Item: Fortify by OpenText
Rating: 9
Author: Verified User

Overall Satisfaction with Micro Focus Fortify WebInspect

Use Cases and Deployment Scope

We use Micro Focus Fortify WebInspect for it's static analysis on our codebase of web applications. Using the reports generated for found vulnerabilities, we can work with our developers to target the high or critically ranked findings and reduce risk on our external and internally facing web apps and mobile apps.

Pros and Cons

Pros

Static code analysis
Organization of found vulnerabilities
Usually provides clear feedback on how to correct vulnerable code

Cons

Reporting could be better
Can be an involved setup if your organization is not using common build tools
Users get spammed with a lot of email updates from the service

Most Important Features

Static analysis
Vulnerability reporting
Automation

Return on Investment

A cheaper option than some other SAST tools
Automation of code scanning
Reduction of high and critical vulnerabilities

Alternatives Considered

Veracode, SonarQube and Contrast Assess

Veracode is the product I've used that is most similar to Fortify WebInspect. They both do a good job at reporting code vulnerabilities and both allow for good automation.
SonarQube can be a free tool, but does a much better job at finding bugs that aren't necessarily vulnerabilities.
Contract Assess takes a different approach for finding vulnerabilities. Instead of doing a code scan, it observes the running program to find vulnerabilities. In our experience this was harder to automate since it required developers and QA to exercise the application.

Key Insights

Do you think Fortify by OpenText delivers good value for the price?

Yes

Are you happy with Fortify by OpenText's feature set?

Yes

Did Fortify by OpenText live up to sales and marketing promises?

I wasn't involved with the selection/purchase process

Did implementation of Fortify by OpenText go as expected?

Yes

Would you buy Fortify by OpenText again?

Yes

Other Software Used

Veracode, Contrast Assess, SonarQube

Likelihood to Recommend

I think Micro Focus Fortify WebInspect could fit really any organization well that needs to perform static code analysis on their applications (they do have dynamic scanning but I don't have any experience using it). Different static analysis tools scan code differently, Micro Focus Fortify WebInspect requires you to provide a full build of the application to be submitted with debugging files which could be easy or hard depending on how your organization is building it's apps.

Comments

Please log in to join the conversation

WebInspect for static scanning