Question 1

Does Fortify Core need write access to my cloud?

Accepted Answer

No. Detection uses a read-only role with short-lived credentials in each account. Remediation is delivered as a pull request against your repository. The only path to a write is your own CI applying a change your team approved — unless you explicitly enable self-healing for a low-risk class of drift.

Question 2

Will scheduled scans interfere with my own Terraform runs?

Accepted Answer

Scans are refresh-only and never acquire a state lock for writing. If a lock is held by one of your pipelines, the scan defers and retries on the next interval.

Question 3

How do you keep alert volume manageable?

Accepted Answer

Every change is classified by resource type, attribute sensitivity and downstream blast radius. You choose the severity threshold per environment and per destination, so CRITICAL can page while MEDIUM lands in a daily digest. Known-noisy attributes are suppressed by default.

Question 4

Which state backends are supported?

Accepted Answer

S3 with DynamoDB locking, Google Cloud Storage, Azure Blob Storage, Terraform Cloud and Enterprise, plus local state committed to the repository. Terragrunt layouts and workspace-per-environment patterns are both supported.

Question 5

What happens when a remediation pull request conflicts with active work?

Accepted Answer

The pull request is rebased automatically on each scan while it stays open. If the underlying drift is resolved by someone else, the pull request closes itself with a comment explaining what changed.

Question 6

Can I run Fortify Core in my own VPC?

Accepted Answer

Self-hosted runners are available on the Enterprise plan. The control plane stays managed; the scanning worker runs inside your network so plan output never leaves your perimeter.

Question 7

How is billing calculated?

Accepted Answer

By managed resource count across connected environments, measured as a daily average over the billing period. Environments you disconnect stop counting the same day. There is no per-seat charge.

Question 8

Is there a free trial?

Accepted Answer

Fourteen days, no card required, full feature set including self-healing. Trials convert only when you choose a plan.

Frequently asked questions