Fortify Static Code Analyzer review
Self-hosted code analysis with custom rules, IDE feedback, and CI/CD integration.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Fortify Static Code Analyzer is OpenText’s self-hosted static application security testing product. It analyzes source code and compiled artifacts to identify security vulnerabilities, including in Java and other supported languages. Findings can be prioritized and triaged, with remediation guidance to help developers address issues. Its focus on configurable analysis and governance makes it a fit for mid-market and enterprise teams building security checks into software development; teams seeking a cloud-hosted service should distinguish it from Fortify on Demand, which is a separate product.
The analysis combines dataflow and control-flow tracing to follow vulnerable paths through code. Teams can configure analysis rules and create custom rules, which supports tailoring checks to their needs. IDE integrations provide feedback in the development environment, while CI/CD and build-pipeline integrations let organizations include analysis in development workflows. This breadth is useful when security teams want findings to inform both developer work and pipeline processes, rather than relying only on a standalone scan. The published product details describe vulnerability detection, prioritization, and remediation guidance, but do not quantify scan performance or coverage across languages.
According to the vendor’s pricing information, Fortify SCA pricing is handled through sales rather than published as public plans, so organizations need to contact OpenText about licensing. Deployment is self-hosted and the listed platforms are Windows and Linux; that makes it more suited to organizations prepared to operate it within their own environment than buyers seeking a hosted setup. Documentation is the listed support channel. Choose Fortify SCA if configurable static analysis, IDE feedback, and pipeline integration align with an established security governance program. Consider a different approach if public, plan-based pricing or cloud-hosted deployment is a requirement.
Fortify Static Code Analyzer pros and cons
- Where it wins
- Analyzes source code and compiled artifacts with dataflow and control-flow tracing
- Supports custom analysis rules, prioritization, and remediation guidance
- Connects with IDEs and CI/CD or build pipelines
- Where it doesn't
- Licensing is handled through sales rather than public pricing
- Requires a self-hosted deployment
- Listed support channel is documentation
Fortify Static Code Analyzer fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update