OpenText Static Application Security Testing
LeaderInformation Reimagined
Est 1991|Valuation $6.1B|Raised $14.3B
Information Reimagined
Published Oct 15, 2026
Public G2 reviews highlight common themes:
Reviewer quotes from third‑party sites are paraphrased here to reflect common sentiment rather than verbatim marketing language.
Capterra review excerpts reflect similar themes: ease of use for some workflows and integrations as reported by reviewers, and occasional references to false positives and perceived cost for smaller organizations.
Gartner Peer Insights entries and snippets indicate long‑term customer deployments spanning on‑premises and hosted models. Access to full Peer Insights content may be gated.
PeerSpot reviews commonly note enterprise suitability and breadth of functionality, alongside comments on cost and implementation complexity. Price references on review platforms should be treated as anecdotal and verified with vendor pricing.
Reddit and other community forums include anecdotal reports of integration challenges in CI/CD pipelines and variable experiences with vendor support responsiveness. These are anecdotal and may reflect specific organizational environments, pipeline complexity, or support tiers.
Recurring selection drivers in documentation and reviews include:
Common signals for switching vendors include:
Vendor materials include customer satisfaction and effectiveness claims. These vendor‑published claims generally lack publicly documented methodology (sample size, survey instrument, selection criteria) and should be treated as vendor‑provided evidence.
Vendor‑distributed reports provide qualitative perspectives and customer anecdotes. These documents are useful to understand vendor messaging and customer narratives but are not independent outcome studies.
Review platforms provide more operational accounts but often lack rigorous ROI metrics. Commonly reported outcomes include earlier vulnerability detection, improved governance visibility, and increased developer awareness; however, explicit ROI figures are generally absent.
Common fits include financial services, insurance, government/defense, telecom, large IT services, and healthcare where on‑premises or data residency requirements exist.
Get a comprehensive analysis of OpenText Static Application Security Testing including market position, competitive landscape, adoption trends, and peer benchmarks.
Download full report →Small organizations or startups with limited security staff and limited budgets; the platform is typically aligned with larger organizational deployments.
Teams seeking the simplest developer‑first experience: if most development is GitHub‑centric and minimal operational overhead is a priority, GitHub Advanced Security (CodeQL) or lightweight tools such as Semgrep may provide a lower‑friction alternative.
Organizations unwilling to invest in tuning, baselining, and audit workflows; without process maturity, static analysis output can generate noise that is difficult to manage.
Use cases primarily focused on open‑source dependency risk and SBOM generation; if SCA and supply‑chain security are the primary concerns, consider SCA‑focused vendors (Snyk, Mend, Sonatype, Debricked) possibly paired with a lighter SAST.
OpenText Static Application Security Testing (SAST), also known as OpenText SAST (Fortify), is a static code analysis tool intended to identify security vulnerabilities in source code, bytecode, or binaries during the software development lifecycle and within CI/CD pipelines. It is positioned for enterprise deployments and supports multiple deployment models (on‑premises, hosted/managed, and SaaS via OpenText Core Application Security).
Vendor messaging and third‑party reviews emphasize the following vendor claims and observable characteristics:
Official vendor product overview and feature pages.
Primary fit: mid‑to‑large enterprises and regulated organizations that require:
Positioning in market materials indicates it is intended as an enterprise application security testing (AST) platform rather than a lightweight, developer‑focused SAST tool. The product is commonly purchased as part of a broader application security portfolio (SAST + DAST + SCA + program management).