# Contrast Security vs Imperva Runtime Application Self-Protection (RASP) for an AppSec team: which is worth adding to an existing stack?

I'm trying to understand Contrast Security vs Imperva Runtime Application Self-Protection (RASP) for an AppSec team: which is worth adding to an existing stack? Both embed protection into the application rather than bolting it onto the network, so the real question is which one earns its place next to what you already run. Here's how the two compare, from the Runtime Application Self-Protection (RASP) Tools category, with a couple of alternatives worth a look.

Contrast Security is the more deeply reviewed of the two, and reviewers consistently praise its combined runtime protection and IAST approach: sensors inside the app catch vulnerabilities under real traffic, which reviewers say cuts false positives versus traditional scanning, while the Protect module handles real-time blocking. Common gripes are slower support for some legacy languages and RASP licensing that a few felt differed from what they expected.
Imperva Runtime Application Self-Protection (RASP) takes a leaner, in-app blocking posture that reviewers describe as close to set-and-forget, aimed at stopping attacks other controls miss with minimal performance impact. The honest limit is a very small G2 review base, so there's less independent signal than with Contrast, and the console reportedly takes some time to learn.

For alternatives in the same evaluation, Dynatrace folds runtime application security into a broader observability platform, which suits teams wanting security and monitoring converged, and Waratek is a strong Java-specific option where reviewers value virtual patching with no measurable performance hit.

For your stack, is the priority breadth (RASP plus IAST plus dev-stage findings) or a lean blocking layer that mostly runs itself? And does most of your risk sit in Java, mixed languages, or client-side code?

##### Post Metadata - Posted at: 12 days ago - Author title: Marketer - Net upvotes: 1 ## Comments ### Comment 1 <p>The two aren't really symmetric choices: Contrast is the combined RASP-plus-IAST platform with a deep review base to back up its claims, while Imperva is explicitly the leaner, narrower option with a thin review base, so choosing Imperva means accepting less independent signal in exchange for simplicity. That asymmetry matters more than the "existing stack" framing suggests, since adding Contrast is really adding a second detection layer alongside what you run, while adding Imperva is closer to adding a single-purpose blocking control. Has anyone swapped from Imperva to Contrast (or the reverse) and found the smaller review base was actually justified once running it in production?</p> ##### Comment Metadata - Posted at: 4 days ago - Author title: SEO Content Writer ## Related discussions - [How well does Trello scale into a larger team?](https://www.g2.com/discussions/1-how-well-does-trello-scale-into-a-larger-team) - Posted at: about 13 years ago - Comments: 6 - [Can we please add a new section](https://www.g2.com/discussions/2-can-we-please-add-a-new-section) - Posted at: about 13 years ago - Comments: 0 - [Quantifiable benefits from implementing your CRM](https://www.g2.com/discussions/quantifiable-benefits-from-implementing-your-crm) - Posted at: about 13 years ago - Comments: 4