OpenText Dynamic Application Security Testing

Name: OpenText Dynamic Application Security Testing
Brand: OpenText
Rating: 4.6 (81 reviews)

Leader

Information Reimagined

Est 1991|Valuation $6.1B|Raised $14.3B

LinkedIn 550K|Website|Web traffic 1.1M|FTEs 19,900|HQ Waterloo, Ontario, CA

MarketsApplication Security Testing (AST)Cloud-Native Application Protection Platform (CNAPP)Web Application & API Protection (WAAP)

Platform CoversVulnerability Management Continuous Integration & Continuous Delivery (CI/CD)

OpenText Dynamic Application Security Testing screenshot

Published Oct 15, 2026

01Common complaints

You require a lightweight, low-overhead DAST for a small application portfolio: an enterprise-focused product may be more complex and costly than required.
You cannot invest resources in tuning and authentication/crawl engineering: DAST success typically requires application-specific configuration.
Your architecture is primarily serverless or event-driven with limited traditional web surface: some reviewers have reported fit limitations in such environments.
You prioritize a developer-centric UX and rapid self-serve onboarding: some user feedback highlights a less modern UI and longer onboarding compared with developer-first tools.
You need immediate, near-zero-maintenance stability on highly complex modern sites: community feedback includes reports of crawl loops and crashes in specific complex environments.
You require transparent list pricing and a short procurement cycle: pricing is typically quote-based and may require additional procurement time.

1. You require a lightweight, low-overhead DAST for a small application portfolio: an enterprise-focused product may be more complex and costly than required. 2. You cannot invest resources in tuning and authentication/crawl engineering: DAST success typically requires application-specific configuration. 3. Your architecture is primarily serverless or event-driven with limited traditional web surface: some reviewers have reported fit limitations in such environments. 4. You prioritize a developer-centric UX and rapid self-serve onboarding: some user feedback highlights a less modern UI and longer onboarding compared with developer-first tools. 5. You need immediate, near-zero-maintenance stability on highly complex modern sites: community feedback includes reports of crawl loops and crashes in specific complex environments. 6. You require transparent list pricing and a short procurement cycle: pricing is typically quote-based and may require additional procurement time.

Deal disqualifiers

Small teams without AppSec resources for tuning and operations
Environments dominated by highly dynamic single-page applications where time-to-value must be immediate and minimal tuning is required
Organizations seeking transparent list pricing and rapid, self-serve purchasing

Recurring limitations reported by users and community sources

Crawling instability and scanning errors on complex sites (for example, loops or crashes in specific contexts).
Resource intensity: high CPU, memory, and storage usage reported in some on-prem deployments.
Limitations on parallel scans depending on deployment model and licensing.
User interface and workflow maturity: some users describe the UI and experiences as dated compared with newer tools.
Mixed feedback on support resolution times across different engagements.

- Crawling instability and scanning errors on complex sites (for example, loops or crashes in specific contexts). - Resource intensity: high CPU, memory, and storage usage reported in some on-prem deployments. - Limitations on parallel scans depending on deployment model and licensing. - User interface and workflow maturity: some users describe the UI and experiences as dated compared with newer tools. - Mixed feedback on support resolution times across different engagements.

Vendor-acknowledged signals

OpenText publishes regular release notes and platform updates in official documentation portals; detailed roadmaps and timelines for specific features may not be public.

Why some customers leave / churn reasons

Drivers for switching away that appear in public feedback and community commentary include:

Operational friction: configuration and crawling complexity can increase operational burden
Support dissatisfaction in some cases
Perceived cost relative to perceived value in specific organizational contexts
Performance or scalability constraints in smaller deployments, particularly around parallel scans and resource usage

02Why they buy

Product differentiators supported by documentation and user feedback

Established presence in application security and integration into a broader Fortify/OpenText application security portfolio.
Multiple deployment models (SaaS, private cloud, on-premise) to fit enterprise hosting and data residency needs.
Pre-configured reporting templates and policy mappings for common compliance frameworks (PCI DSS, NIST, DISA STIG, ISO 27000 series, OWASP, HIPAA) to support audit evidence generation.
Broad API scanning support as documented by vendor materials (OpenAPI/Postman, GraphQL, gRPC, SOAP).

- Established presence in application security and integration into a broader Fortify/OpenText application security portfolio. - Multiple deployment models (SaaS, private cloud, on-premise) to fit enterprise hosting and data residency needs. - Pre-configured reporting templates and policy mappings for common compliance frameworks (PCI DSS, NIST, DISA STIG, ISO 27000 series, OWASP, HIPAA) to support audit evidence generation. - Broad API scanning support as documented by vendor materials (OpenAPI/Postman, GraphQL, gRPC, SOAP).

Claims that should be validated during evaluation

Reduction in false positives and accuracy claims: although some users report fewer false positives in specific environments, buyers should validate detection precision and recall on their own applications.
Performance and stability on modern single-page applications and highly dynamic sites: test on representative applications to verify crawling stability and resource usage.

Areas where competitors may have advantages

Public pricing and entry options: some competitors provide clearer entry pricing and trial options.
Developer-first workflows and simpler onboarding: some vendors emphasize ease of adoption for development teams.
Alternative scanning approaches and verification: some vendors combine scanning approaches intended to reduce manual triage.

Why customers chose it over alternatives

Common selection drivers across reviews and public materials include:

Standardization on a vendor application security portfolio within enterprise environments
Runtime coverage for traditional web applications
Integration capabilities for CI/CD workflows and governance reporting that support audit requirements

03Field reports

Review platform summary signals

Gartner Peer Insights (OpenText DAST / Fortify):

Peer review pages display aggregate ratings (for example, past snapshots showed a strong aggregate rating based on multiple reviews). Themes reported include broad coverage when used within a wider application security portfolio and potential cost reductions compared with occasional third-party penetration testing when used for continuous scanning.

TrustRadius (Fortify by OpenText):

Scores on review platforms vary, with limited review counts in some listings. Positive comments include aspects of usability in certain contexts and reports of rapid integration in some deployments; negative comments include support responsiveness delays in some cases.

PeerSpot (Fortify WebInspect / OpenText DAST):

User sentiment on some platforms reports stability in long-running deployments but also cites resource usage concerns, crawling loops, crashes, or challenges with very complex websites.

G2 (OpenText Fortify WebInspect):

Reviews are available on the platform; specific quotes and sentiments vary and should be reviewed directly by buyers for current impressions.

Gartner Peer Insights (OpenText DAST / Fortify): - Peer review pages display aggregate ratings (for example, past snapshots showed a strong aggregate rating based on multiple reviews). Themes reported include broad coverage when used within a wider application security portfolio and potential cost reductions compared with occasional third-party penetration testing when used for continuous scanning. TrustRadius (Fortify by OpenText): - Scores on review platforms vary, with limited review counts in some listings. Positive comments include aspects of usability in certain contexts and reports of rapid integration in some deployments; negative comments include support responsiveness delays in some cases. PeerSpot (Fortify WebInspect / OpenText DAST): - User sentiment on some platforms reports stability in long-running deployments but also cites resource usage concerns, crawling loops, crashes, or challenges with very complex websites. G2 (OpenText Fortify WebInspect): - Reviews are available on the platform; specific quotes and sentiments vary and should be reviewed directly by buyers for current impressions.

Direct user quotes (positive and negative)

User review excerpts reported on public review sites and community forums include both favorable and critical remarks. Examples reported by reviewers include:

Gartner Peer Insights (examples)

Favorable: A reviewer stated the product is integrated across a significant portion of their application security activities and that continuous scanning reduced reliance on occasional third-party penetration testing.
Critical (older): A reviewer described limitations with certain integration environments and noted the UI felt dated or difficult to use at times.

TrustRadius (examples)

Positive: A reviewer described the product as a strong DAST solution and highlighted scanning performance for certain application types; the reviewer also reported lower incidence of false positives in their environment.
Critical: One reviewer noted that vendor support is responsive but that resolution times can be extended in some cases.
Fit limitation: A reviewer noted the product may be less appropriate for serverless architectures.

Reddit / community (examples)

Some community comments describe frustrations with integration and support across the Fortify suite; other comments report the WebInspect experience as unstable in specific environments (for example, crashes or workflow issues).

Practitioners emphasize that tools without triage and remediation processes can be used for compliance checkboxes rather than improving security outcomes.

User review excerpts reported on public review sites and community forums include both favorable and critical remarks. Examples reported by reviewers include: Gartner Peer Insights (examples) - Favorable: A reviewer stated the product is integrated across a significant portion of their application security activities and that continuous scanning reduced reliance on occasional third-party penetration testing. - Critical (older): A reviewer described limitations with certain integration environments and noted the UI felt dated or difficult to use at times. TrustRadius (examples) - Positive: A reviewer described the product as a strong DAST solution and highlighted scanning performance for certain application types; the reviewer also reported lower incidence of false positives in their environment. - Critical: One reviewer noted that vendor support is responsive but that resolution times can be extended in some cases. - Fit limitation: A reviewer noted the product may be less appropriate for serverless architectures. Reddit / community (examples) - Some community comments describe frustrations with integration and support across the Fortify suite; other comments report the WebInspect experience as unstable in specific environments (for example, crashes or workflow issues). Practitioners emphasize that tools without triage and remediation processes can be used for compliance checkboxes rather than improving security outcomes.

Vendor-published success stories (examples)

Vendor-published materials include customer case studies and quotes, such as automation of vulnerability workflows via Azure DevOps and reductions in manual testing effort in specific deployments.

Critical evaluation:

Vendor-published case studies often lack full methodology disclosure, baseline metrics, and independent verification. Buyers should request:
- Before-and-after metrics (scan time, findings precision/recall proxies, remediation cycle time)
- Coverage measurement approaches (routes hit, authentication roles, API endpoints exercised)
- False-positive rates and tuning practices used in the case study

Vendor-published materials include customer case studies and quotes, such as automation of vulnerability workflows via Azure DevOps and reductions in manual testing effort in specific deployments. Critical evaluation: - Vendor-published case studies often lack full methodology disclosure, baseline metrics, and independent verification. Buyers should request: - Before-and-after metrics (scan time, findings precision/recall proxies, remediation cycle time) - Coverage measurement approaches (routes hit, authentication roles, API endpoints exercised) - False-positive rates and tuning practices used in the case study

Compliance reporting as an operational value

Vendor materials describe pre-configured policy templates and reporting mappings for frameworks such as PCI DSS, NIST, DISA STIG, ISO 27000, OWASP, and HIPAA. These can be useful for audit preparation, but organizations should avoid treating scans alone as sufficient for compliance and should ensure remediation and evidence-handling processes are enforced.

04Best fit

Company sizes

Recommended for mid-market to large enterprises with centralized AppSec functions and multiple application teams.
Budget profile: organizations prepared for enterprise licensing, professional services, and ongoing tuning and integration efforts.

Industries

Sectors with significant compliance and reporting requirements are a closer fit, including financial services, government/defense contracting, telecommunications, healthcare, and large B2B SaaS providers with audit requirements.

Roles/personas

Decision makers: CISOs, Heads of AppSec, DevSecOps platform owners, and security governance/compliance leads.
End users: AppSec engineers, security testers, QA automation engineers, and pipeline engineers.

Pain points addressed

Runtime vulnerability detection for web applications and APIs
Centralized reporting and audit evidence generation
Scaling scanning operations across many applications and teams with governance controls

05The pitch

What the product does (core value proposition)

Vendor messaging highlights:

DAST for runtime exploitability testing against live applications (no source required)
CI/CD automation support for DevSecOps pipelines
API scanning support (OpenAPI/Swagger, Postman, GraphQL, gRPC, SOAP)
Options for distributed scanning
Reporting templates aligned to compliance frameworks (PCI, NIST, DISA STIG, ISO, OWASP, HIPAA)

OpenText Dynamic Application Security Testing (DAST) (often referred to as Fortify WebInspect in older branding) is an automated black-box security testing product that scans running web applications, APIs, and services by simulating attacker behavior to identify exploitable vulnerabilities (for example, classes from the OWASP Top 10 such as injection, authentication issues, and sensitive data exposure). The product is offered for enterprise environments and can be operated through a user interface or automated via APIs and CI pipelines. It is commonly bundled with other OpenText/Fortify application security products (such as SAST and SCA) and central reporting/governance tools. Vendor messaging highlights: - DAST for runtime exploitability testing against live applications (no source required) - CI/CD automation support for DevSecOps pipelines - API scanning support (OpenAPI/Swagger, Postman, GraphQL, gRPC, SOAP) - Options for distributed scanning - Reporting templates aligned to compliance frameworks (PCI, NIST, DISA STIG, ISO, OWASP, HIPAA)

Target market and market positioning

Target buyers: security engineering/AppSec leaders, DevSecOps platform teams, and compliance/security governance teams in regulated environments.
Typical environment: organizations with large portfolios of internally developed web applications and APIs, CI/CD pipelines, and a need for centralized reporting and policy enforcement.
Positioning: positioned for enterprise use with integration into broader application security portfolios rather than only as a standalone scanner.

- Target buyers: security engineering/AppSec leaders, DevSecOps platform teams, and compliance/security governance teams in regulated environments. - Typical environment: organizations with large portfolios of internally developed web applications and APIs, CI/CD pipelines, and a need for centralized reporting and policy enforcement. - Positioning: positioned for enterprise use with integration into broader application security portfolios rather than only as a standalone scanner.

Get a comprehensive analysis of OpenText Dynamic Application Security Testing including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →