OpenText Application Security Aviator (Fortify)

Fortify on Demand Mobile App Security Testing is a game-changer! 5 stars all the way. Why the top rating? It's simple, it's got everything covered. From the app itself to the network and servers, this thing checks it all. Makes me feel way better about our apps not getting hacked.

Not up to the mark as expected.Accuracy of the scan is not up to the mark. The product wont work properly as expected. Performance is Average.

Not up to the mark as expected.Accuracy of the scan is not up to the mark. It has high positive rate but we cant find it. The product wont work properly as expected and the customer support wont car about it, If it stops working you need to deep dive to check what causing the issue you'll end up in scan issue or something else. They wont provide the product for the price they quoted .

An organisation's application security maturity can be measured by automation. For Fortify on Demand, we were coaxed into using their product and service based upon the apparent ease of build server integration using the Jenkins and VSTS plugins. But these plugins have failed a number of times, and getting Fortify Support to address and fix the problems is like trying to move a mountain. There are two types of failures: (1) either the product blatantly stops working or (2) it appears to be working but truthfully -- if you dig deep and know what to look for (this involves downloading scan results and analysing the fpr file), you may find that a lot of files are not being scanned at all. Unfortunately, only a very experience person with Fortify is able to identify (2), and unfortunately Fortify support makes substantial effort to make you do something else (which is very time consuming to you) rather than simply looking at the Fortify backend failures and trying to fix them. What MicroFocus doesn't seem to get is that efficiency needs to be part of a SAST delivery. We continue to struggle with MicroFocus to try to get them to give us what we paid for: if we are using their VSTS plugin, then the code needs to scan and scan in full when it gets uploaded to their backend. However, they seem to think that when their backend fails, the customer should just do something else rather than use their tools. Truthfully, it is quite likely that hundreds of scans from various customers are not working properly, yet these customers are no visibility to it. MicroFocus doesn't seem to care about this - if nobody knows their product is not working, they don't think it is their problem.