OpenText Dynamic Application Security Testing carries the Fortify WebInspect engine. WebInspect has run in regulated industries for two decades, including financial services, government, defense and healthcare. The 2024-2025 renaming did not change the engine. Programs running WebInspect transition to OpenText DAST without re-authoring scans.
Authenticated scanning is the load-bearing capability. Most applications worth testing sit behind authentication, and DAST that cannot maintain session through SSO, multi-step login, or token refresh ends up scanning the public landing page and missing the application. WebInspect handles SAML, OAuth, OIDC, multi-factor flows, custom session protocols, and the long-tail authentication shapes regulated programs ship. Programs running unauthenticated DAST are not running DAST.
Source correlation back to SAST is the platform advantage. DAST findings cross-reference back to Fortify SAST findings on the same code path, so AppSec sees both the source-level vulnerability and the runtime confirmation in one ticket. Aviator AI augmentation extends across DAST and SAST findings together, proposing fixes grounded in the customer's actual codebase. Programs running DAST as a standalone tool against a different vendor's SAST get fragmented findings; programs running OpenText DAST inside Core Application Security get unified backlog math.
Environment access decides whether DAST works. DAST needs a runnable application with realistic data, working authentication, and network reachability from the scanner. Programs that run DAST against an empty staging environment with a generic test account scan a hollow shell. Implementation therefore starts with environment readiness (test data, authentication wiring, scan-window scheduling) before the scanner touches anything real, and tunes policy to each application surface instead of running default rules across web, API and mobile as if they were the same.
Ideal use cases
- Authenticated DAST against web applications behind SSO or multi-step login
- API DAST against REST and GraphQL endpoints with token-based authentication
- Mobile DAST for native iOS and Android applications and their backends
- DAST integrated with OpenText SAST and Core SCA for cross-source-and-runtime findings
- Regulated DAST evidence for SOC 2, FedRAMP, HIPAA, and PCI DSS audits