About Contrast Security
Contrast Security was founded in 2014 by Jeff Williams, a longtime application security expert and one of the original creators of the widely used OWASP (Open Web Application Security Project) Top 10 list of common web application vulnerabilities, based on the observation that traditional application security testing approaches, such as static code analysis performed before deployment or external vulnerability scanning of a running application from outside, often produce a high volume of false positives and miss vulnerabilities that only become apparent when code is actually executing with real data flowing through it.
Contrast's core technical approach, known as instrumentation-based security or interactive application security testing (IAST), embeds lightweight monitoring agents directly within an application's runtime environment, observing how data actually flows through the application's code as it executes in testing or production, which lets it identify real, exploitable vulnerabilities with much higher accuracy than external scanning approaches, since it can observe the actual behavior of the running application rather than only inferring potential vulnerabilities from static code analysis or external probing. This same instrumentation approach extends to runtime application self-protection (RASP), which lets Contrast's technology actively detect and block real attacks against a running application in production, providing a layer of protection that operates from inside the application itself rather than relying solely on external security tools like web application firewalls. Contrast's customers span enterprises across many industries that develop significant amounts of custom software and need to secure that software throughout its development and deployment lifecycle, particularly relevant given the increasing pace of software development under DevOps and continuous deployment practices, which can outstrip the capacity of traditional, slower application security testing approaches. The company has raised substantial venture funding from investors including Warburg Pincus, General Atlantic, and Battery Ventures, reaching a valuation exceeding $1 billion, competing with other application security vendors including Veracode, Checkmarx, and Snyk.
