Security Testing
Fortify Static Code Analyzer (SCA), from OpenText (formerly Micro Focus, formerly HP), is one of the most widely deployed SAST tools in regulated industries — financial services, healthcare, government. If your organization needs to demonstrate security compliance (PCI-DSS, HIPAA, FedRAMP), you've probably encountered Fortify. This guide covers how
SonarQube
Security hotspots are code locations that require a human security review — they might be fine, or they might be vulnerabilities. Unlike vulnerabilities (which are confirmed issues), hotspots are flagged for review. SonarQube tracks their review status: TO_REVIEW, ACKNOWLEDGED, SAFE, or FIXED. Key Takeaways Hotspots ≠ Vulnerabilities. A vulnerability is a
Security Testing
SAST tools commonly produce 30–70% false positive rates out of the box. Teams that don't manage this noise end up ignoring all SAST output. The solution is a combination of: baseline suppression (ignore existing issues, only alert on new ones), rule tuning (disable rules not relevant to
Security Testing
Static application security testing (SAST) finds vulnerabilities before your code ships. Coverity, from Synopsys, is one of the most widely deployed SAST tools in enterprise environments — used by teams that need low false-positive rates and deep language support. This guide covers what Coverity does, how to set it up,
Security Testing
Checkmarx is one of the most widely deployed SAST platforms globally, known for its extensive language support, customizable queries, and strong developer workflow integrations. If your organization has a formal AppSec program, Checkmarx SAST (now part of Checkmarx One) is likely on the shortlist. This guide covers how Checkmarx works,
Semgrep
Semgrep is a fast, syntax-aware static analysis tool that lets you write custom security rules in YAML using code patterns rather than regular expressions. This guide covers rule syntax, writing custom rules for your codebase, using community rulesets, CI integration, and reducing false positives through triage and rule refinement.