Contrast Security Assess vs OpenText Core Application Security comparison

Contrast Security Assess vs. OpenText Core Application Security

September 2026

Download the complete report

Helped 917,433 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

ROI

Sentiment score

6.8

Contrast Security Assess improves code quality, reduces costs, and streamlines workflows by detecting vulnerabilities early, enhancing efficiency.

Sentiment score

3.7

OpenText Core Application Security automates scans, enhances security, reduces costs, and is essential for minimizing risks and data leaks.

Contrast has probably saved us a couple hundred hours over the past six years.

Threat & Vulnerability Management Senior Analyst at a tech vendor with 10,001+ employees

The speed of fixing issues is significantly improved due to the vast amount of information provided by Contrast Security Assess, making it quite essential for finding the root cause of problems in the source code.

For more quotes and insights, download the Contrast Security Assess report

Management Of Quality Managers at a tech vendor with 1,001-5,000 employees

There is definitive ROI if OpenText Core Application Security is deployed properly; it substantially reduces efforts in securing the solution while averting various application-related risks.

For more quotes and insights, download the OpenText Core Application Security report

Co-Founder at Insecsys Technologies Private Limited

Customer Service

Sentiment score

8.4

Contrast Security Assess support is responsive and knowledgeable, with efficient issue resolution and high user satisfaction despite customization challenges.

Sentiment score

7.0

Customer service is praised for responsiveness, but technical support experiences vary, with both effective assistance and unresolved issues.

They go out of their way to respond quickly and very knowledgeably.

Threat & Vulnerability Management Senior Analyst at a tech vendor with 10,001+ employees

Customer support is one of the strongest points of Contrast Security Assess, as they are really responsive and answer tickets in less than one hour.

For more quotes and insights, download the Contrast Security Assess report

Management Of Quality Managers at a tech vendor with 1,001-5,000 employees

Support tickets often stay open for one month to three months, which leads to customer frustration.

Diego Caicedo Lescano

Chief Innovation Officer at SAGGA

I had direct interaction with them, which facilitated how we onboarded Fortify.

Lead Cybersecurity at TBO

The technical support from OpenText is very good.

For more quotes and insights, download the OpenText Core Application Security report

Co-Founder at Insecsys Technologies Private Limited

Scalability Issues

Sentiment score

8.0

Contrast Security Assess offers scalability across platforms but faces challenges with change management and limited technology support.

Sentiment score

7.2

OpenText Core Application Security scales effectively in the cloud but faces pricing and scan-related challenges across industries.

It is fairly simple to install the agents for Contrast Security Assess and keep them updated.

Threat & Vulnerability Management Senior Analyst at a tech vendor with 10,001+ employees

Contrast Security Assess's scalability is not an issue at all.

For more quotes and insights, download the Contrast Security Assess report

Management Of Quality Managers at a tech vendor with 1,001-5,000 employees

If a customer wants to know the tools and the technology used for their application to scan their application, they provide less information on that.

Lead Cybersecurity at TBO

OpenText Core Application Security is highly scalable; it is running on the cloud, and elasticity is one of the best points of a cloud environment.

Wagner Azevedo

Cloud Security Manager at T-Systems International GmbH

Fortify is superior to many solutions because of its scalability and that it does not require massive compute capabilities for its SAST and sandboxing features.

For more quotes and insights, download the OpenText Core Application Security report

Co-Founder at Insecsys Technologies Private Limited

Stability Issues

Sentiment score

7.9

Contrast Security Assess is highly stable and reliable, with occasional environment-related issues and limited ColdFusion support.

Sentiment score

8.7

OpenText Core Application Security is reliable with minor resource concerns, consistent updates, and occasional JavaScript-related performance issues.

We opened a ticket to customer support and experienced four weeks of disruption due to the extension malfunctioning in some of the .NET servers running Contrast Security Assess.

For more quotes and insights, download the Contrast Security Assess report

Management Of Quality Managers at a tech vendor with 1,001-5,000 employees

OpenText Core Application Security is stable and has minimal downtime, benefitting from AWS cloud availability.

For more quotes and insights, download the OpenText Core Application Security report

Co-Founder at Insecsys Technologies Private Limited

Room For Improvement

Contrast Security Assess offers effective automation but requires better documentation, integration, reporting, support, pricing flexibility, and AI enhancements.

OpenText Core Application Security faces efficiency, integration, and usability challenges, prompting calls for improvements in AI, interfaces, and pricing.

Regarding Contrast Security Assess's AI capabilities, I think they are missing a huge opportunity because they could lead the way in automatic testing and AI security testing.

Management Of Quality Managers at a tech vendor with 1,001-5,000 employees

Contrast support has been great in fixing any issues or getting back to us with questions.

For more quotes and insights, download the Contrast Security Assess report

Threat & Vulnerability Management Senior Analyst at a tech vendor with 10,001+ employees

Contrast Security Assess can be improved as it checks the code and asks to fix the code that is vulnerable, and in that way, we can prevent potential hacking or attempts for people to inject malicious code.

reviewer2882520

Postdoctoral Research Fellow at a program development consultancy with 1-10 employees

It would be beneficial if Fortify could check for CVEs (Common Vulnerabilities and Exposures) in third-party libraries, which I currently use a separate dependency checker tool for.

reviewer2646048

Lead Developer at a legal firm with 1,001-5,000 employees

One thing I would highlight is if Fortify can focus more on the centralized dashboard of the tools because nowadays, tools such as SentinelOne also exist for identifying security issues, but they have a centralized dashboard that merges their cloud solution and application security side solution together.

Lead Cybersecurity at TBO

I would say OpenText Core Application Security is not very user-friendly in terms of price; it is quite high.

For more quotes and insights, download the OpenText Core Application Security report

Co-Founder at Insecsys Technologies Private Limited

Setup Cost

Contrast Security Assess offers scalable pricing based on application size and environment, ranging from $20,000 to $100,000 annually.

OpenText Core Application Security is considered costly, but features and integration often justify the price for users.

Licensing costs are fairly high compared to other DAST and SAST tools, but it seems to be worth the money.

For more quotes and insights, download the Contrast Security Assess report

Threat & Vulnerability Management Senior Analyst at a tech vendor with 10,001+ employees

No quotes available

For more quotes and insights, download the OpenText Core Application Security report

Valuable Features

Contrast Security Assess offers real-time vulnerability detection with minimal false positives, enhancing security through CI/CD integration and proactive measures.

OpenText Core Application Security is valued for vulnerability detection, DevOps integration, comprehensive scanning, customization, and enterprise scalability.

The ability to see what is going on and what has been going on in a given application and basically get to see what is coming across it in real time is helpful in finding vulnerabilities to remediate before production deployments.

Threat & Vulnerability Management Senior Analyst at a tech vendor with 10,001+ employees

Instead of fixing each vulnerability reported independently, you can group them and fix them in a single point in the source code, resolving several vulnerabilities at once.

For more quotes and insights, download the Contrast Security Assess report

Management Of Quality Managers at a tech vendor with 1,001-5,000 employees

Contrast Security Assess has positively impacted my organization by improving the security features of our application.

reviewer2882520

Postdoctoral Research Fellow at a program development consultancy with 1-10 employees

Fortify helps me find serious issues, such as developers inadvertently leaving access tokens, including API access tokens, in the source code.

reviewer2646048

Lead Developer at a legal firm with 1,001-5,000 employees

On demand you have two levels of reports: the first from the tool, which is the same as we can get from Fortify on-premises, and a next level reporting made by experts from OpenText, leading to a more condensed and precise report as level three.

Diego Caicedo Lescano

Chief Innovation Officer at SAGGA

Additionally, you can integrate Fortify in CICD pipeline, so you get real-time updates about the security issues in your pipeline.

For more quotes and insights, download the OpenText Core Application Security report

Lead Cybersecurity at TBO

Categories and Ranking

Contrast Security Assess

Ranking in Application Security Tools

25th

Ranking in Static Application Security Testing (SAST)

12th

Average Rating

8.4

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

No ranking in other categories

OpenText Core Application S...

Ranking in Application Security Tools

11th

Ranking in Static Application Security Testing (SAST)

9th

Average Rating

8.0

Reviews Sentiment

7.0

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of October 2026, in the Application Security Tools category, the mindshare of Contrast Security Assess is 1.7%, up from 0.8% compared to the previous year. The mindshare of OpenText Core Application Security is 3.4%, down from 3.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools Mindshare Distribution
Product	Mindshare (%)
OpenText Core Application Security	3.4%
Contrast Security Assess	1.7%
Other	94.9%

Application Security Tools

Featured Reviews

Real-time assessments have improved remediation speed and reduced time spent on authentication issues

Threat & Vulnerability Management Senior Analyst at a tech vendor with 10,001+ employees

I do find that here and there with Contrast Security Assess there are user interface issues, particularly with how they work with libraries. The way that it works is people have access to library data for all applications, not just the applications that they should have access to. However, they are trying to fix that. The way the libraries are handled with Contrast Security Assess could use some work. I know that there is an additional service tier that allows for more in-depth library data. These are small things. Contrast support has been great in fixing any issues or getting back to us with questions. They seem to really be dedicated to the product.

Read full review

Supports secure development pipelines and improves issue detection but limits internal visibility and needs broader dashboard integration

Lead Cybersecurity at TBO

If you have an internal team and you want your internal team to validate false positives, basically to determine whether it's a valid issue or an invalid issue, then I wouldn't recommend it much. That was the only reason we migrated from Fortify on Demand to another solution. Fortify has another tool which is Fortify WebInspect. On Demand is the outsourcing solution, and WebInspect you can use with your in-house team, which is basically the product developed by the Fortify team. For automated scanning, Fortify helps a lot. Regarding the visibility for the internal team, everyone is moving toward the DevSecOps side, and Fortify team has made good progress that you can integrate into your CICD pipeline. One thing I would highlight is if Fortify can focus more on the centralized dashboard of the tools because nowadays, tools such as SentinelOne also exist for identifying security issues, but they have a centralized dashboard that merges their cloud solution and application security side solution together. If you have one tool that works for different solutions, it helps a lot. They are doing good, but they should invest more on the AI side as well because AI security is evolving these days. On the cloud side, they have already made good progress, but I believe they should explore the new area related to AI security as well.

Read full review

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

917,433 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

13%

Manufacturing Company

13%

Comms Service Provider

12%

Healthcare Company

Financial Services Firm

12%

Outsourcing Company

12%

Manufacturing Company

Construction Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	3
Midsize Enterprise	3
Large Enterprise	11

By reviewers
Company Size	Count
Small Business	18
Midsize Enterprise	8
Large Enterprise	46

Questions from the Community

What is your experience regarding pricing and costs for Contrast Security Assess?

I was not involved in the negotiation of pricing for Contrast Security Assess, but I am somewhat familiar with setup cost and licensing. Licensing costs are fairly high compared to other DAST and S...

What needs improvement with Contrast Security Assess?

I don't use Contrast Security Assess anymore, so I cannot comment on how it can be improved; I stopped using it four years ago, but at the time, I think the UI could be improved to be more friendly...

What advice do you have for others considering Contrast Security Assess?

I don't remember specific metrics regarding the outcomes we saw, but I can tell that the false positive rate was a third compared to a static analysis scanner; we used to have automation testing ex...

What needs improvement with Micro Focus Fortify on Demand?

Areas for improvement should be contextualized post the OpenText acquisition, but back when I was working with Micro Focus, they focused heavily on enterprise-centric solutions. Now, after the acqu...

What is your primary use case for Micro Focus Fortify on Demand?

For OpenText Core Application Security, I currently support a couple of my clients who are using Fortify on Demand for their web application, CRM, and sales platform. Many good features of Fortify ...

What advice do you have for others considering Micro Focus Fortify on Demand?

I use Fortify on Demand for monitoring up to a certain extent; it provides monitoring and helps analyze and identify issues that could propagate in the application. When used in conjunction with Ar...

Veracode vs Contrast Security Assess

Comparisons

Compared 8% of the time

SonarQube vs Contrast Security Assess

Compared 6% of the time

Mend.io vs Contrast Security Assess

Compared 5% of the time

Quotium Seeker vs Contrast Security Assess

Compared 5% of the time

Data Theorem API Secure vs Contrast Security Assess

Compared 2% of the time

More Contrast Security Assess Competitors

SonarQube vs OpenText Core Application Security

Compared 28% of the time

Checkmarx One vs OpenText Core Application Security

Compared 5% of the time

GitHub vs OpenText Core Application Security

Compared 4% of the time

Veracode vs OpenText Core Application Security

Compared 4% of the time

HCL AppScan vs OpenText Core Application Security

Compared 4% of the time

More OpenText Core Application Security Competitors

Product Reports

Download Contrast Security Assess product report

Contrast Security Assess

October 2026

OpenText Core Application Security

October 2026

OpenText Core Application Security report

Download OpenText Core Application Security product report

Also Known As

Contrast Assess

Micro Focus Fortify on Demand

Overview

Contrast Security Assess is an IAST platform known for accurate vulnerability detection. It integrates into development workflows, offering real-time insights into security issues with minimal false positives, supporting legacy applications and enhancing code security visibility.

Designed to integrate seamlessly into DevOps workflows, Contrast Security Assess automates real-time vulnerability detection and reduces false positives through its powerful IAST features. By continuously monitoring vulnerabilities, it provides a robust option for securing legacy applications and identifying vulnerabilities without lengthy scans. This cloud-hosted platform supports numerous programming languages, making it versatile for security testing across enterprise environments. Users benefit from detailed reports that pinpoint exact code locations requiring remediation, enhancing speed and efficiency in addressing security concerns.

What are the key features of Contrast Security Assess?

IAST Technology: Delivers accurate vulnerability detection with reduced false positives.
Seamless Integration: Integrates into development processes, supporting real-time vulnerability detection.
Open Source Security: Analyzes third-party libraries for vulnerabilities.
Continuous Monitoring: Provides valuable insights with real-time security feedback for developers.
API Interface: Enhances operational efficiency and streamlining with minimal false positives.

What benefits should users look for in reviews?

Enhanced Security Visibility: Offers comprehensive insights across application environments.
Speed and Efficiency: Quick identification and remediation of vulnerabilities accelerate development.
Operational Streamlining: Seamless integration into DevOps workflows improves productivity.
Legacy Application Support: Effective for securing existing applications with ongoing monitoring.

Companies in industries requiring high levels of application security, such as finance and healthcare, implement Contrast Security Assess for its ability to enhance visibility and detect vulnerabilities early in the development lifecycle. Its seamless integration with DevOps processes makes it ideal for environments that prioritize agility while maintaining stringent security standards.

Contrast Security

OpenText Core Application Security offers robust features like static and dynamic scanning, real-time vulnerability tracking, and seamless integration with development platforms, designed to enhance code security and reduce operational costs.

OpenText Core Application Security is a cloud-based, on-demand service providing accurate and deep scanning capabilities with detailed reporting. Its integrations with development platforms ensure an enhanced security layer in the development lifecycle, benefiting users by lowering operational costs and facilitating efficient remediation. The platform addresses needs for intuitive interfaces, API support, and comprehensive vulnerability assessments, helping improve code security and accelerate time-to-market. Despite its strengths, challenges exist around false positives, report clarity, and language support, alongside confusing pricing and package options. Enhancements are sought in areas like CI/CD pipeline configuration, report visualization, scan times, and integration with third-party tools such as GitLab, container scanning, and software composition analysis.

What features define OpenText Core Application Security?

Static and Dynamic Scanning: Offers thorough analysis to identify vulnerabilities during development.
Real-time Vulnerability Tracking: Continuously updates and monitors potential security threats.
Seamless Development Platform Integration: Enhances security processes without disrupting workflows.
Cloud-Based Service: Provides flexible, on-demand security capabilities with accurate results.
API Support: Allows smooth integration and automation within existing systems.

What benefits should users look for in reviews?

Reduced Operational Costs: Optimizes resources by lowering costs associated with security management.
Efficient Remediation: Speeds up the process of identifying and resolving vulnerabilities.
Enhanced Code Security: Strengthens overall application security during the development lifecycle.
Accelerated Time-to-Market: Streamlines development stages by integrating essential security tools.

Industries like mobile applications, e-commerce, and banking leverage OpenText Core Application Security for its ability to identify vulnerabilities such as SQL injections. Integrating seamlessly with DevSecOps and security auditing processes, this tool supports developers in writing safer code, ensuring secure application deployment and enhancing software assurance.

OpenText

Sample Customers

Williams-Sonoma, Autodesk, HUAWEI, Chromeriver, RingCentral, Demandware.

SAP, Aaron's, British Gas, FICO, Cox Automative, Callcredit Information Group, Vital and more.