Home / Services / AI landscape management
Code security with OpenText Fortify
AI coding assistants have multiplied the amount of code your teams ship, but review time has not grown with it. Flex Consulting puts OpenText Fortify into your build pipeline, so every change is checked for security flaws before it reaches production, and your developers get help fixing what it finds.
Why AI-written code needs security checks
Developers using AI assistants are producing much more code than they used to, and teams outside IT are building apps, scripts and agents of their own. That code still has to be safe. An assistant can suggest an injection flaw, a hard-coded secret or an out-of-date open source library as readily as it suggests working code, and a reviewer reading hundreds of extra lines a day will miss some of them.
OpenText Fortify is application security testing software. It checks source code, running applications and open source dependencies for security weaknesses, and it runs automatically inside the tools your developers already use. Flex Consulting implements it, connects it to your CI/CD pipeline, tunes it to your code, and helps your teams triage and fix the findings. It sits within our wider AI landscape management work.
What Fortify changes
Every change is checked
Scans run in the pipeline on each build or pull request, not once a year before an audit, so flaws are caught while the code is still fresh in the developer's mind.
Developers fix more, faster
Findings appear in the IDE and the ticketing system with an explanation, and Fortify Remediation Aviator suggests the code fix, so developers spend less time researching each issue.
Less noise
Tuning and AI-assisted auditing separate real issues from false positives, so security teams spend their time on the findings that matter.
Evidence for risk and audit
Scan history, open findings and fix rates are recorded per application, which gives your risk committee and auditors something concrete to review.
Where we use Fortify
Common first pieces of work for large New Zealand organisations:
Securing AI-assisted development
Static analysis added to the repositories where developers use AI assistants, with rules agreed for which findings block a merge.
Pipeline integration
Fortify connected to Azure DevOps, GitHub, GitLab or Jenkins, so scans run automatically and results reach the right team.
Testing live web apps and APIs
Dynamic testing of customer portals and APIs in a test environment, to find weaknesses an attacker could reach from outside.
Open source and supply chain risk
Dependencies checked for known vulnerabilities and licence issues, with a software bill of materials for each application.
Checking code from automation and agents
Scripts, integrations and agent code built by citizen developers and partners brought under the same checks as core applications.
Backlog reduction
An existing pile of findings triaged, ranked by risk and worked down with developers, using AI-suggested fixes where they fit.
What Fortify includes
OpenText sells Fortify as a set of products that can run on your own infrastructure, privately hosted or as a service. We help you choose the mix that suits your code, your teams and where your data is allowed to go.
OpenText Fortify SAST
Static analysis of source code, including detection of secrets left in code. It works in IDEs such as Visual Studio, VS Code, Eclipse and IntelliJ, in CI/CD tools such as Jenkins, GitHub Actions, GitLab CI and Azure DevOps, and can raise Jira tickets automatically.
OpenText Fortify DAST
Dynamic testing that simulates real-world attacks on running applications, APIs and services, without needing the source code. It can be run from its interface or fully automated in a CI/CD pipeline through REST APIs.
OpenText Fortify Software Composition Analysis
Visibility of the open source dependencies in your applications, with vulnerability and licence information, enforceable pipeline rules for licence compliance, and export of a CycloneDX software bill of materials.
OpenText Fortify Remediation Aviator
Uses AI and large language models to audit static analysis findings, explain each issue in the context of the developer's code, and suggest the code fix.
OpenText Fortify on Demand
Application security testing as a service, offering static, dynamic, software composition, interactive and mobile testing without on-premises infrastructure. OpenText states its rule packs are updated for risks from AI-generated code.
How we implement Fortify
Assess
We review your repositories, pipelines and development teams, including where AI assistants are in use, and agree which applications to start with.
Integrate
We install or provision Fortify, connect it to your source control, CI/CD and ticketing tools, and set the rules for when a finding blocks a release.
Tune and triage
We tune the rules to your code, work through the first results with your developers and security team, and remove the noise before scanning goes wide.
Train and hand over
We train developers and security staff to read and fix findings, report on progress, and stay on to support and extend the programme if you want us to.
Why Flex Consulting
Flex Consulting is an OpenText partner. We build automation and AI agents for large New Zealand organisations, so we know where code is actually being written in practice: by core development teams, by partners, and increasingly by people using AI assistants and low-code tools. That lets us put Fortify where the risk is, rather than only on the applications that were already being reviewed.
Fortify is one part of our AI landscape management work, alongside orchestration on UiPath and data security with OpenText Voltage.
Questions we are asked
What is OpenText Fortify?
OpenText Fortify is application security testing software. It includes static analysis of source code (Fortify SAST), dynamic testing of running applications and APIs (Fortify DAST), open source dependency checks (Fortify Software Composition Analysis) and AI-suggested code fixes (Fortify Remediation Aviator). It can run on your own infrastructure or as a service through Fortify on Demand.
Does AI-generated code need security testing?
Yes. AI coding assistants can suggest code containing security flaws, hard-coded secrets or vulnerable libraries, and they increase the volume of code faster than review effort grows. Automated security testing in the build pipeline checks every change before it reaches production, whoever or whatever wrote it.
How long does it take to add Fortify to a CI/CD pipeline?
Connecting Fortify to a pipeline such as Azure DevOps, GitHub or Jenkins is usually the quick part. Most of the effort goes into agreeing which findings should block a release, tuning out false positives and training developers to act on results, so we start with a small group of applications and expand once the process works.
Find out how much of your code is being checked
Talk to us about the code your teams and their AI assistants are writing. We will show you where Fortify fits in your pipeline and which applications to start with.