of the product is slightly complex, making it not so easy. The product does not come in packaging, so one needs to install a database, after which one can install the product by activating the license and updating it whenever required. Fortify WebInspect has many processes involved in its installation phase compared to the other products in the market. Certain Korean products can be installed with just one step. I need to support my customers with the product's installation phase. The installation process takes a day or two to complete, but for some of my customers, it takes a month since they do not have any experience or knowledge about the product. The solution is deployed on-premises.

Read full review

Fortify WebInspect mindshare

Product category:

As of May 2025, the mindshare of Fortify WebInspect in the Dynamic Application Security Testing (DAST) category stands at 22.6%, down from 31.3% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Dynamic Application Security Testing (DAST)

PeerResearch reports based on Fortify WebInspect reviews

Type	Title	Date
Category	Dynamic Application Security Testing (DAST)	May 19, 2025	Download
Product	Reviews, tips, and advice from real users	May 19, 2025	Download
Comparison	Fortify WebInspect vs HCL AppScan	May 19, 2025	Download
Comparison	Fortify WebInspect vs Invicti	May 19, 2025	Download
Comparison	Fortify WebInspect vs Rapid7 InsightAppSec	May 19, 2025	Download

Title	Rating	Mindshare	Recommending
GitLab	4.3	N/A	97%	84 interviews Add to research
Snyk	4.0	N/A	100%	45 interviews Add to research

Valuable Features

Fortify WebInspect offers valuable features like the Guided Scan option, centralized dashboard, scalability, and static analysis. Users appreciate its ease of use, accurate scans, and wide vulnerability detection. Reporting, user authentication scanning, and integration with Fortify code scanner are highlights. It's especially good for enterprise-level organizations, with tools such as HTTP editor and FPA facilitating detailed vulnerability management. Adept at scanning applications early in development and removing false positives, it aligns with top security standards.

"The transaction recorder within WebInspect is easy to use, which is valuable for our team."
"The tool provides comprehensive vulnerability assessments which help ensure our deliverables are as free from vulnerabilities as possible. It has also streamlined our web application vulnerability assessments, assisting us in delivering secure applications to our clients."
"It is easy to use, and its reporting is fairly simple."

Room for Improvement

Fortify WebInspect faces challenges with user-friendliness, scalability, and integration, particularly with cloud services like Azure. Authentication issues persist, and automation for vulnerability interpretation is lacking. It's considered expensive, especially in Korea, with its cost being a major concern. Localization, streamlined installation, and improved scanning speed are desired. Users encounter compatibility and deployment difficulties, excessive resource usage, and frequent freezes. Enhanced file extension scanning, report generation, and reduced false positives are needed improvements.

"The main area for improvement in Fortify WebInspect is the price, as it is too high compared to the market rate."
"I would like WebInspect's scanning capability to be quicker."
"There are some file extensions, like .SER, that Fortify WebInspect doesn't scan."

ROI

Fortify WebInspect significantly improved security assessment efficiency, leading to faster detection and remediation of vulnerabilities. Users reported enhanced application security, reducing potential costs associated with breaches. Cost savings from automated scans and comprehensive testing exceeded initial investment. Through its detailed analytics, companies experienced better compliance with security standards, ultimately achieving a strong return on investment.

Pricing

Fortify WebInspect pricing is often viewed as expensive, especially when compared to competitors like Acunetix. While pricing clarity can be a challenge, it's typically bundled with other Fortify solutions. Many users find it similar in cost to IBM's AppScan. Although pricing is high, some justify it due to the tool's reliability and stability. It can reach up to $50,000, making it more accessible for medium to large enterprises rather than smaller clients.

"Fortify WebInspect is a very expensive product."
"This solution is very expensive."
"The price is okay."

Popular Use Cases

Fortify WebInspect is used by teams for dynamic web application scanning, focusing on identifying vulnerabilities and enhancing security. It is deployed both on the cloud and on-premise, allowing users to scan, test, and analyze applications in various environments. QA and security teams integrate it for security assessments, code and performance testing, especially in BFSI sectors, ensuring applications are secure before release. Customers utilize it for proactive security evaluations across multiple applications.

Service and Support

Fortify WebInspect's customer service and support receive mixed feedback. Some users find technical support satisfactory, citing prompt responses and effective issue resolution. Others note delays in response times and a lack of remote assistance. Many do not interact directly, relying on internal teams. The support level varies, with some reporting it as knowledgeable and helpful, while others find less responsiveness. Despite occasional delays, remote assistance is not immediate but most issues are eventually resolved effectively.

Deployment

Many users found Fortify WebInspect's initial setup straightforward or manageable, while others described it as complex, needing significant resources and taking days or weeks to complete. It often requires skills in database handling and log maintenance. Preparation of servers or virtual machines is necessary, and installation may demand manual updates. Users noted that experience with the tool influences ease, highlighting variability in difficulty based on user expertise and specific deployment situations.

Scalability

Fortify WebInspect offers scalability for various organizations, with users ranging from 10 to over 80. It performs well with multiple servers and integrations with other products enhance its scalability. While some report challenges in scanning larger sites or multiple applications, the cloud version scales easily. Ratings on scalability vary but generally indicate strong performance, particularly in serving banks, telecoms, and SMEs. Some have faced challenges due to licensing and installation constraints.

Stability

Fortify WebInspect is generally considered stable with reports indicating reliability, though some users experience issues with scanning errors and bugs, especially in new versions. There may be performance concerns, like high CPU usage and occasional false negatives. Users suggest improvements for handling complex websites. Many find it stable and rate it highly, appreciating its capacity for vulnerability management, while others report needing manual oversight for intricate projects, rating stability between five and nine out of ten.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Fortify WebInspect Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

17%

Government

14%

Computer Software Company

13%

Manufacturing Company

12%

Healthcare Company

Insurance Company

Real Estate/Law Firm

Retailer

Educational Organization

University

Media Company

Consumer Goods Company

Comms Service Provider

Performing Arts

Energy/Utilities Company

Wholesaler/Distributor

Construction Company

Non Profit

Aerospace/Defense Firm

Hospitality Company

Transportation Company

Logistics Company

Outsourcing Company

Pharma/Biotech Company

Leisure / Travel Company

Recreational Facilities/Services Company

Engineering Company

Compare Fortify WebInspect with alternative products

Learn more about Fortify WebInspect

Fortify WebInspect may be used as a completely automated solution to suit DevOps and scaling requirements, and it integrates seamlessly with the SDLC. REST APIs aid in closer integration by automating scans and ensuring that compliance standards are satisfied. Users can make use of pre-built integrations for Micro Focus Lifecycle Management (ALM) and Quality Center, as well as other security testing and management platforms.

Teams may reuse current scripts and tools thanks to powerful connectors. Any Selenium script can be simply integrated with Fortify WebInspect. Fortify WebInspect supports Swagger and OData formats via the WISwag command line tool, allowing it to work with any DevOps workflow. A scan template can be pre-configured by ScanCentral Admin and sent to users to scan their apps, with zero security knowledge required.

Fortify WebInspect Features

Fortify WebInspect has many valuable key features. Some of the most useful ones include:

Security testing of functional applications (FAST): FAST can use all of the functional tests in the same way as IAST does, but it will continue crawling. FAST will not miss anything that a functional test misses.

Insights from a hacker's perspective: View discoveries such as client-side frameworks and version number. These are findings that, if not addressed, could lead to vulnerabilities.

Workflow macros HAR files: Fortify WebInspect can scan workflows with HAR files, ensuring that crucial content is not missed.

Management of compliance: Preconfigured policies and reports for all key online application security compliance regulations, such as PCI DSS, DISA STIG, NIST 800-53, ISO 27K, OWASP, and HIPAA.

Horizontal scaling can help you speed up your work: Using Kubernetes, horizontal scaling creates little versions of WebInspect that only process JavaScript. This allows the scans to run in parallel, resulting in significantly faster scans.

Scan any API for better accuracy: Get the complete picture on APIs, including SOAP, Rest, Swagger, OpenAPI, and Postman.
Managing the security of enterprise applications: To meet DevOps requirements, monitor trends within an application and take action on the most critical issues first.

Deployment options: With the flexibility of on-premise, SaaS, or AppSec-as-a-service, you can get started immediately and scale as needed.

Fortify WebInspect Benefits

There are many benefits to implementing Fortify WebInspect. Some of the biggest advantages the solution offers include:

Vulnerabilities are discovered faster and earlier.
Automation and agent technology can help you save time.
Users can utilize crawl web technologies and modern frameworks.
ScanCentral DAST helps you manage enterprise app security risk.

Reviews from Real Users

Fortify WebInspect stands out among its competitors for a number of reasons. One major one is its robust centralized dashboard, which gives insight into all vulnerabilities.

Milin S., an Information Security Architect at a real estate/law firm, writes of the product, “Reporting, centralized dashboard, and bird's eye view of all vulnerabilities are the most valuable features. The vulnerability management part of it is very easy. We can suppress or comment on each vulnerability and assign a vulnerability to an individual risk owner, which makes the work easy.”

Fortify WebInspect was previously known as Micro Focus WebInspect, WebInspect.