OpenText Core Application Security

OpenText Core Application Security is the SaaS-unified AppSec product carrying the Fortify on Demand lineage. It bundles SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), and Core SCA (Core Software Composition Analysis) into one platform with shared findings management, unified policy, and Application Security Aviator as the AI augmentation surface across all three. Customers running standalone Fortify scanners on-premises modernize onto Core Application Security; net-new programs adopt Core Application Security directly as the unifying surface.

The Fortify lineage matters. Fortify Static Code Analyzer became SAST. Fortify WebInspect became DAST. Fortify SCA became Core SCA. Fortify on Demand became Core Application Security. The engines are mature (Fortify SAST has been in regulated production for two decades), the language coverage is broad, and the regulated-industry footprint (financial services, government, defense, healthcare) is real. The 2024-2025 rebrand cycle is cosmetic at the engine level; the modernization opportunity is at the operational level (SaaS unification, CI/CD integration, AI augmentation).

Modernization off legacy Fortify on-prem is the most common engagement. Programs running Fortify Static Code Analyzer on-premises with Fortify on Demand SaaS for some teams typically end up with two policy stores, two suppression histories, and two sets of CI/CD integrations. Core Application Security unifies the operational surface in SaaS. Merito treats the move as a chance to refresh policies, redo suppression discipline, modernize CI/CD wiring, and layer Aviator AI augmentation rather than a license-swap exercise.

What breaks Core Application Security adoption is treating the SaaS migration as identical to the on-prem deployment. The on-prem Fortify model assumes manual scan triggering and post-hoc triage and the SaaS Core Application Security model assumes CI/CD-triggered scans, PR-time integration, and continuous triage. Programs that lift-and-shift the on-prem operating model into SaaS get Fortify on Demand-shaped operations rather than Core Application Security-shaped operations. Merito's engagement redesigns the operating model rather than copying it.

Merito has migrated programs off legacy Fortify on-prem onto Core Application Security and watched some teams lift-and-shift the operating model verbatim. The result is Fortify on Demand-shaped operations running in Core Application Security, which is not what the SaaS unification is for. The modernization opportunity is at the operational level: continuous CI/CD-triggered scans, PR-time gates, AI augmentation through Aviator, unified findings management across SAST + DAST + SCA. Programs that treat the move as a license swap leave most of the value on the table.

Merito recommends Core Application Security specifically when the program is consolidating off legacy Fortify on-prem, when SaaS unification across SAST + DAST + SCA pays back the migration cost, and when regulated compliance posture (SOC 2, FedRAMP, HIPAA) matters. For programs running mature Checkmarx One pipelines, replacing them with Core Application Security is a 12-month project that often does not deliver enough delta to justify the disruption. Merito runs that decision honestly.

Application Security Aviator is the AI augmentation that pays back when grounding is real. Programs licensing Aviator without piloting and without grounding configuration get generic AppSec AI that looks correct and frequently is not. Merito treats Aviator pilot validation as part of the Core Application Security implementation rather than an upsell.