OpenText 主页。
解决方案

智能体应用安全

使用 Fortify Agentic Analyzer，发现基于规则的分析无法发现的内容

联系我们
计算机上的 Fortify Agentic Analyzer 仪表板视图

概述

观看 Fortify Agentic Analyzer 如何利用智能体 AI 揭示复杂漏洞

Fortify 智能体分析器功能会利用 AI 智能体，像安全审查人员一样对这些漏洞进行推理，然后与您的 OpenText™ Fortify™ SAST 发现结果进行去重，并将结果纳入团队在 Fortify Software Security Center 和 OpenText™ Fortify™ on Demand 中的工作流。

主要优势

无需离开您当前使用的 Fortify 工作流，即可发现基于规则的分析所遗漏的漏洞。

  • 发现基于规则的分析无法检测到的关键漏洞

    智能体分析可跨 10 种语言捕获 12 个真实严重 CVE 中的 10 个，其中大多数被评为 CVSS 9.0 或更高级别——这些逻辑和授权漏洞不存在可追踪的受污染数据路径。

  • 在一个位置管理所有发现结果

    调查结果会与您基于规则的 SAST 结果进行去重，映射到 Fortify 类别，并显示在 Fortify Software Security Center 和 Fortify on Demand 中。无需第二种工具，也无需第二个分诊队列。

  • 无需新增 SKU，深化智能体能力

    Fortify Agentic Analyzer 已包含在您现有的 Fortify SAST 许可证中。您可以接入任何受支持提供商的 LLM，使用费用仅需支付给该提供商。

商业影响

  • 逻辑和授权缺陷检测

    有些漏洞没有可供追踪的数据痕迹。清除误报，例如将消息字符串误认为硬编码密码的情况，并揭示基于规则的分析无法追踪的逻辑和授权漏洞。

  • 为高风险应用提供更深层次的覆盖

    定期对您的关键应用运行智能体分析，就像安排渗透测试一样，同时让 SAST 继续作为您快速、日常的第一道防线。

  • 仅限全新发现结果

    团队浪费时间重新分诊 SAST 已经发现的问题。将您的 SAST 结果传入 Fortify Agentic Analyzer，它会剔除重复项，让您的团队只审核新增内容。

  • 单一权威记录系统

    调查结果会以 Fortify 分类体系呈现在 Fortify Software Security Center 和 Fortify on Demand 中，并可导出为 SARIF，因此智能体分析结果可与 AppSec 计划的其余内容并存。

  • 扫描成本控制

    您使用自己的 LLM，因此可以掌控成本。 设置每次运行的费用上限，为每个阶段选择模型和分析力度，并在关键应用上进行更深入的分析，在其他应用上则采用较轻量的分析

探索解决方案的组成部分

产品

OpenText 将智能体分析与基于规则的分析整合到一个应用程序安全计划中。 Fortify Agentic Analyzer（随 SAST 一同提供）可发现基于规则的分析无法发现的内容；Fortify SAST 提供快速、确定性的覆盖；Fortify on Demand 则以 SaaS 形式交付。

专业服务

OpenText 将端到端解决方案的实施与全面的技术服务相结合，以帮助改进系统。

Resources

  • Agentic AST is the category Gartner defines for AI-agent-driven code analysis. Rather than matching rules or tracing a data path, AI agents reason about your source code the way an expert reviewer would, following logic and intent to find vulnerabilities rules-based analysis can't reach. Fortify Agentic Analyzer applies this to your codebase to uncover flawed authorization design, business-logic weaknesses, and subtle injection and persistence patterns. It complements Fortify SAST, which runs a suite of deterministic analyzers fast enough to use on every build.

  • No. It complements SAST, it does not replace it. Fortify SAST stays your fast, broad, deterministic first line of defense on every build, covering a wide range of weakness classes. Fortify Agentic Analyzer adds a deeper, agentic pass you run selectively on higher-risk applications, the way you would schedule a penetration test. Used together, they cover ground neither reaches alone.

  • Yes. It is included under your existing Fortify SAST license at no additional charge. If an application is licensed for SAST analysis, you can analyze it with agentic analysis too, whether you connect through Fortify Software Security Center or Fortify on Demand. You bring your own LLM and pay your provider for usage: there is no separate SKU and no fixed AI surcharge from OpenText.

  • The flaws that turn on logic and intent rather than a traceable data path: broken authorization and authentication design, business-logic weaknesses, and subtle injection and persistence patterns. In a published study across 10 languages, Fortify Agentic Analyzer found 10 of 12 real-world CVEs, most rated CVSS 9.0 or higher, all disclosed after the analysis model's training cutoff, so the results reflect reasoning about the code rather than recall of a known bug.

  • You bring your own. Fortify Agentic Analyzer works with a wide set of LLM providers, connected through your own API key or a supported subscription, so you control model choice and cost. Usage is billed by your provider, not by OpenText. You can select the model and effort level for each stage of a scan to balance depth against spend.

  • They are distinct Fortify capabilities. Fortify Agentic Analyzer finds vulnerabilities rules-based analysis can't reach. Fortify Remediation Aviator triages findings and generates fixes to speed remediation. Fortify Agentic Analyzer does not require Remediation Aviator (which is an add-on). Fortify Agentic Analyzer is included with Fortify SAST.

  • Findings appear in Fortify Software Security Center and Fortify on Demand, reported in the Fortify taxonomy alongside your SAST, DAST, and SCA results, so agentic findings live in the same system of record your team already uses. Findings are deduplicated against your existing SAST results, so you review only what's net-new, and output is also available as SARIF for downstream tools.

  • Because you bring your own LLM, you control the spend. Set a per-run cost cap, choose the model and effort level for each stage, and run agentic analysis where it earns its keep: deeper on your critical applications, lighter elsewhere. There is no fixed AI surcharge from OpenText on top of your provider usage.

    Fortify Agentic Analyzer

    Watch the demo

    Fortify SAST

    Read the data sheet

    Fortify SAST

    Read the data sheet

    我们能提供什么帮助？

    脚注