Crucible vs. Fortify by OpenText

Crucible is well suited for situations where development teams follow a branch-based merge process, where new features or automation stories are introduced. It allows more seasoned team members to check newer team members' code to ensure standards are followed. It is probably less appropriate for smaller development teams or smaller projects, where code reviews can be less formal.

Incentivized

SDLC deployment is simple. simple to use The coverage is thorough and complete as a DAST product.

Incentivized

• Supports all major source control systems such as SVN and Git.
• Integration with Jira, Bamboo, Bitbucket, to have a complete end to end development experience.
• Easy to use UI/UX for reviewing code changes amongst different team members.

Incentivized

• Detection of vulnerabilities
• Scanning pipelines
• Integration is super easy
• Scanned cloud based applications

Incentivized

• Crucible notifications of changes or updates to the code review are delayed as well as loading more source code is slow.
• Crucible is formatting could use improvements for viewing customization features. For instance, allowing the user to create a new tab per file to be reviewed would be nice to have.

Incentivized

• Reporting could be better
• Can be an involved setup if your organization is not using common build tools
• Users get spammed with a lot of email updates from the service

Incentivized

Since every firm needs to perform static code analysis on their applications, I believe Micro Focus Fortify WebInspect would work well for them (they also offer dynamic scanning, although I haven't used it myself). Different static analysis tools scan code in different ways, and Micro Focus Fortify WebInspect asks you to submit a complete build of the application along with debugging files. Depending on how your company builds its apps, this requirement may be simple or challenging.

Incentivized

Good support overall being an Atlassian product, with options including free/paid official support and community provided help.

Incentivized

Always receive excellent support from the vendor. No issues there.

Incentivized

Crucible was first on the market and the price is inexpensive. Crucible integrates with Jira Software and Atlassian Fisheye, providing the ability to track defects efficiently. SonarQube compares code to 'best standards' but not 'internal standards' and does not integrate to issue tracking. GitHub offers effective peer review, and has some integration with GitHub issues but costs more.

Incentivized

Fortify Application Defender is a little more timely and upfront with a lot of their information on cyber security. we like what they provide and how they communicate with our users. I think they have a good understanding and practice in their field. they seem best suited for us and the best fit.

Incentivized

• It has had a large ROI for our team, as it has helped us find issues sooner than we would have had we not reviewed things properly.

Incentivized

• DevSecOps helped in reducing efforts
• License cost was less
• We could roll out double the count of applications with implementation of WebInspect

Incentivized