OpenText Core Application Security Reviews

All in-house developed code or a third-party developed code on our behalf is scanned via Fortify on Demand. Any results for unsecure code, vulnerabilities, or issues are passed back to the development teams for remediation.

Secure code is an important part of our day-to-day development activities. So, having code out there gives us some reasonable assurance that it is not vulnerable or open to attack. It certainly makes our overall risk posture better.

Being able to reduce risk overall is a very valuable feature for us.

They have a release coming out, which is full of new features. Based on their roadmap, there's nothing that I would suggest for them to put in it that they haven't already suggested. However, I am a customer, so I always think the pricing is something that could be improved. I am working with them on that, and they're very flexible. They work with their customers and kind of tailor the product to the customer's needs. So far, I am very happy with what they're able to provide. Their subscriptions could use a little bit of a reworking, but that would be about it.

It is a very stable product. They are constantly updating and keeping it up to date. There are no issues.

It is extremely scalable and flexible. We scan very small applications from our in-house innovations team and all the way up to millions of lines of code from our e-commerce teams. We currently have about 50 users, but the number varies. Some development teams are fairly small, and some are fairly large.

Technical support is very good. I've never had an issue that we couldn't resolve. If we have a scan running and we need it to finish sooner, they will allocate extra resources to it if we identify. We've had very good results with their tech support.

This is the first solution that was implemented. I inherited this from somebody else. We are a government organization, so we have to do an RFP next year to renew. We'll see how it goes.

The basic scanning is not very complex. When you get into more detailed scanning such as APIs, the level of complexity is moderate. However, when you are scanning that type of application, you usually have teams available that know what to do and what the configuration needs to be. We did our first scan within two days.

It was implemented in-house. We have in-house expertise. Our strategy was basically just to stand it up and use the default settings initially with a pilot. We planned to do some pilot scans and get a good feel for the product, and then adjust accordingly on an ongoing basis.

I managed it for two years single-handedly. As we expand and add more and more applications, we are adding extra hands. If we're looking at an FTE, equivalency is probably 0.5 to 0.75 people to manage it.

Looking for a return on investment on security is a little challenging. Some CIOs might argue one way or another. Some look at it as a cost, and some look at it as cost avoidance. I'm a security professional, and I look at it as cost avoidance. So, we're avoiding breaches, people being able to manipulate the code or cause any issues, and downtime. I always look at the positives of the product. If we eliminate any of the security risks or attack factors on these products before they go live, we're doing due diligence in making sure that the product stays up and running, especially for something like e-commerce.

Their subscriptions could use a little bit of a reworking, but I am very happy with what they're able to provide.

We plan to keep using this solution. Every year, we seem to have more and more code, and they add more and more features such as third-party library assessments, etc. Open source has become a big thing as companies try and save money, but with open source comes additional risk. This solution helps us mitigate the risk of those open-source components. So, we're using this more and more as we move forward.

The important part of this is automation. There are lots of automation options for this tool. Initially, trying to do it manually was a great start, but we kind of got lost a little bit along the way of implementing it. We should have done more automation right from the beginning, made it our standard, and created the policies. Sometimes, you put the cart before the horse. The tool does a great job, and you get lost in the results. It does provide good results and good information, but I think it's very important to have those policies and procedures in place right up front with this product. It will save you a lot of time in the end.

The biggest lesson that I have learned from using this product is that even if you have the best people, there are always vulnerabilities and things that will surprise you.

I would rate Micro Focus Fortify on Demand a nine out of ten.

We use this solution for our web applications. 

We have the option to scan web applications on demand. We have the option to do dynamic analysis. We also have an on-premise solution for static code analysis.

We have the option to test applications with or without credentials.

Overall, it's very good. They have very good support, but there is always room for improvement.

I've been using this solution for two to three years.

They are helpful, and we have a good relationship with them. I'd rate them an eight out of ten.

Positive

It was straightforward. It took us two or three months because we had to integrate with our DevOps and pipeline solutions. It took a bit of extra time.

In terms of maintenance, we need to update the version. Micro Focus releases new versions every two months or so.

We had our DevOps manager, and then we had two people from IT. We also had the support of the provider. We also worked with a partner to help us to implement faster.

I'd rate it an eight out of ten in terms of pricing.

Overall, I'd rate it a nine out of ten. We are very satisfied with it.

I mainly use Fortify on Demand for static scanning.

Fortify on Demand's best feature is that there's no need to install and configure it locally since it's on the cloud.

An improvement would be the ability to get vulnerabilities flowing automatically into another system.

I've been using Fortify on Demand for over a year.

Fortify on Demand's stability is fantastic - I've never seen slowness, and it performs consistently.

I previously used ShiftLeft, but Fortify on Demand gives me a portal, and it's much easier to get details about the issues affecting us.

The initial setup is very simple because no installation is necessary - you just need to access the application and configure it. 

We used a vendor team.

Fortify on Demand is moderately priced, but its pricing could be more flexible.

I would rate Fortify on Demand nine out of ten.

I am using Micro Focus Fortify on Demand for SAT analogies and data analysis.

The most valuable features of Micro Focus Fortify on Demand have been SAT analysis and application security.

Micro Focus Fortify on Demand can improve by having more graphs. For example,  to show the improvement of the level of security.

I have been using Micro Focus Fortify on Demand for approximately six months.

Micro Focus Fortify on Demand is stable.

The scalability of Micro Focus Fortify on Demand is good.

We have eight users using this solution. We plan to increase our usage in the future.

The technical support of Micro Focus Fortify on Demand is very good.

The initial setup of Micro Focus Fortify on Demand was simple. The deployment took approximately three or four days.

We have used a consultant for one deployment in the past. We have two people that do the deployment of the solution.

There are different costs for Micro Focus Fortify on Demand depending on the assessments you want to use. There is only a standard license needed to use the solution.

Micro Focus Fortify on Demand is a very easy-to-use solution. You don't need some technical staff. It's very easy to implement and use the application. I don't require assistance I only have my advisories that are users.

I rate Micro Focus Fortify on Demand a nine out of ten.

Fortify on Demand is primarily used in DevSecOps in a banking environment.

Fortify on Demand could be improved with support in Russia.

I've been working with Fortify on Demand for two years.

Fortify on Demand is stable.

Fortify on Demand can be scaled very easily.

Deployment takes between four to six months.

We use an in-house team.

Fortify on Demand is affordable, and its licensing comes with a year of support.

I would give Fortify on Demand a rating of nine out of ten.

Fortify is used for static scans — cold-scanning.

Fortify supports most languages. Other tools are limited to Java and other typical languages. IBM's solutions aren't flexible enough to support any language. Fortify also integrates with lots of tools because it has API support.

We have some stability issues, but they are minimal.

We've been using Fortify for two or three years

Fortify is stable. 

Fortify is scalable. 

Whenever we have any issues, Micro Focus support has been helpful. They have lots of products, and they're established in the market. When you open a ticket, you get an immediate response by phone.

The initial setup is straightforward and the second or third-tier support is available whenever we face an issue or something. Most of the components are plug-and-play, so it doesn't take much time. 

I rate Micro Focus Fortify on Demand. This is a good solution for doing static analysis. There is also a dynamic component, but we haven't used it because we are unsure how flexible it is. We are using it only for static scanning.

I use it for SAST, security analysis static code.

The features that I have found most valuable include its security scan, the vulnerability finds, and the web interface to search and review the issues.

In terms of what could be improved, we need more strategic analysis reports, not just for one specific application, but for the whole enterprise.

In the next release, we need more reports and more analytic views for all the  applications. There is no enterprise view in Fortify. I would like enterprise views and reports.

I am using Micro Focus Fortify on Demand for one year.

It is very stable.

It is scalable. Micro Focus Fortify on Demand requires a big hardware with a big processing capacity, but it is scalable.

Their customer support is very good. I sometimes need it, and I get the answer quickly. They are very helpful.

The initial setup is not so easy, but not so difficult. I would say it is medium difficulty.

On a scale of one to ten, I would give Micro Focus Fortify on Demand an eight.

We are using Micro Focus Fortify on Demand because in the beginning we were using the on-premise version and it was very limited. We thought we could do everything wanted with the on-premise solution. However, it was not easy to use. 

We are testing the Micro Focus Fortify on Demand solution to improve security.

We are using the on-premise version of this solution for the static code for developers. For the dynamic code, we're using Micro Focus Fortify on Demand.

There is not only one specific feature that we find valuable. The idea is to integrate the solution in DevSecOps which we were able to do. We were working with a different solution called SolarCloud previously and it was limited. We are trying to find the right level of security for our needs.

I have been using Micro Focus Fortify on Demand for approximately eight months.

The support is good. Their support is in the Netherlands, sometimes it takes some time for the time zone difference between Latin America and the Netherlands but overall the support is good.

The implementation of Micro Focus Fortify on Demand was simple, since it is on the cloud everything is automatic. They give you an account and that is all, you use the product.

The premise solution is more rentable. However, it is asking for a lot of effort in the implementation, administration, and integration in the pipeline. It takes time until the company comes to the right level to be able to manage this product. Even with the right partners in Latin America that work with us, it took some time.

We had partners in Latin America that help us integrate the implementation of the Micro Focus Fortify on Demand.

The solution is expensive and the price could be reduced.

My advice to others is if you choose Micro Focus Fortify on Demand, it's very simple to use. If they choose the on-premise version for the static code, they will need a person to manage it to be sure that it's integrated with all the pipelines that they developed. 

I rate Micro Focus Fortify on Demand a seven out of ten.