OpenText Fortify on Demand is the SaaS-unified AppSec product. It bundles SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), and Fortify SCA (Fortify Software Composition Analysis) into one platform with shared findings management, unified policy, and Fortify Remediation Aviator as the AI augmentation surface across all three. Customers running standalone Fortify scanners on-premises modernize onto Fortify on Demand; net-new programs adopt Fortify on Demand directly as the unifying surface.
The Fortify lineage matters. OpenText renamed the Fortify products in 2024-2025 and again in the 26.3 release (July 2026), which brought the Fortify brand back as OpenText Fortify SAST, OpenText Fortify Software Composition Analysis, OpenText Fortify Remediation Aviator and OpenText Fortify on Demand. WebInspect is now OpenText Fortify DAST. The engines are mature (Fortify SAST has been in regulated production for two decades), the language coverage is broad, and the regulated-industry footprint (financial services, government, defense, healthcare) is real. Neither rename changed the scan engines. What the move changes is operational, through SaaS unification, CI/CD integration and AI augmentation.
Modernization off legacy Fortify on-prem is the most common engagement. Programs running Fortify SAST on-premises for some teams and Fortify on Demand SaaS for others typically end up with two policy stores, two suppression histories, and two sets of CI/CD integrations. Fortify on Demand unifies the operational surface in SaaS. The move is the right moment to refresh policies, redo suppression discipline, modernize CI/CD wiring and layer in Aviator, instead of running it as a license-swap exercise.
The SaaS migration is not a copy of the on-prem deployment, and treating it as one undermines the move. The on-prem Fortify model assumes manual scan triggering and post-hoc triage and the SaaS Fortify on Demand model assumes CI/CD-triggered scans, PR-time integration, and continuous triage. Programs that lift-and-shift the on-prem operating model into SaaS get on-prem-shaped operations running in SaaS. Merito's engagement redesigns the operating model rather than copying it.
Ideal use cases
- Modernizing off legacy Fortify on-prem onto SaaS-unified Fortify on Demand
- Net-new AppSec programs adopting SaaS SAST + DAST + Fortify SCA in one platform
- Fortify Remediation Aviator AI augmentation across the AppSec line
- Regulated AppSec evidence (SOC 2, FedRAMP, HIPAA, PCI DSS) under one SaaS platform
- Consolidating multiple Fortify license shapes onto one Fortify on Demand subscription