SECURITY ATLAS / EVALUATION BRIEF OpenText Fortify SAST Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/opentext-fortify/ THE ATLAS TAKE Fortify Static Code Analyzer is now presented in current OpenText materials as Fortify SAST and OpenText Static Application Security Testing. The underlying evaluation remains source-analysis coverage, integration with enterprise builds, and the ability to audit and remediate findings. Atlas analysis: it fits a program prepared to manage analysis infrastructure and specialist triage, particularly across a varied application estate. Naming updates should not be mistaken for a required product migration. Confirm the exact release and deployment, and keep static-code analysis distinct from separately scoped software-composition and dynamic testing. SCOPE Audit Workbench style review, false-positive handling, and the OpenText versus former Micro Focus contract and support path are operational boundaries. Language-list marketing does not prove the team's compiler and framework are modeled. Self-managed analysis is a reason teams still evaluate Fortify for regulated code. WORTH A LOOK WHEN Enterprise programs needing governed static analysis across complex builds and deployment constraints. THINK TWICE WHEN The expectation is that the SCA abbreviation automatically means dependency analysis or that every Fortify product is bundled. IMPLEMENTATION 1. Freeze product and release scope Record the engine, management components, hosting, and entitled adjacent analysis. 2. Integrate the actual build Verify modules, frameworks, generated code, and exclusions against production build behavior. 3. Establish finding audit Assign technical reviewers and define accepted-risk, ownership, and verified-fix records. OPERATING REALITY Build integration, analysis configuration, security-content updates, and finding audit require ownership. Atlas analysis: include a difficult enterprise application in the pilot rather than only a small demo. Preserve the analyzed revision and build context so developers can reproduce a finding and auditors can understand why it was accepted or fixed. COMMERCIAL CONSIDERATIONS Quote static analysis, management, hosting, and any adjacent products explicitly; include build-integration and audit labor. - Analysis and management entitlement - Hosted versus self-managed infrastructure - Build onboarding and finding-audit effort EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Verify analysis completeness Acceptance evidence: Retain build capture, analyzed modules, exclusions, and engine version. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Audit one data flow Acceptance evidence: Have a developer reproduce the reported source-to-sink issue and document any mitigation. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Confirm a fixed finding Acceptance evidence: Retain the code revision, application tests, repeated analysis, and audited state transition. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Does the analyzer model this team's compiler, build options, and frameworks, not just list the language name? - How are false positives reviewed and suppressed in the actual audit workflow? - What remains of former Micro Focus contracts, and who supports the product under OpenText? EVIDENCE GAPS - No independent vulnerability-detection or analysis-capacity benchmark was performed. - Exact release support and component licensing require confirmation against the deployment. SOURCES Fortify SAST product and deployment (Product information) https://www.opentext.com/products/static-application-security-testing Current product naming in OpenText release notes (Documentation) https://community.opentext.com/cybersec/fortify/w/tips/53936/what-s-new-in-opentext-scancentral-dast-26-2 OpenText application-security release overview (Product information) https://www.opentext.com/en/media/whats-new/whats-new-in-opentext-core-application-security-24-4-0-en.pdf Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.