Findbugs vs. Fortify by OpenText

Findbugs is best suited even when you want to adapt to certain coding conventions and discover possible bugs beforehand and it's best suited for the java open source. whether you are a developer or a DevOps engineer you can even use it as a plugin in your Jenkins pipeline or any other build automation server and your developer tool such as visual studio as well.

Incentivized

SDLC deployment is simple. simple to use The coverage is thorough and complete as a DAST product.

Incentivized

• Scan the code for existing bugs present
• It can detect an vulnerabilities and also show possible bad warnings
• Can help identify errors in advance to avoid code crash post deployment

Incentivized

• Detection of vulnerabilities
• Scanning pipelines
• Integration is super easy
• Scanned cloud based applications

Incentivized

• It’s documentation is not always up to date
• Difficulty in finding a prper solution when an issue arises during its configuration
• has limited features

Incentivized

• Reporting could be better
• Can be an involved setup if your organization is not using common build tools
• Users get spammed with a lot of email updates from the service

Incentivized

Since every firm needs to perform static code analysis on their applications, I believe Micro Focus Fortify WebInspect would work well for them (they also offer dynamic scanning, although I haven't used it myself). Different static analysis tools scan code in different ways, and Micro Focus Fortify WebInspect asks you to submit a complete build of the application along with debugging files. Depending on how your company builds its apps, this requirement may be simple or challenging.

Incentivized

Always receive excellent support from the vendor. No issues there.

Incentivized

Sonar cloud has its own cloud where all the code vulnerabilities are collected and stored as a whole whereas its a plugin that is used in a code itself but the cons is that SonarCloud needs a license if you want to use it privately and also requires personal access token authentication if used with an external service

Incentivized

Fortify Application Defender is a little more timely and upfront with a lot of their information on cyber security. we like what they provide and how they communicate with our users. I think they have a good understanding and practice in their field. they seem best suited for us and the best fit.

Incentivized

• Its being used overall by most of the teams
• Some of the teams migrating to another testing tool as it has limited features
• Still recommend as its open source and beginners friendly

Incentivized

• DevSecOps helped in reducing efforts
• License cost was less
• We could roll out double the count of applications with implementation of WebInspect

Incentivized