GitHub CodeQL vs OpenText Fortify SAST

GitHub CodeQL9.0Visit OFOpenText Fortify SAST8.8Visit

Higher score GitHub CodeQL #3 in SAST Tools 9.0/10 Free plan Free plan✓ 5 of 5 features Visit GitHub CodeQL

vs

OF OpenText Fortify SAST #4 in SAST Tools 8.8/10 Pricing on request ✓ 5 of 5 features Visit OpenText

• GitHub CodeQL fits best

  GitHub-centric development teams

• OpenText Fortify SAST fits best

  Large enterprises needing broad analysis

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Side by side

Feature	GitHub CodeQL 9.0/10 Visit ↗	OFOpenText Fortify SAST 8.8/10 Visit ↗
At a glance
Editor score	9.0	8.8
Ranking	#3 in SAST Tools	#4 in SAST Tools
Best for	GitHub-centric development teams	Large enterprises needing broad analysis
Pricing model	Free plan + paid	Paid
Starting price	$30/user/mo	Pricing on request
Free plan	✓ (best)	Not checked yet
Free trial	—	—
Deployment	Cloud, Desktop	Cloud, Self-hosted
Platforms	Web, Windows, macOS, Linux	Web, Windows, macOS, Linux
Support	Docs	Phone, Docs
Integrations	4 integrations	12 integrations
Built for	Small business, Mid-market, Enterprise	Mid-market, Enterprise
Features GitHub CodeQL 5/5 · OpenText Fortify SAST 5/5
Pull request scans	✓	✓
IDE support	✓	✓
CI/CD integration	✓	✓
Custom security rules	✓	✓
Automated fixes	✓	✓
Specs
Analysis targets	source code	source code, bytecode, binaries
Languages supported	11	Not checked yet
Our review
Pros	Semantic queries detect vulnerabilities and coding errors. Pull-request, GitHub Actions, and external CI scanning. Custom queries and SARIF support for tailored analysis.	Analyzes source code, bytecode, and binaries across 44+ languages and 350+ frameworks Connects pull requests, IDEs, CI/CD pipelines, and issue tracking Adds IaC scanning, custom rules, dashboards, and AI remediation suggestions
Cons	Private-repository scanning requires paid GitHub Code Security. Paid pricing is based on unique active committers. The feature set is centered on source-code analysis.	Pricing requires contacting sales The breadth may exceed the needs of smaller or narrowly focused teams Deployment and governance options can require a structured security program
Our verdict	GitHub CodeQL is a semantic static-analysis engine for finding security vulnerabilities, coding errors, and other issues in source code. It represents code as data and queries that representation, giving development and security teams a… Read the review →	OpenText Fortify SAST is a static application security testing platform for development and security teams. It analyzes source code, bytecode, and binaries across web, mobile, desktop, cloud-native, API, container, and… Read the review →

Strengths and trade-offs

• GitHub CodeQL — where it wins

  • Semantic queries detect vulnerabilities and coding errors.
  • Pull-request, GitHub Actions, and external CI scanning.
  • Custom queries and SARIF support for tailored analysis.

  Where it doesn't

  • Private-repository scanning requires paid GitHub Code Security.
  • Paid pricing is based on unique active committers.
  • The feature set is centered on source-code analysis.

• OpenText Fortify SAST — where it wins

  • Analyzes source code, bytecode, and binaries across 44+ languages and 350+ frameworks
  • Connects pull requests, IDEs, CI/CD pipelines, and issue tracking
  • Adds IaC scanning, custom rules, dashboards, and AI remediation suggestions

  Where it doesn't

  • Pricing requires contacting sales
  • The breadth may exceed the needs of smaller or narrowly focused teams
  • Deployment and governance options can require a structured security program

• GitHub CodeQL9.0/10 · Free plan

  Deep SAST for GitHub workflows, with free public-repository scanning.

  Visit GitHub CodeQLFull verdict →
• OFOpenText Fortify SAST8.8/10 · Pricing on request

  Broad SAST coverage for enterprises, with sales-led pricing and extensive workflow integrations.

  Visit OpenTextFull verdict →