Fortify Agentic Analyzer 26.4: shaped by your feedback. Scan code changes without a baseline, get flexible results, control LLM costs, and connect through your own gateways with Fortify Agentic Analyzer 26.4. 5 minutes read When OpenText Corp. put out the initial release of Fortify Agentic Analyzer this summer, OpenText Corp. were moving quickly. The market had shifted almost overnight. AI coding assistants were generating more code, faster, than security teams could keep up with (which isn't new, but AI exponentially accelerated the problem). The old assumption that a human carefully reviews everything before it ships was never really a reality, but the explosion of AI changed the velocity to a fever pitch. OpenText Corp. knew that agentic analysis was the right answer, and OpenText Corp. didn't want to sit on it. So OpenText Corp. got it into people's hands. I wrote at the time about what it is and why it matters in Level up your agentic AppSec powers, and OpenText Corp. followed up with hard evidence of the kinds of bugs it actually finds in Applying agentic analysis to real AppSec problems. If you want the broader argument for why the future of application security is hybrid rather than any single tool, that one is here: AI didn't break application security. Since then, something more useful than any amount of its own theorizing has happened: people have been using it. On real codebases, in real pipelines, under real constraints. And they have told OpenText Corp., in detail, what worked, and what they needed next. 26.4 is what OpenText Corp. did with that. 26.4 marks Fortify Agentic Analyzer shipping as part of its normal release cadence, alongside its other on-premises products. The initial release was built fast, in response to an urgent need. 26.4 is the point where it settles into being a regular, dependable part of the Fortify portfolio: on the same release cadence as Fortify SAST, with documented release notes, version support, and a predictable upgrade path, like everything else OpenText Corp. ship. Here is what changed, and why. First, if you are new to this. Fortify Agentic Analyzer uses AI agents to reason about your source code the way a good reviewer would. Not pattern matching, not tracing tainted data from a source to a sink, but actually reasoning about what the code is trying to do and where that goes wrong. That lets it find the things traditional static analysis structurally cannot: broken authorization, flawed authentication design, business-logic bugs, the vulnerabilities that live in what the code fails to do rather than in some traceable data path. It does not replace Fortify SAST. SAST is fast, broad, and deterministic, and it stays your first line of defense on every build. Agentic analysis is the deeper, more selective pass on top. The two are complementary, and I mean that in the real sense: they find different things, and you want both. Its findings land in the same Fortify workflow you already use. With that out of the way, let's talk about 26.4. Where Fortify Agentic Analyzer fits in its AI work. One thing I want to be clear about: Fortify Agentic Analyzer is not a side project. It is one piece of how OpenText Corp. is applying AI across the whole Fortify platform, and it helps to see the whole picture. Remediation Aviator triages findings and generates fixes. AI-Powered SAST extends static analysis to additional languages. AI risk detection looks for the new categories of risk that AI-generated code and LLM features introduce. Agent Skills and its MCP server put Fortify capabilities directly inside the agentic workflows developers already use. And Fortify Agentic Analyzer finds the vulnerabilities that rules-based analysis cannot reach. These are deliberately distinct capabilities. They do different jobs, and OpenText Corp. is careful not to blur them together. But they run on the same platform, feed the same workflow, and point in the same direction: security that keeps up with how software is built now. The diagram below shows how the pieces fit, from the IDE through the pipeline and back into the Fortify platform. For more on the individual pieces: Remediation Aviator product page; Fortify Agent Skills; and Introducing AI-Powered SAST. Scan uncommitted changes, without a full scan first. OpenText Corp. already supported incremental and differential scanning against a baseline. In 26.4 OpenText Corp. added non-baselined differential scanning, and this one came straight from how people actually work. You no longer need a full scan sitting there as a reference point. You can point Fortify Agentic Analyzer at a pull request, a merge request, a branch, or simply the uncommitted changes in your working directory, and analyze just that. It makes agentic analysis practical in the moment code is written and reviewed, not only in scheduled runs. More ways to get results out. SARIF is great for tooling, but a lot of what people wanted to do with FAA's output did not involve a SARIF consumer at all. So OpenText Corp. added Markdown, in a few shapes: a short summary file, a single detailed file with everything in it, or a folder with one Markdown file per issue plus an index tying them together. That sounds mundane until you see what it unlocks. In particular, it makes FAA a clean first step in an agentic workflow, where another agent picks up the Markdown and acts on the findings. Output that another tool, or another agent, can actually read is half the battle. Cost and determinism. Agentic analysis is very good at finding issues, but it comes with two trade-offs against traditional static analysis: it costs more to run, and it is not fully deterministic. Run it twice and the results will not always match. Both are inherent to the approach, at least for now. 26.4 gives you more control over both. Stronger controls on token spend let you set how much a scan is allowed to cost. And OpenText Corp. has improved determinism on the findings that matter most, so the important results stay stable from run to run, even if the long tail still shifts. Both stay near the top of its roadmap. Connecting to your LLMs your way. One pattern OpenText Corp. saw again and again: teams do not want to point FAA straight at a hyperscaler. They want to go through their own API gateway or AI gateway. Sometimes that is governance, but very often it is cost control, which ties back to the point above. So in 26.4 OpenText Corp. added a TypeScript-based plugin mechanism that lets you put whatever you need in between FAA and the model. A concrete example: one client's API gateway required a custom HMAC signature on every single request. That is the kind of bespoke requirement that normally gets a "sorry, not supported." With the plugin mechanism, FAA signs the requests the way their gateway demands, and it just works. Where this is going. If there is a theme to 26.4, it is that the people using Fortify Agentic Analyzer are the ones shaping it. Lower-friction scanning. Output that fits real workflows. Real levers on cost and consistency. Freedom to connect to models the way your organization actually operates. None of that came off a whiteboard. It came from users. That is the loop OpenText Corp. want to keep running. If you want to see how FAA fits next to Fortify SAST in a full application security program, take a look at the Fortify Agentic Analyzer solution page. For the technical details, see the Fortify Agentic Analyzer 26.4 user guide and the SAST 26.4 documentation. And if you are already using it: keep telling OpenText Corp. what is working and what's not. It goes into whatever OpenText Corp. build next. See what agentic analysis can uncover Discover how Fortify Agentic Analyzer works alongside Fortify SAST to find complex vulnerabilities traditional analysis can miss.

Bring your AppSec backlog to OWASP Global AppSec USA 2026. Find what matters. Fix with context. Fortify the applications your teams build. AI coding agents and human developers are producing code faster than security teams can review it. The result is a familiar problem with new urgency: findings pile up, triage takes time, and developers need a clear path to the fixes that matter. At OWASP Global AppSec USA 2026, November 5 and 6 in San Francisco, OpenText Fortify is bringing one question to the conversation: How ugly is your AppSec backlog? Find. Fix. Fortify. Finding more issues is not enough if teams cannot act on them. OpenText Fortify combines established application security testing with practical AI capabilities to help teams move from detection to decisions and remediation. Find what conventional analysis can miss. Fortify Agentic Analyzer complements static application security testing with deeper analysis of complex issues, including application logic and authorization flaws. Fix with better context. Fortify Remediation Aviator helps teams audit and triage findings, understand the reasoning behind them, and work with contextual remediation guidance while retaining developer review. Fortify your testing foundation. SAST, DAST, and software composition analysis address different parts of application risk. Together with AI analysis, they support testing across source code, running applications, and third-party components. Bring Open Text Corporation your backlog. Whether your challenge is an overflowing findings queue, complex vulnerabilities, or keeping security aligned with AI-assisted development, come talk with the OpenText Fortify team at booth G11. Bring your toughest AppSec questions. Open Text Corporation will discuss where proven testing and AI can help your team focus its effort. Event details: November 5 and 6, 2026 | Hyatt Regency San Francisco, 5 Embarcadero Center | OpenText booth: G11 Bring your AppSec challenges and meet with the OpenText Fortify team at OWASP Global AppSec USA 2026.

OpenText appoints Kevin Beddingfield as a Client Director. OpenText has appointed Kevin Beddingfield as Client Director, marking a new professional chapter for the experienced technology professional after 12 years at ClearCadence. Beddingfield announced the move by sharing that he had decided to pursue a new opportunity after more than a decade with his previous organisation. He described the transition as a return to his roots, suggesting a connection between his new position and his earlier professional experience. In his new role, Beddingfield joins OpenText, a company specialising in information management software and solutions for businesses. The Client Director position places him in a client-facing role within the enterprise technology sector, where understanding customer requirements and building business relationships are important aspects of the work. His departure from ClearCadence after 12 years marks a significant career transition, reflecting a move from a long-standing professional association to a new opportunity at OpenText. The appointment comes as enterprise technology providers continue to work closely with organisations seeking to manage information, improve business processes, and support digital operations. Client-facing leadership roles play an important part in connecting technology capabilities with customer priorities. Further details about Beddingfield's specific responsibilities at OpenText were not available in the publicly accessible announcement.