Sponsored by

Whitepaper

Product Security Development Lifecycle

Security that is bolted on at the end of development tends to be expensive and incomplete, and the pressure is growing as AI-assisted research and automated vulnerability discovery change the threat landscape. This white paper is a public overview of the OpenText Product Security Development Lifecycle, which covers every product the company and its subsidiaries build. It walks through each phase: security requirements and threat modeling during concept and design; third-party component tracking, supply chain security, privacy reviews and container scanning during development; mandatory static and dynamic scanning of every release with OpenText Fortify; and penetration tests run by a product security team that sits apart from the product teams, or by third parties. It also explains how issues are rated with industry standards such as CVSS, how clients are alerted and patched when a significant threat emerges, and why every product has an assigned Security Advocate who owns its security and verifies the required controls are in place.