Fortify Remediation Aviator is the AI augmentation layer for the OpenText Cybersecurity AppSec line. It is the same Aviator pattern OpenText runs across Software Delivery Aviator (test generation, defect clustering on the DevOps catalog) and Content Aviator (grounded search on the Content catalog), applied to AppSec specifically. Aviator is not a replacement for SAST, DAST, or SCA. It sits on top of those scanners and turns their findings into developer-aware triage, remediation guidance, and risk-aware reporting.
Grounding is the load-bearing technical claim. Aviator reads from the customer's actual Fortify findings, triage history, and source code rather than from a generic public-code corpus. Vendors that fine-tune AppSec AI on public code without hooking into the customer's findings store give plausible suggestions that miss internal coding conventions, mandated wrappers, and compensating-control logic. Aviator's suggestions are grounded in the actual program, which is the entire reason to layer AI on AppSec instead of buying a generic coding assistant.
Cross-product coverage is the platform claim. Aviator works on SAST findings (suggesting fixes for static-analysis flow paths), DAST findings (correlating dynamic findings with source-level fixes), Fortify SCA findings (proposing dependency upgrade paths and reachability-aware triage), and Fortify on Demand as the unifying SaaS surface. Programs running multiple OpenText AppSec scanners get AI augmentation across the whole line; programs running only one get a more limited Aviator footprint.
Aviator goes wrong when teams treat its output as autonomous. The agent proposes, and the AppSec analyst and developer decide. Programs that auto-merge AI suggestions ship regressions, while programs that treat suggestions as a high-quality first draft for human review ship faster with fewer false starts. Merito's engagement defines the supervision boundary, tunes the grounding against the customer's findings store, and pilots Aviator on a single application before broad rollout. Customer adoption of Aviator is still early and the AppSec team should validate suggestion quality on real findings before committing to enterprise scale.
Ideal use cases
- Layering AI fix suggestions on Fortify SAST and Fortify on Demand findings
- AI-assisted triage clustering across SAST, DAST, and Fortify SCA
- Risk-aware reporting grounded in the customer's own findings store
- Pilot AI-augmented AppSec on one application before enterprise rollout
- Migrating off generic coding-only AI assistants to grounded AppSec AI