OpenText home page.
Solutions

Agentic application security

Find what rules-based analysis can’t with Fortify Agentic Analyzer

Contact us
Dashboard view of Fortify Agentic Analyzer on a computer

Overview

Watch Fortify Agentic Analyzer use agentic AI to uncover complex vulnerabilities

The Fortify Agentic Analyzer feature uses AI agents to reason through them the way a security reviewer would, then deduplicates against your OpenText™ Fortify™ SAST findings and lands the results inside your team’s workflow in Fortify Software Security Center and OpenText™ Fortify™ on Demand.

Key benefits

Catch vulnerabilities rules-based analysis misses, without leaving the Fortify workflow you already run.

  • Find the critical flaws rules-based analysis can’t reach

    Agentic analysis catches 10 of 12 real critical CVEs across 10 languages, most rated CVSS 9.0 or higher—the logic and authorization bugs where there is no tainted data path to trace.

  • Manage all your findings in one place

    Findings are deduplicated against your rules-based SAST results, mapped to Fortify categories, and shown in Fortify Software Security Center and Fortify on Demand. No second tool, no second triage queue is required.

  • Add agentic depth with no new SKU

    Fortify Agentic Analyzer is included under your existing Fortify SAST license. Bring your own LLM from any supported provider and pay only your provider for usage.

Business impacts

  • Logic and authorization flaw detection

    Some flaws leave no data trail to follow. Clear false positives, like a message string mistaken for a hard-coded password, and surface the logic and authorization flaws rules-based analysis can't trace.

  • Deeper coverage for high-risk apps

    Run agentic analysis periodically on your critical apps, the way you would schedule a penetration test, while SAST stays your fast, daily first line of defense.

  • Net-new findings only

    Teams lose time re-triaging issues SAST already found. Pass your SAST results in and Fortify Agentic Analyzer drops them, so your team reviews only what's net-new.

  • One system of record

    Findings land in Fortify Software Security Center and Fortify on Demand in the Fortify taxonomy and export as SARIF, so agentic results live alongside the rest of your AppSec program.

  • Scan cost control

    You bring your own LLM, so you control the spend. Set a per-run cost cap, choose the model and effort for each stage, and run deeper on critical apps, lighter elsewhere.

Explore the components of the solution

Products

OpenText brings agentic and rules-based analysis together in one application security program. Fortify Agentic Analyzer (included with SAST) finds what rules-based analysis can’t; Fortify SAST provides fast, deterministic coverage; and Fortify on Demand delivers it as SaaS.

Professional Services

OpenText combines end-to-end solution implementation with comprehensive technology services to help improve systems.

Resources

  • Agentic AST is the category Gartner defines for AI-agent-driven code analysis. Rather than matching rules or tracing a data path, AI agents reason about your source code the way an expert reviewer would, following logic and intent to find vulnerabilities rules-based analysis can't reach. Fortify Agentic Analyzer applies this to your codebase to uncover flawed authorization design, business-logic weaknesses, and subtle injection and persistence patterns. It complements Fortify SAST, which runs a suite of deterministic analyzers fast enough to use on every build.

  • No. It complements SAST, it does not replace it. Fortify SAST stays your fast, broad, deterministic first line of defense on every build, covering a wide range of weakness classes. Fortify Agentic Analyzer adds a deeper, agentic pass you run selectively on higher-risk applications, the way you would schedule a penetration test. Used together, they cover ground neither reaches alone.

  • Yes. It is included under your existing Fortify SAST license at no additional charge. If an application is licensed for SAST analysis, you can analyze it with agentic analysis too, whether you connect through Fortify Software Security Center or Fortify on Demand. You bring your own LLM and pay your provider for usage: there is no separate SKU and no fixed AI surcharge from OpenText.

  • The flaws that turn on logic and intent rather than a traceable data path: broken authorization and authentication design, business-logic weaknesses, and subtle injection and persistence patterns. In a published study across 10 languages, Fortify Agentic Analyzer found 10 of 12 real-world CVEs, most rated CVSS 9.0 or higher, all disclosed after the analysis model's training cutoff, so the results reflect reasoning about the code rather than recall of a known bug.

  • You bring your own. Fortify Agentic Analyzer works with a wide set of LLM providers, connected through your own API key or a supported subscription, so you control model choice and cost. Usage is billed by your provider, not by OpenText. You can select the model and effort level for each stage of a scan to balance depth against spend.

  • They are distinct Fortify capabilities. Fortify Agentic Analyzer finds vulnerabilities rules-based analysis can't reach. Fortify Remediation Aviator triages findings and generates fixes to speed remediation. Fortify Agentic Analyzer does not require Remediation Aviator (which is an add-on). Fortify Agentic Analyzer is included with Fortify SAST.

  • Findings appear in Fortify Software Security Center and Fortify on Demand, reported in the Fortify taxonomy alongside your SAST, DAST, and SCA results, so agentic findings live in the same system of record your team already uses. Findings are deduplicated against your existing SAST results, so you review only what's net-new, and output is also available as SARIF for downstream tools.

  • Because you bring your own LLM, you control the spend. Set a per-run cost cap, choose the model and effort level for each stage, and run agentic analysis where it earns its keep: deeper on your critical applications, lighter elsewhere. There is no fixed AI surcharge from OpenText on top of your provider usage.

    Fortify Agentic Analyzer

    Watch the demo

    Fortify SAST

    Read the data sheet

    Fortify SAST

    Read the data sheet

    How can we help?

    Footnotes