Checkmarx SAST vs OpenText Fortify SAST

Checkmarx SAST9.3Visit OFOpenText Fortify SAST8.9Visit

Higher score Checkmarx SAST #1 in Static Application Security Testing Sast 9.3/10 Pricing on request ✓ 0 of 4 features Visit Checkmarx

vs

OF OpenText Fortify SAST #3 in Static Application Security Testing Sast 8.9/10 Pricing on request ✓ 2 of 4 features Visit OpenText

• Checkmarx SAST fits best

  Enterprise teams needing broad SAST coverage

• OpenText Fortify SAST fits best

  Large development and AppSec teams

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Side by side

Feature	Checkmarx SAST 9.3/10 Visit ↗	OFOpenText Fortify SAST 8.9/10 Visit ↗
At a glance
Editor score	9.3	8.9
Ranking	#1 in Static Application Security Testing Sast	#3 in Static Application Security Testing Sast
Best for	Enterprise teams needing broad SAST coverage	Large development and AppSec teams
Pricing model	Paid	Paid
Starting price	Pricing on request	Pricing on request
Free plan	Not checked yet	Not checked yet
Free trial	—	—
Deployment	Cloud, Self-hosted	Cloud, Self-hosted
Platforms	Web, Windows, Linux	Web, Windows, macOS, Linux
Support	Docs, Tickets	Phone, Docs
Compliance	SOC 2	PCI DSS, ISO 27001
Integrations	40+ integrations	12 integrations
Built for	Enterprise, Mid-market	Mid-market, Enterprise
Features Checkmarx SAST 0/4 · OpenText Fortify SAST 2/4
IDE integration	Not checked yet	Not checked yet
CI/CD integration	Not checked yet	✓ (best)
Custom rules	Not checked yet	✓ (best)
Pull request scanning	Not checked yet	Not checked yet
Specs
Languages supported	Not checked yet	Not checked yet
Deployment	Not checked yet	Not checked yet
Our review
Pros	Analyzes source code and data flows without requiring compilation Supports custom security queries, vulnerability triage, and fix guidance Connects with major CI/CD services and IDEs, including GitHub and VS Code	Analyzes source code, bytecode, and binaries Scans pull requests and integrates with CI/CD and IDEs Adds custom rules and AI-assisted remediation
Cons	Pricing requires a custom sales quote Static analysis does not include software composition analysis Hybrid deployment and query customization may exceed smaller teams' needs	Pricing is handled through contact sales Its broad analysis scope may exceed narrower SAST needs Deployment and integrations can require coordination across toolchains
Our verdict	Checkmarx SAST analyzes application source code for security vulnerabilities, compliance issues, and business-logic flaws. It is aimed at enterprise and mid-market teams that need security analysis in development workflows, including teams… Read the review →	OpenText Fortify SAST analyzes application source code, bytecode, and binaries to identify vulnerabilities during development. It is aimed at development, application security, and DevSecOps teams, particularly in mid-market and enterprise… Read the review →

Strengths and trade-offs

• Checkmarx SAST — where it wins

  • Analyzes source code and data flows without requiring compilation
  • Supports custom security queries, vulnerability triage, and fix guidance
  • Connects with major CI/CD services and IDEs, including GitHub and VS Code

  Where it doesn't

  • Pricing requires a custom sales quote
  • Static analysis does not include software composition analysis
  • Hybrid deployment and query customization may exceed smaller teams' needs

• OpenText Fortify SAST — where it wins

  • Analyzes source code, bytecode, and binaries
  • Scans pull requests and integrates with CI/CD and IDEs
  • Adds custom rules and AI-assisted remediation

  Where it doesn't

  • Pricing is handled through contact sales
  • Its broad analysis scope may exceed narrower SAST needs
  • Deployment and integrations can require coordination across toolchains

• Checkmarx SAST9.3/10 · Pricing on request

  Broad source analysis with custom queries and remediation guidance for enterprise teams.

  Visit CheckmarxFull verdict →
• OFOpenText Fortify SAST8.9/10 · Pricing on request

  Broad SAST coverage with pull-request scans, custom rules, and AI-assisted fixes.

  Visit OpenTextFull verdict →