Jan 11, 2019
I think the benefit of Fortify on Demand is that it covers all the scan types: DAST, SAST. RASP, and Mobile. The research team that builds the vuln database is solid and well-staffed.
OpenText Core Application Security and SonarQube Server compete in the application security and code quality assurance markets. Each product shines in different areas, with OpenText excelling in compliance and security guidance, while SonarQube stands out in code quality inspection and integration capabilities.
Features: OpenText Core Application Security provides HIPAA compliance, correlated static and dynamic results, and central testing program management. This solution offers on-demand testing suitable for development integration. SonarQube Server supports multiple programming languages and features code quality inspection and customizable coding rules. Its extensive plugin ecosystem enhances many functionalities and integrates smoothly with CI/CD pipelines.
Room for Improvement: OpenText needs to address false positives, improve bug tracking system integration, and simplify reporting. SonarQube should enhance language support, strengthen security rule robustness, and offer better third-party tool integration. The reporting and scalability features also require refinement.
Ease of Deployment and Customer Service: OpenText provides flexible deployment options across cloud and on-premises environments, supported by good customer service, although it can improve in response time. SonarQube's similar deployment flexibility is complemented by a community edition, though it could benefit from more responsive technical support.
Pricing and ROI: OpenText's subscription model is seen as costly but justified by its advanced features, offering significant ROI through preventive savings. SonarQube is accessible with open-source and various licensing models, though some features and plugins may incur additional costs. It delivers value through improved code quality.
| Product | Market Share (%) |
|---|---|
| SonarQube Server (formerly SonarQube) | 20.8% |
| OpenText Core Application Security | 4.0% |
| Other | 75.2% |
| Company Size | Count |
|---|---|
| Small Business | 16 |
| Midsize Enterprise | 8 |
| Large Enterprise | 43 |
| Company Size | Count |
|---|---|
| Small Business | 32 |
| Midsize Enterprise | 21 |
| Large Enterprise | 75 |
OpenText Core Application Security offers robust features like static and dynamic scanning, real-time vulnerability tracking, and seamless integration with development platforms, designed to enhance code security and reduce operational costs.
OpenText Core Application Security is a cloud-based, on-demand service providing accurate and deep scanning capabilities with detailed reporting. Its integrations with development platforms ensure an enhanced security layer in the development lifecycle, benefiting users by lowering operational costs and facilitating efficient remediation. The platform addresses needs for intuitive interfaces, API support, and comprehensive vulnerability assessments, helping improve code security and accelerate time-to-market. Despite its strengths, challenges exist around false positives, report clarity, and language support, alongside confusing pricing and package options. Enhancements are sought in areas like CI/CD pipeline configuration, report visualization, scan times, and integration with third-party tools such as GitLab, container scanning, and software composition analysis.
What features define OpenText Core Application Security?Industries like mobile applications, e-commerce, and banking leverage OpenText Core Application Security for its ability to identify vulnerabilities such as SQL injections. Integrating seamlessly with DevSecOps and security auditing processes, this tool supports developers in writing safer code, ensuring secure application deployment and enhancing software assurance.
SonarQube Server enhances code quality and security via static code analysis. It detects vulnerabilities, improves standards, and reduces technical debt, integrating into CI/CD pipelines.
SonarQube Server is a comprehensive tool for enhancing code quality and security. It offers static code analysis to identify vulnerabilities, improve coding standards, and reduce technical debt. By integrating into CI/CD pipelines, it provides automated checks for adherence to best practices. Organizations use it for code inspection, security testing, and compliance, ensuring development environments with better maintainability and fewer issues.
What are the key features of SonarQube Server?Many industries implement SonarQube Server to uphold coding standards, maintain security protocols, and streamline their software development lifecycle. In sectors like finance and healthcare, adhering to regulations and ensuring reliable software is critical, making SonarQube Server invaluable. It is often integrated into CI/CD pipelines, ensuring that code changes meet set standards before deployment. This approach enhances productivity and maintains compliance with industry-specific requirements.
We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
