Fortify WebInspect

Fortify WebInspect (by OpenText) is an automated dynamic application security testing (DAST) solution engineered to identify, analyze, and validate security vulnerabilities in running web applications, single-page applications (SPAs), web services, and APIs. By emulating real-world cyber attacks from an external attacker perspective, WebInspect probes running applications without requiring access to underlying source code, discovering exploitable vulnerabilities such as SQL injection, cross-site scripting (XSS), server-side request forgery (SSRF), and misconfigured server headers.

The solution features a modern crawl engine that executes JavaScript and handles complex HTML5, AJAX, and modern SPA web architectures. Key capabilities include automated crawling and attack simulations, comprehensive REST and SOAP API testing using OpenAPI/Swagger definitions, interactive application security testing (IAST) correlation via WebInspect Agent, automated login macro recording, and configurable compliance reporting. WebInspect validates whether discovered weaknesses are truly exploitable, helping security engineers eliminate theoretical vulnerabilities and focus remediation resources on high-risk, confirmed exposures.

Fortify WebInspect integrates with Fortify Software Security Center, Jenkins, Azure DevOps, Jira, enterprise SIEM platforms, and Fortify on Demand. Core enterprise use cases include validating web application defenses prior to production releases, performing automated black-box penetration testing, verifying API security posture, and demonstrating compliance with PCI-DSS requirement 6.5 and OWASP guidelines. Fortify WebInspect provides thorough scanning depth, modern web framework compatibility, and reliable vulnerability validation.