OpenText Dynamic Application Security Testing

OpenText Dynamic Application Security Testing carries the Fortify WebInspect engine. WebInspect has been the regulated-industry DAST tool for two decades, with established case law in financial services, government, defense, and healthcare. The 2024-2025 rebrand is cosmetic at the engine level. Programs running WebInspect transition to OpenText DAST without re-authoring scans.

Authenticated scanning is the load-bearing capability. Most applications worth testing sit behind authentication, and DAST that cannot maintain session through SSO, multi-step login, or token refresh ends up scanning the public landing page and missing the application. WebInspect handles SAML, OAuth, OIDC, multi-factor flows, custom session protocols, and the long-tail authentication shapes regulated programs ship. Programs running unauthenticated DAST are not running DAST.

Source correlation back to SAST is the platform advantage. DAST findings cross-reference back to Fortify SAST findings on the same code path, so AppSec sees both the source-level vulnerability and the runtime confirmation in one ticket. Aviator AI augmentation extends across DAST and SAST findings together, proposing fixes grounded in the customer's actual codebase. Programs running DAST as a standalone tool against a different vendor's SAST get fragmented findings; programs running OpenText DAST inside Core Application Security get unified backlog math.

What kills DAST adoption is environment access. DAST needs a runnable application with realistic data, working authentication, and network reachability from the scanner. Programs that run DAST against an empty staging environment with a generic test account scan a hollow shell. Merito's engagement starts with environment readiness (test data, authentication wiring, scan-window scheduling) before pointing the scanner at anything real, and tunes the policy to the specific application surface rather than running default rules across web, API, and mobile as if they were the same.

Merito has audited DAST programs that ran nightly against production-shaped staging, generated thousands of findings, and missed every business-logic flaw because the scanner lost session at the SSO redirect. Authenticated scanning is the difference between testing the application and testing the public landing page. WebInspect (now OpenText DAST) handles real session protocols across the long-tail authentication shapes regulated programs ship; programs that adopt DAST without configuring authentication correctly are doing compliance theater.

Merito recommends OpenText DAST specifically when the program is consolidating onto Core Application Security or already running OpenText AppSec, when source correlation with SAST matters, and when regulated DAST evidence (FedRAMP, HIPAA, PCI DSS) is a buying criterion. For programs picking developer-led cloud DAST without the rest of OpenText, StackHawk or Bright might fit better; Merito surfaces those alternatives honestly.

API DAST is where the program math changes. The API surface is usually the actual application; the web frontend is the easy half. Programs running DAST without API scanning are scanning the visible part and missing the structural risk. Merito's engagements include OpenAPI or GraphQL schema ingestion as a default.