OpenText Fortify on Demand review
Broad SaaS AppSec coverage for mature enterprises, with contact-sales pricing and Java/.NET support.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
OpenText Fortify on Demand is a cloud-based application security service for development, security, and compliance teams. It brings together interactive application security testing with active runtime agents, static and dynamic testing, software composition analysis, and mobile application security testing. The service covers web applications, APIs, mobile applications, and source code through a SaaS portal and API. Its audience is primarily mature enterprises that need several AppSec testing methods and a shared workflow for vulnerability management, reporting, remediation guidance, and development coordination.
Pricing uses a contact-sales model rather than published plan tiers. That approach can suit organizations evaluating a broad AppSec program, but buyers need to engage OpenText to scope the service. The platform connects with Jenkins, Azure DevOps, GitHub Actions, GitLab CI, Bitbucket Pipelines, Fortify CLI, REST API, Slack, source control systems, and bug trackers. Authenticated dynamic testing uses login macros, while API access supports reports and automation. These integrations position Fortify on Demand for teams that want security testing connected to existing development and CI/CD workflows instead of operating as a separate review process.
The main strength is breadth: IAST sits alongside SAST, DAST, SCA, MAST, authenticated testing, reporting, remediation guidance, training, and expert review. That coverage can help enterprises coordinate web, API, mobile, and source-code assessments in one remotely delivered service. The trade-off is narrower language coverage, with Java and .NET listed for this category, and the overall scope may be more than a smaller team needs. Enterprises seeking broad AppSec management should consider it; teams prioritizing simpler adoption, transparent plan pricing, or wider language coverage should evaluate alternatives.
OpenText Fortify on Demand pros and cons
- Where it wins
- Combines IAST, SAST, DAST, SCA, and mobile testing
- Supports authenticated testing, APIs, CI/CD tools, and bug trackers
- Provides vulnerability reporting, remediation guidance, and expert review
- Where it doesn't
- Pricing requires contacting OpenText
- Language coverage is limited to Java and .NET
- Its broad scope may exceed the needs of smaller teams
OpenText Fortify on Demand fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update