OpenText Fortify 26.4 adds cheaper-to-control, easier-to-fit AI security scans

OpenText’s Fortify Agentic Analyzer 26.4 adds ways to scan code changes before a full baseline exists, control model spend and feed findings into other tools. The update makes AI-assisted vulnerability analysis easier to fit into everyday development, while keeping it alongside, rather than in place of, conventional static analysis.

OpenText Watch analysis

What happened

OpenText says Fortify Agentic Analyzer is now on the regular release cadence for its on-premises products, with documented release notes, version support and a predictable upgrade path. Its 26.4 update adds non-baselined differential scanning, so teams can analyse a pull request, merge request, branch or uncommitted changes without first running a full scan.

The release also adds Markdown output in three forms: a summary, one detailed file, or separate files for each issue with an index. Other changes include controls to cap scan token spend, improved consistency for the findings OpenText considers most important, and a TypeScript plugin mechanism for connecting to a team’s own API or AI gateway. OpenText describes Agentic Analyzer as a deeper, selective pass that complements Fortify SAST, which remains the faster, broader first line of analysis.

Our top picks

• Scan changes without a full baseline
  Teams can analyse code as it is being written or reviewed, rather than waiting for a reference scan.
• Send findings out as Markdown
  The files can be read by developers and passed into other tools or agent workflows.
• Set a limit on token spend
  Teams gain a direct control over a scan’s model costs.
• Connect through a custom gateway
  The TypeScript plugin can handle bespoke requirements, such as signing requests for a company gateway.
• More consistent priority findings
  OpenText says its most important results should remain more stable between runs, though the long tail can still shift.

Why it matters

Security teams are being asked to review code at a pace that automated coding tools can accelerate. Being able to scan a small change without waiting for a full baseline could make deeper analysis more practical during development, while Markdown output gives teams another way to route findings into existing work.

The cost and gateway controls also address a familiar deployment snag: teams may want model-assisted analysis but need to manage usage and connect through their own infrastructure. The release does not remove the trade-offs OpenText describes. Agentic analysis costs more than traditional static analysis and is not fully deterministic, so the two approaches have different jobs.

Our read

This is a useful workflow update, not a claim that an AI reviewer makes static analysis obsolete. The strongest improvements are the ones that reduce friction: scan only the changes that matter, set a spending boundary, and get results into a format other tools can use. Teams considering it should test those benefits against their own code and review process, rather than treating a vendor’s account of its product as a performance benchmark.

What to watch

• Whether teams can use differential scans routinely without losing useful findings.
• How the token controls affect scan coverage and cost in practice.
• Whether the custom plugin works with the gateways and signing requirements teams actually use.

Discussion spark: Would you add a more expensive, less predictable AI analysis pass to every code review, or reserve it for changes that conventional static analysis is likely to miss?

not affiliated with or endorsed by OpenText