Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

OpenText Fortify DAST review

#10 of 26 in Dynamic Application Security Testing SoftwareWeb Application Security Scanners

A compliance-oriented DAST solution with broad API coverage and enterprise automation.

8.5/10Editor score
Visit OpenText
OpenText Fortify DAST8.5 Visit OpenText

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

OpenText Fortify DAST is an automated dynamic application security testing solution for DevSecOps teams securing running web applications, APIs, and services. It simulates attacks against live environments without requiring source code or staging systems, while supporting authenticated and MFA-enabled scanning. The product fits organizations that need security testing across modern JavaScript applications, API estates, and workflow-driven applications, particularly where compliance reporting is part of the AppSec process.

Its strongest differentiator is coverage depth across application types and testing conditions. API scanning supports REST, SOAP, Swagger, OpenAPI, Postman, GraphQL, and gRPC. Browser-based rendering and advanced crawling address modern JavaScript applications, while HAR files and macros support workflow scanning. Compliance policies and reports cover PCI DSS, DISA STIG, NIST 800-53, ISO 27K, OWASP, and HIPAA, giving enterprise teams a way to align DAST activity with established requirements.

For delivery pipelines, Fortify DAST provides REST APIs, CLI, containers, and pipeline workflows, with integrations for Jenkins, Azure DevOps, GitHub Actions, GitLab, Bamboo, and CircleCI. Remote-sensor orchestration supports rapid DAST scaling, and the deployment model spans SaaS and off-cloud options. According to the vendor's pricing approach, purchasing is handled through contact sales rather than published plan tiers. Choose Fortify DAST when broad API support, compliance policies, authenticated scanning, and enterprise automation are priorities. Smaller teams seeking a simpler, openly priced DAST tool may prefer a narrower alternative.

OpenText Fortify DAST pros and cons

  • Where it wins
    • Scans authenticated applications, including MFA-enabled environments
    • Supports REST, SOAP, OpenAPI, GraphQL, gRPC, and other API formats
    • Provides compliance policies for PCI DSS, NIST 800-53, ISO 27K, and HIPAA
  • Where it doesn't
    • Pricing requires contacting sales rather than choosing a published plan
    • Enterprise features may exceed the needs of smaller AppSec teams
    • Hybrid deployment can require coordination across SaaS and off-cloud environments

OpenText Fortify DAST fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update