What is Contrast Security?
Contrast Security was founded by Jeff Williams, a co-creator of OWASP, around an "inside-out" approach to application security: patented sensors embedded inside the running application rather than external scanners. The platform includes Contrast Assess (interactive application security testing, IAST), Contrast Scan (SAST), Contrast SCA (open-source dependency analysis), and application detection and response (ADR/RASP) for blocking attacks at runtime. A newer product, CVE Shield, is offered on a free tier alongside a paid Pro plan and custom Enterprise pricing.
Read the full overview
Sources checked 27 September 2026: official website, pricing page.
Key capabilities
- Testing: IAST (Contrast Assess), SAST (Contrast Scan), and SCA for dependency risk.
- Runtime protection: Application detection and response (ADR) to detect and block live attacks from inside the app.
- CVE Shield: A separate, free-tier product for open-source vulnerability triage, with a paid Pro plan.
Core areas are in-app instrumentation for vulnerability testing (IAST/SAST/SCA) and runtime application detection and response, aimed at reducing false positives compared with external scanners.
Shortlist Contrast Security if you want vulnerability detection and runtime attack protection from the same in-app sensor rather than stitching together separate SAST, IAST, and RASP tools. Confirm current pricing directly, since most of the platform is sold as a custom enterprise quote.
A pilot should confirm sensor performance overhead in your runtime and how many findings from Assess/Scan are true positives your team can act on, since in-app instrumentation is more invasive than a periodic external scan.
Technical details
- Access
- Self-hosted
- Source model
- Other license
- Founded
- 2014
- Headquarters
- Baltimore, USA
- Pricing model
- Freemium
- API
- Available
- Website
- www.contrastsecurity.com ↗
Official resources
What to verify for your environment
Start from the users, systems and operating responsibilities the tool needs to support.
- Confirm current features, licensing and support terms with the publisher.
- Validate deployment, data location, access control, backup and recovery requirements.
- Test integrations, export paths and a representative operational workflow before committing.
ITHub profiles are discovery summaries. Read how product information is presented or report a correction.
Reviews of Contrast Security
No published reviews yet.
Loading review form…
