name: Fortify API FinOps
specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/
provider: Fortify
providerId: fortify
publisherName: Open Text Corporation
serviceCategory: Application Security
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Application Security
  - DevSecOps
  - SAST
  - DAST
  - SCA
  - FinOps
  - FOCUS
description: FOCUS-aligned FinOps mapping for Fortify (OpenText) — annual subscription application-security tooling billed per application (Fortify on Demand SaaS) or per developer seat / scan engine (self-hosted SCA + SSC + WebInspect).
notes: No public price list. Meters reflect typical OpenText/Fortify invoice line items.
sources:
  - https://www.opentext.com/products/fortify-on-demand
  - https://www.opentext.com/products/fortify
billingModel:
  pricingCategory: Tiered Subscription
  billingFrequency: Annual
  billingCurrency: USD
  chargeCategories:
    - Purchase
    - Usage
    - Tax
    - Adjustment
    - Credit
focusColumns:
  ServiceName: Fortify (OpenText)
  ServiceCategory: Application Security
  ProviderName: Open Text Corporation
  PublisherName: Open Text Corporation
  InvoiceIssuerName: Open Text Corporation
  BillingCurrency: USD
  ChargeCategory: Purchase
meters:
  - name: applications_scanned
    description: Distinct applications under Fortify on Demand subscription
    unit: application-year
    aggregation: max
    dimensions:
      - product
      - business_unit
  - name: developer_seats
    description: Developer / contributor seats licensed for self-hosted Fortify
    unit: seat-year
    aggregation: max
    dimensions:
      - product
  - name: scan_engines
    description: SCA / WebInspect / ScanCentral engine licenses
    unit: engine-year
    aggregation: max
    dimensions:
      - engine_type
  - name: scans_executed
    description: Static, dynamic, mobile, or SCA scans executed
    unit: scan
    aggregation: sum
    dimensions:
      - scan_type
      - application
  - name: lines_of_code_scanned
    description: LOC analyzed (used as a tier-sizing metric for some FoD agreements)
    unit: line
    aggregation: sum
    dimensions:
      - language
principles:
  - name: Visibility
    description: Pull Fortify on Demand and SSC reporting APIs into your data warehouse; track scans-per-application and scan-pass-rate to expose unused application licenses.
  - name: Allocation
    description: Tag applications in FoD/SSC with business-unit metadata so license consumption is allocable.
  - name: Optimization
    description: Right-size FoD application tier (LOC bands) annually based on actual codebase size; consolidate dormant applications; consider on-prem ScanCentral for high-volume CI scanning where it is cheaper than per-app FoD subscriptions.
  - name: Accountability
    description: AppSec engineering owns the Fortify contract; finance reviews application count and scan utilization quarterly ahead of OpenText renewal.
maintainers: []