Fortify by OpenText vs. SonarQube for IDE

It is best suited for runtime application security scanning and very useful for automation. You can seemlessly integrate with pipeline for dynamic scans. Cloud based apps can also be scanned for vulnerabilities, cross site scripting attacks. Basically all OWASP TOP 10. It is less appropriate to use if you have serverless architecture

Incentivized

• DAST Scanning
• API Scanning
• Less detection of false positive

Incentivized

• SonarLint highlights all the issues in our codes and also displays the severity of each issue.
• SonarLint also provides suggestions for how to fix those code issues which are highlighted.
• SonarLint starts the processing of the file as soon as it is opened and highlights all the issues which it found.
• When we fix the issue, we don't even need to create a new build or generate fresh code quality report, as soon as we save the file with the changes, it does the processing again and shows the result if the issue is fixed or not.
• SonarLint saves a lot of time and effort by saving us from doing fresh build every time and generating new code quality report every time, thus increasing the efficiency and output which is in return beneficial for the client.

Incentivized

• Reporting could be better
• Can be an involved setup if your organization is not using common build tools
• Users get spammed with a lot of email updates from the service

Incentivized

• Sometimes, SonarLint does not highlight the issues in the code correctly.
• The severity of the issues highlighted is according to the default rules set, we should also be given authority to set the severity of the issues.
• The default fixes which SonarLint provides should be more enhanced and there should be more fixes available.
• Sometimes it takes a lot of time for processing of the file when any new file is loaded or changes are saved in a file.

Incentivized

Since every firm needs to perform static code analysis on their applications, I believe Micro Focus Fortify WebInspect would work well for them (they also offer dynamic scanning, although I haven't used it myself). Different static analysis tools scan code in different ways, and Micro Focus Fortify WebInspect asks you to submit a complete build of the application along with debugging files. Depending on how your company builds its apps, this requirement may be simple or challenging.

Incentivized

It is a cloud-based platform which can provide us a very useful and unique features like Application Assessment, Scans, Vulnerability Test, Comprehensive Reporting, Monitoring, etc. Fortify by Open Text is also outstanding in various parameters for the support and integration and it is highly adaptable in various DevOps Program where you need secure app testing with all given features.

Incentivized

Always receive excellent support from the vendor. No issues there.

Incentivized

Fortify Application Defender is a little more timely and upfront with a lot of their information on cyber security. we like what they provide and how they communicate with our users. I think they have a good understanding and practice in their field. they seem best suited for us and the best fit.

Incentivized

SonarLint works along with SonarQube

Incentivized

• DevSecOps helped in reducing efforts
• License cost was less
• We could roll out double the count of applications with implementation of WebInspect

Incentivized

• SonarLint helps in achieving all the business requirements in a more efficient way.
• It reduces the manual and redundant work which we would have to do else every time if we did not use SonarLint.
• SonarLint helps in maintaining code quality, and thus also highlights the loopholes for the cyber attacks and phishing attacks.
• SonarLint makes work easy and helps the developer to invest less time in manual work thereby increasing their capacity to deliver the maximum output to the client.

Incentivized