The DerScanner system helps our customers ensure that the security of the apps they create are exhaustively checked end-to-end for security vulnerabilities both obvious, and non obvious in a thorough and comprehensive way. DerScanner discovered potential weaknesses that would have been difficult or even impossible to find, even in long-standing, mature code.
Ian BarkerDeveloper Advocate, Embarcadero TechnologiesSAST, DAST, SCA, MAST
SAST, DAST, SCA, mobile
DerScanner runs static analysis on .exe, .dll, .jar, .war, .apk and .ipa files inside the perimeter. Fortify scans source code and Java bytecode, and tests mobile binaries at runtime in Fortify on Demand.
Fortify 26.1 covers these languages through an AI Analyzer that relies on a customer-supplied LLM.
DerScanner vs OpenText Fortify
DerCodeFix rebuilds source from the bytecode and suggests a secure edit. Engineers can ask for another variant and compare.
DerScanner reads 43 languages with its own rule sets, from mainframe COBOL to Solidity contracts.
Vendor .exe and .dll files are analyzed as delivered, so supplier code meets the same bar as in-house builds.
DerScanner flags functionality missing from specifications, including logic left in the code by contractors.
DerScanner scores credibility, authorship, popularity and community reaction time for every package.
Each DerTriage decision comes with an explanation a reviewer can check. No cloud service is involved.
Hardcoded credential in DbConfig.pas:17
TRUE POSITIVEA database password is stored as a string constant in the unit.
Sources: OpenText SAST 25.2 supported languages, SAST 26.1 release notes and the SAST Aviator user guide, September 2026.
| Capability | DerScanner | OpenText Fortify |
|---|---|---|
| AI verification of findings | Yes | Yes |
| AI-generated code fixes | Yes | Yes |
| AI triage without internet access | Yes | PartialSAST Aviator uses a cloud service hosted by OpenText |
| Capability | DerScanner | OpenText Fortify |
|---|---|---|
| Vulnerability search in source code | Yes | Yes |
| Taint, semantic and control flow analysis | Yes | Yes |
| Undocumented feature search | Yes | No |
| Obfuscated code check | Yes | Yes |
| Delphi, Perl, Rust | Yes | PartialAI Analyzer with a customer-supplied LLM |
| LotusScript, Vyper | Yes | No |
| ActionScript, Classic ASP, ColdFusion | No | Yes |
| Infrastructure as code and container checks | Yes | Yes |
| Capability | DerScanner | OpenText Fortify |
|---|---|---|
| JAR, WAR, EAR (Java) | Yes | PartialJava bytecode translation |
| EXE, DLL (C/C++) | Yes | No |
| APK (Android) | Yes | Partialruntime mobile assessment in Fortify on Demand |
| IPA (iOS) | Yes | Partialruntime mobile assessment in Fortify on Demand |
| Third-party software without source code | Yes | PartialJava bytecode only |
| Capability | DerScanner | OpenText Fortify |
|---|---|---|
| Transitive dependency analysis | Yes | Yes |
| SBOM file analysis | Yes | Yes |
| License risk coverage | Yes | Yes |
| Capability | DerScanner | OpenText Fortify |
|---|---|---|
| Web application DAST | Yes | Yes |
| SAST and DAST correlation | Yes | Yes |
| OpenAPI specification import | Yes | Yes |
| Capability | DerScanner | OpenText Fortify |
|---|---|---|
| Repository, CI/CD and issue tracker integrations | Yes | Yes |
| IDE plugins with inline findings | PartialEclipse, IntelliJ IDEA, Visual Studio plugins, findings outside the editor | Yes |
| Compliance reports (OWASP Top 10, PCI DSS, CWE/SANS) | Yes | Yes |
| Capability | DerScanner | OpenText Fortify |
|---|---|---|
| SaaS | Yes | Yes |
| On-premises | Yes | Yes |
| Installation wizard | No | Yes |
| Automatic database updates in on-premises installations | Partialautomatic in SaaS, manual on-premises | Yes |
OpenText Fortify entries are drawn from OpenText public documentation available in September 2026.
Fortify scans run until the matching DerScanner projects are live, so every release still passes a security check.
Plan a migrationA proof of concept on the same codebase puts both reports side by side before any license decision.
Prefer email? company@derscanner.com