Fortify On Demand overview
SHIP-HATS offers Fortify On Demand (FOD) as a cloud-based application security testing service that helps agencies identify and remediate vulnerabilities in their applications.
FOD enables teams to perform automated security testing without managing their own security scanning infrastructure. It supports multiple testing methods and integrates with development workflows to detect vulnerabilities early in the software development lifecycle.
Key features and benefits
| Feature | Description |
|---|---|
| Application security testing | Performs automated security testing on application source code and running applications. |
| Multiple scan types | Supports Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Mobile Application Security Testing (MAST). |
| Cloud-based platform | Security scans and vulnerability management are handled through the Fortify On Demand service without requiring local infrastructure. |
| CI/CD integration | SHIP-HATS provides GitLab pipeline templates that allow teams to integrate FOD scans into their CI/CD pipelines. |
| Vulnerability management | Provides detailed vulnerability reports and remediation guidance to help teams fix security issues. |
| Centralised results | Security findings are consolidated in the FOD portal for review and tracking. |
Use cases
Fortify On Demand in SHIP-HATS can be used to:
- Detect security vulnerabilities during software development
- Integrate security testing into CI/CD pipelines
- Identify vulnerabilities in running web applications
- Track and manage security issues across application releases
Scan types
FOD provides the following types of security scans:
- SAST scan – Analyses application source code for vulnerabilities.
- DAST scan – Tests running applications for security weaknesses.
- MAST scan – Analyses mobile applications for security risks.
CI/CD integration
SHIP-HATS provides GitLab pipeline templates that allow development teams to run Fortify On Demand scans automatically during their CI/CD pipelines.
For details on the available templates and how they are used, see FOD pipeline templates.
Pricing
Public officers can view the pricing for this service at SHIP-HATS pricing using their non-SE GSIB or COMET device.
