OpenText Fortify Software Composition Analysis is the SaaS SCA product in the OpenText Fortify line. It scans open-source dependencies in package manifests across npm, PyPI, Maven Central, NuGet, Go modules, Cargo, Gem, Composer, RubyGems, and more, surfaces vulnerabilities and license risk across the dependency tree, and feeds findings into Fortify on Demand alongside SAST and DAST. Programs running standalone Fortify SCA on-premises modernize onto Fortify SCA in SaaS as part of the Fortify on Demand move.
License compliance is half of SCA's value. Programs that ship code with copyleft licenses (GPL, AGPL) into proprietary products create legal exposure. Fortify SCA evaluates every dependency against a configurable license policy and flags forbidden licenses before they reach production. Policy can be set per application or business unit, so internal-only tooling is held to looser rules than a customer-facing SaaS product. Fortify's license-intelligence depth is one of the historical strengths of the line.
Cross-correlation with SAST is the platform advantage. SCA findings cross-link to Fortify SAST flow paths so AppSec sees both the dependency CVE and the application-code path that calls into the vulnerable library. Aviator AI augmentation extends across SCA, SAST, and DAST findings together, proposing dependency-upgrade paths and reachability-aware triage. Programs running Fortify SCA standalone get the SCA capability; programs running it inside Fortify on Demand get the unified backlog math.
Alert fatigue can sink an SCA program. Default policies, no per-application license tuning and every CVE sent straight to the developer queue will burn out engineering and AppSec at the same time. Merito's engagement starts with license-policy tuning, suppression workflow with audit trail, and developer-time integration that surfaces findings during PR review rather than as a separate dashboard. Without that, SCA generates more noise than it removes.
Ideal use cases
- SaaS SCA on heterogeneous codebases inside Fortify on Demand
- License compliance enforcement (GPL, AGPL, copyleft policy gates)
- SCA gates on pull requests in the CI system each team already uses
- SBOM generation for SBOM-required regulated programs
- SCA consolidation off Black Duck or Sonatype Lifecycle onto OpenText