Fortify on Demand Reviews

Name: Fortify on Demand
Brand: OpenText
Rating: 4 (59 reviews)

4.0 out of 5

59 reviews
89% willing to recommend

4,183 followers

What is Fortify on Demand?

Fortify on Demand is a web application security testing tool that enables continuous monitoring. The solution is designed to help you with security testing, vulnerability management and tailored expertise, and is able to provide the support needed to easily create, supplement, and expand a software security assurance program without the need for additional infrastructure or resources.

Get the Fortify on Demand Buyer's Guide and find out what your peers are saying about Fortify on Demand, SonarQube, Veracode and more!

Fortify on Demand is the #9 ranked solution in application security solutions and AST tools. PeerSpot users give Fortify on Demand an average rating of 8.0 out of 10. Fortify on Demand is most commonly compared to SonarQube: Fortify on Demand vs SonarQube. Fortify on Demand is popular among the large enterprise segment, accounting for 72% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 19% of all views.

Helped 814,325 peers since 2012

Featured reviews

Jonathan Steyn

Principal Technical Consultant at EOH

Not challenges with the product itself. The product is very reliable. It does have a steep learning curve. But, again, one thing that Fortify or OpenText does very well is training. There are a lot of free resources and training in the community forums, free training as well as commercial training where users can train on how to use the back-end systems and the scanning engines and how to use command-line arguments because some of the procedures or some of the tools do require a bit of a learning curve. That's the only challenge I've really seen for customers because you have to learn how to use the tool effectively. But Fortify has, in fact, improved its user interface and the way users engage the dashboards and the interfaces. It is intuitive. It's easy to understand. But in some regards, the cybersecurity specialist or AppSec would need a bit of training to engage the user interface and to understand how it functions. But from the point of the reliability index and how powerful the tool is, there's no challenge there. But it's just from a learning perspective; users might need a bit more skill to use the tool. The user interface isn't that tedious. It's not that difficult to understand. When I initially learned how to use the interfaces, I was able to master it within a week and was able to use it quite effectively. So training is required. All skills are needed to learn how to use the tool. I would like to see more enhancements in the dashboards. Dashboards are available. They do need some configuration and settings. But I would like to see more business intelligence capabilities within the tool. It's not particularly a cybersecurity function, but, for instance, business impact analysis or other features where you can actually use business intelligence capabilities within your security tool. That would be remarkable because not only do you have a cybersecurity tool, but you also have a tool that can give you business impact analysis and some other measurements. A bit more intelligence in terms of that from a cybersecurity perspective would be remarkable.

Read full review

AhmedElkholy

Pre-Sales Manager at Ejada Company Limited

One of the most valuable features of Fortify On Demand is its ability to integrate seamlessly with the DevOps lifecycle, particularly in terms of security testing. Injecting security testing into the DevOps process ensures that security measures are incorporated from the development stage onwards. It aligns with the main objective of DevOps, which is to automate and streamline the software development lifecycle, from code commit to deployment. With automation tools orchestrating the pipeline, tasks such as code compilation, testing, and deployment can be carried out rapidly and efficiently. This results in faster time-to-market for features, reducing deployment times from hours to minutes. It enhances trust from customers and cybersecurity teams, as security measures are built into the software from the outset, increasing confidence in the security.

Read full review

Thomas Boltze

Cloud Architecture Head at PagoNxt Merchant Solutions S.L.

Whether or not this solution will be useful depends on the maturity of your organization. If you understand what all the messages and the analysis mean, and you can usefully react to it then I think you should absolutely use it. If you're still working out these things, you should probably first go through some learning process and start with some simpler tooling that gives you some insights. The challenge is always how to make things actionable and that is lacking to some extent. If, for example, there is something that depends on scans for vulnerability for all your dependencies and just pulls requests for you, Fortify doesn't action anything. It leaves all the actioning things to you so in a sense, it creates more work for the developers, but it doesn't help them to do the work. We're not happy with the solution as a process because of the way it's internally implemented in the bank. On the other hand, the features are quite good so I would rate that aspect higher. On average, I rate this solution seven out of 10.

Read full review

Fortify on Demand mindshare

Product category:

As of October 2024, the mindshare of Fortify on Demand in the Application Security Tools category stands at 5.2%, up from 4.6% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Application Security Tools

Key learnings from peers

Last updated Oct 8, 2024

Valuable Features

Fortify on Demand's valuable features include compliance with HIPAA, correlating static and dynamic results, accurate and tailored findings, manual analysis by security experts, rapid results, and support from experts. Central testing management, cloud-based on-demand use, seamless integration into development, source code exploration, vulnerability tracking, and detailed reporting are highlighted. It supports a wide variety of languages, integrates with CI/CD tools, and provides comprehensive scanning and security measures from the development stage, enhancing both speed and security.

"The source code analyzer is the most effective for identifying security vulnerabilities."
"I use the solution in my company for security code scans."
"The solution is user-friendly. One feature I find very effective is the tool's automatic scanning capability. It scans replicas of the code developers write and automatically detects any vulnerabilities. The integration with CI/CD tools is also useful for plugins."

Room for Improvement

Fortify on Demand requires improvement in various areas including reporting features, integration with incident management and CI/CD pipelines, support for more languages, and reduction of false positives. There is a need for better user interface and customization options, improved pricing clarity, and quicker scan times. Enhancing support for emerging technologies, better integration with third-party tools, streamlined setup, and increased automation would benefit users. Additionally, improved documentation and training resources are requested by multiple clients.

"The cybersecurity specialist or AppSec would need a bit of training to engage the user interface and to understand how it functions."
"The product has a lot of false positives."
"Fortify on Demand needs to improve its pricing."

ROI

Many find Fortify on Demand offers cost avoidance by reducing security issues and preventing breaches. Automation features save time and streamline processes, achieving quality security as a significant benefit. Real-time dashboards and improved security posture minimize bug densities and attack surfaces. It's found cost-effective and suitable for those with hardware requirements. Users acknowledge its value despite the challenges in precisely calculating ROI, highlighting satisfaction with security and efficiency.

Pricing

Fortify on Demand offers a flexible pricing model tailored to enterprise needs, balancing cost and features. Users appreciate its robust capabilities, though opinions on affordability vary. Many suggest starting with the trial or free version, while noting that the pricing can be expensive depending on usage. Subscription models and setup costs are generally seen as high, but scalable options and annual licenses provide value for extensive use. Firewall changes and cloud implementation may incur extra costs.

"It is not more expensive than other solutions, but the pricing is competitive."
"Fortify on Demand is more expensive than Burpsuite. I rate its pricing a nine out of ten."
"The product's cost depends on the type of license."

Popular Use Cases

Fortify on Demand is primarily used for security in the software development lifecycle, focusing on static and dynamic code analysis. Users integrate it with development processes to identify vulnerabilities in external applications before production. It's favored by banking and e-commerce sectors for comprehensive vulnerability management, ensuring code security and compliance. Fortify on Demand scans applications for issues like SQL injection and verifies network transport layer security, supporting developers in fixing vulnerabilities efficiently.

Service and Support

Customer service for Fortify on Demand is praised as excellent, with support described as knowledgeable and responsive. Some users find technical support helpful but not consistently fast. Others mention the need for improved responsiveness and clarity post-acquisition. Many receive timely responses, though some utilize online resources instead. Overall, users appreciate assistance in resolving issues, though response times and communication are occasionally inconsistent. Most find the support team professional and helpful when contacted.

Deployment

Users experienced Fortify on Demand's initial setup as mostly straightforward and intuitive, with few complexities, particularly for cloud-based deployments. Some faced challenges with on-premises installations and integration, but many praised its ease and the support provided. In more complex environments, implementation required additional time and resources, but the platform's user-friendly interface and documentation were helpful. While some experienced deployment setbacks, Fortify on Demand generally offered a manageable and simple setup process.

Scalability

Fortify on Demand is widely appreciated for its scalability, handling various volumes without major issues. Many organizations successfully integrate and use it across multiple application types, reporting no large-scale limitations. It efficiently manages code scanning needs across different enterprises, including those in banking and insurance. While some users note pricing challenges at larger volumes, its cloud-based nature facilitates easy scale adjustments, supporting a diverse user base with varying needs.

Stability

Fortify on Demand exhibits great stability according to multiple users, with many rating it highly for reliability and performance. Occasional issues like high resource usage and slow JavaScript scan times stem from memory constraints, but these are infrequent. Users appreciate consistent updates, finding it dependable for long-term use with minimal crashes. While some mention browser hiccups, most agree it remains stable with proper configuration and hardware, often rating its stability between seven and ten out of ten.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Fortify on Demand Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

19%

Manufacturing Company

14%

Computer Software Company

13%

Government

Insurance Company

Healthcare Company

Educational Organization

University

Energy/Utilities Company

Comms Service Provider

Real Estate/Law Firm

Retailer

Construction Company

Non Profit

Transportation Company

Media Company

Hospitality Company

Aerospace/Defense Firm

Pharma/Biotech Company

Wholesaler/Distributor

Logistics Company

Outsourcing Company

Legal Firm

Performing Arts

Recreational Facilities/Services Company

Consumer Goods Company

Compare Fortify on Demand with alternative products

Learn more about Fortify on Demand

Fortify on Demand Features

Fortify on Demand has many valuable key features. Some of the most useful ones include:

Deployment flexibility
Scalability
Built for DevSecOps
Ease of use
Supports 27+ languages
Real-time vulnerability identification with
Security Assistant
Actionable results in less than 1 hour for most applications with DevOps automation
Expanded coverage, accuracy and remediation details with IAST runtime agent
Continuous application monitoring of production applications
Virtual patches
Supports iOS and Android mobile applications
Security vulnerability identification
Behavioral and reputation analysis

Fortify on Demand Benefits

There are several benefits to implementing Fortify on Demand. Some of the biggest advantages the solution offers include:

Fast remediation: With Fortify on Demand you can achieve fast remediation throughout the software lifecycle with robust assessments by a team of security experts.

Easy integration: The solution’s integration ecosystem is easy to use, creating a more secure software supply chain.

Security testing: Fortify on Demand covers in-depth mobile app security testing, open-source analysis, and vendor application security management, in addition to static and dynamic testing.

Reviews from Real Users

Below are some reviews and helpful feedback written by PeerSpot users currently using the Fortify on Demand solution.

Dionisio V., Senior System Analyst at Azurian, says, "One of the top features is the source code review for vulnerabilities. When we look at source code, it's hard to see where areas may be weak in terms of security, and Fortify on Demand's source code review helps with that." He goes on to add, “Another reason I like Fortify on Demand is because our code often includes open source libraries, and it's important to know when the library is outdated or if it has any known vulnerabilities in it. This information is important to us when we're developing our solutions and Fortify on Demand informs us when it detects any vulnerable open source libraries.”

A Security Systems Analyst at a retailer mentions, “Being able to reduce risk overall is a very valuable feature for us.”

Jayashree A., Executive Manager at PepsiCo, comments, “Once we have our project created with our application pipeline connected to the test scanning, it only takes two minutes. The report explaining what needs to be modified related to security and vulnerabilities in our code is very helpful. We are able to do static and dynamic code scanning. When we are exploring some of the endpoints this solution identifies many loopholes that hackers could utilize for an attack. This has been very helpful and surprising how many vulnerabilities there can be.”

A Principal Solutions Architect at a security firm explains, “Its ability to perform different types of scans, keep everything in one place, and track the triage process in Fortify SSC stands out.”

PeerSpot user Mamta J., Co-Founder at TechScalable, states, "Almost all the features are good. This solution has simplified designing and architecting for our solutions. We were early adopters of microservices. Their documentation is good. You don't need to put in much effort in setting it up and learning stuff from scratch and start using it. The learning curve is not too much."

Fortify on Demand was previously known as Micro Focus Fortify on Demand.