OpenText 首頁。
解決方案

代理式應用程式安全性

使用 Fortify Agentic Analyzer，找出規則式分析無法發現的內容

聯絡我們
電腦上的 Fortify Agentic Analyzer 儀表板畫面

概述

觀看 Fortify Agentic Analyzer 運用代理式 AI，找出複雜漏洞

Fortify 代理式分析器功能會運用 AI 代理，以資安審查人員的方式推理分析這些項目，接著與您的 OpenText™ Fortify™ SAST 掃描結果進行去重比對，並將結果納入您團隊在 Fortify Software Security Center 和 OpenText™ Fortify™ on Demand 中的工作流程。

主要優點

在不離開您現有的 Fortify 工作流程的情況下，找出規則式分析遺漏的弱點。

  • 找出規則式分析無法觸及的關鍵漏洞

    代理式分析在 10 種語言中，能捕捉 12 個真實重大 CVE 漏洞中的 10 個，其中多數的 CVSS 評分為 9.0 或更高—這些漏洞涉及邏輯與授權問題，沒有可供追蹤的污染資料路徑。

  • 在同一處管理所有發現項目

    結果會與您以規則式分析取得的 SAST 結果進行去重比對，對應至 Fortify 類別，並顯示於 Fortify Software Security Center 和 Fortify on Demand 中。 不需要第二個工具，也不需要第二個分流佇列。

  • 無需新增 SKU，即可拓展代理式能力

    Fortify Agentic Analyzer 已包含在您現有的 Fortify SAST 授權中。 自備來自任何受支援提供商的 LLM，且只需針對使用量向您的提供商付費。

商業影響

  • 邏輯與授權缺陷偵測

    有些漏洞不會留下可供追蹤的資料軌跡。 清除誤報（例如被誤認為寫死密碼的訊息字串），並找出規則式分析無法追蹤的邏輯與授權漏洞。

  • 為高風險應用程式提供更深入的涵蓋範圍

    定期在關鍵應用程式上執行代理式分析，就像安排滲透測試一樣，而 SAST 則持續作為快速、每日的第一道防線。

  • 僅限全新發現項目

    團隊往往會耗費時間，重新分流 SAST 已經發現的問題。 將 SAST 結果交由 Fortify Agentic Analyzer 處理，由其剔除重複項目，讓團隊只需審查新增的結果。

  • 單一記錄系統

    發現項目會以 Fortify 分類法呈現在 Fortify Software Security Center 和 Fortify on Demand 中，並可匯出為 SARIF，因此代理式分析結果會與您 AppSec 計畫中的其他結果一同呈現。

  • 掃描成本控管

    由您自備 LLM，因此費用由您掌控。 設定每次執行的費用上限，為各階段選擇模型與投入程度，並在關鍵應用程式上進行更深入的分析，在其他應用程式上則採取較輕量的分析。

探索解決方案的各個組成部分

產品

OpenText 將代理式分析與規則式分析整合至單一應用程式安全性計畫中。 Fortify Agentic Analyzer（隨 SAST 一併提供）可找出規則式分析無法發現的內容；Fortify SAST 提供快速且具確定性的涵蓋能力；Fortify on Demand 則以 SaaS 形式提供上述功能。

專業服務

OpenText 結合端到端解決方案實施與全面的技術服務，幫助改善系統。

Resources

  • Agentic AST is the category Gartner defines for AI-agent-driven code analysis. Rather than matching rules or tracing a data path, AI agents reason about your source code the way an expert reviewer would, following logic and intent to find vulnerabilities rules-based analysis can't reach. Fortify Agentic Analyzer applies this to your codebase to uncover flawed authorization design, business-logic weaknesses, and subtle injection and persistence patterns. It complements Fortify SAST, which runs a suite of deterministic analyzers fast enough to use on every build.

  • No. It complements SAST, it does not replace it. Fortify SAST stays your fast, broad, deterministic first line of defense on every build, covering a wide range of weakness classes. Fortify Agentic Analyzer adds a deeper, agentic pass you run selectively on higher-risk applications, the way you would schedule a penetration test. Used together, they cover ground neither reaches alone.

  • Yes. It is included under your existing Fortify SAST license at no additional charge. If an application is licensed for SAST analysis, you can analyze it with agentic analysis too, whether you connect through Fortify Software Security Center or Fortify on Demand. You bring your own LLM and pay your provider for usage: there is no separate SKU and no fixed AI surcharge from OpenText.

  • The flaws that turn on logic and intent rather than a traceable data path: broken authorization and authentication design, business-logic weaknesses, and subtle injection and persistence patterns. In a published study across 10 languages, Fortify Agentic Analyzer found 10 of 12 real-world CVEs, most rated CVSS 9.0 or higher, all disclosed after the analysis model's training cutoff, so the results reflect reasoning about the code rather than recall of a known bug.

  • You bring your own. Fortify Agentic Analyzer works with a wide set of LLM providers, connected through your own API key or a supported subscription, so you control model choice and cost. Usage is billed by your provider, not by OpenText. You can select the model and effort level for each stage of a scan to balance depth against spend.

  • They are distinct Fortify capabilities. Fortify Agentic Analyzer finds vulnerabilities rules-based analysis can't reach. Fortify Remediation Aviator triages findings and generates fixes to speed remediation. Fortify Agentic Analyzer does not require Remediation Aviator (which is an add-on). Fortify Agentic Analyzer is included with Fortify SAST.

  • Findings appear in Fortify Software Security Center and Fortify on Demand, reported in the Fortify taxonomy alongside your SAST, DAST, and SCA results, so agentic findings live in the same system of record your team already uses. Findings are deduplicated against your existing SAST results, so you review only what's net-new, and output is also available as SARIF for downstream tools.

  • Because you bring your own LLM, you control the spend. Set a per-run cost cap, choose the model and effort level for each stage, and run agentic analysis where it earns its keep: deeper on your critical applications, lighter elsewhere. There is no fixed AI surcharge from OpenText on top of your provider usage.

    Fortify Agentic Analyzer

    Watch the demo

    Fortify SAST

    Read the data sheet

    Fortify SAST

    Read the data sheet

    我們能如何幫助您？

    註腳