OpenText Fortify DAST has run in regulated industries for two decades, including financial services, government, defense and healthcare. The name changes along the way did not change the engine. Programs on older releases move to OpenText Fortify DAST without re-authoring scans.
Authenticated scanning is the load-bearing capability. Most applications worth testing sit behind authentication, and DAST that cannot maintain session through SSO, multi-step login, or token refresh ends up scanning the public landing page and missing the application. OpenText Fortify DAST handles SAML, OAuth, OIDC, multi-factor flows, custom session protocols, and the long-tail authentication shapes regulated programs ship. Programs running unauthenticated DAST are not running DAST.
Source correlation back to SAST is the platform advantage. DAST findings cross-reference back to Fortify SAST findings on the same code path, so AppSec sees both the source-level vulnerability and the runtime confirmation in one ticket. Aviator AI augmentation extends across DAST and SAST findings together, proposing fixes grounded in the customer's actual codebase. Programs running DAST as a standalone tool against a different vendor's SAST get fragmented findings; programs running OpenText Fortify DAST inside Fortify on Demand get unified backlog math.
Environment access decides whether DAST works. DAST needs a runnable application with realistic data, working authentication, and network reachability from the scanner. Programs that run DAST against an empty staging environment with a generic test account scan a hollow shell. Implementation therefore starts with environment readiness (test data, authentication wiring, scan-window scheduling) before the scanner touches anything real, and tunes policy to each application surface instead of running default rules across web, API and mobile as if they were the same.
Ideal use cases
- Authenticated DAST against web applications behind SSO or multi-step login
- API DAST against REST and GraphQL endpoints with token-based authentication
- Mobile DAST for native iOS and Android applications and their backends
- DAST integrated with OpenText Fortify SAST and Fortify SCA for cross-source-and-runtime findings
- Regulated DAST evidence for SOC 2, FedRAMP, HIPAA, and PCI DSS audits