Fortify Static Code Analyzer is OpenText’s enterprise SAST solution. It detects 1,700+ categories of vulnerabilities across 33+ programming languages and covers over one million individual APIs.
Fortify is one of the longest-running commercial SAST tools on the market, with a two-decade track record in government, defense, and financial services. OpenText acquired Micro Focus (the previous Fortify owner) in 2023.
I see Fortify SCA in enterprise environments where procurement decided years ago. It supports a wide language list including COBOL and ABAP, and the rule packs cover compliance frameworks like PCI-DSS and FedRAMP. Scans are slow compared to newer tools, and the output typically goes through Fortify SSC for triage rather than straight to a developer.
What is Fortify SCA?
Fortify SCA performs deep static analysis to find security vulnerabilities in source code. It covers a broad range of languages from modern (Java, Go, Kotlin, Swift) to legacy (COBOL, ABAP, Visual Basic) and extends to infrastructure as code scanning for Terraform, Docker, Kubernetes, and serverless configurations.
The tool includes Fortify Aviator, an AI-powered feature for automated code fix suggestions.
Key features
Deployment options
Fortify is available in three deployment models:
| Deployment | Description |
|---|---|
| On-premises | Fortify SCA installed locally with full control |
| SaaS | Fortify on Demand — managed cloud service |
| Hybrid | Combination of on-premises and cloud |
Language support
Fortify supports a wide range of languages including ABAP/BSP, ActionScript, Apex, ASP.NET, C/C++, C#, Classic ASP, COBOL, ColdFusion, Go, HTML, Java (including Android), JavaScript, JSP, Kotlin, Objective-C, PHP, PL/SQL, Python, Ruby, Swift, T-SQL, VB.NET, VBScript, Visual Basic, and XML.
Note: Beyond source code, Fortify scans infrastructure as code (Terraform, CloudFormation), Docker images, Kubernetes manifests, and serverless function configurations for security misconfigurations.
Getting started
When to use Fortify
Fortify is built for enterprises that need broad language coverage, including legacy languages like COBOL and ABAP that many modern SAST tools don’t support. Its two-decade track record and deep vulnerability category coverage make it a common choice for regulated industries.
For teams that want lighter-weight or open-source SAST, Semgrep CE or SonarQube offer faster time-to-value. Fortify’s strength is comprehensive enterprise coverage.
For a head-to-head comparison, see the Checkmarx vs Fortify guide.
Note: Now under OpenText, which acquired Micro Focus in 2023. Includes Fortify Aviator AI for automated code fixes.
