# What is the most reliable RASP tool for protecting Java web applications in production where the risk of false positives blocking legitimate requests is a real concern?

<p class="elv-tracking-normal elv-text-default elv-font-figtree elv-text-base elv-leading-base elv-font-normal" elv="true">What is the most reliable RASP tool for protecting Java web applications in production, where the risk of false positives blocking legitimate requests is a real concern? In production, an agent that blocks good traffic is its own kind of outage, so for Java teams, the priority is accurate detection without tripping on legitimate requests. These are the Java-capable picks from the <a class="a a--md" elv="true" href="https://www.g2.com/categories/runtime-application-self-protection-rasp-tools">Runtime Application Self-Protection (RASP) Tools</a> category most relevant to that worry.</p><ul>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/contrast-security-contrast-security/reviews"><strong>Contrast Security</strong></a> earns repeated credit for cutting false positives through its runtime, inside-the-app approach, since it watches how code actually behaves under real traffic rather than inferring from patterns, and for its well-represented Java support in reviews. A minority still mentions false positives to tune, so plan for some calibration rather than none.</li>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/opentext-core-application-security/reviews"><strong>OpenText Core Application Security</strong></a>, from the Fortify lineage, draws praise for removing false positives from its results (with expert review available) and for real-time runtime monitoring and protection, which speaks directly to the accuracy concern. Some reviewers find the interface less friendly to navigate.</li>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/waratek-waratek/reviews"><strong>Waratek</strong></a> is the most Java-specific pick here by design, running inside the JVM, and reviewers emphasize precise, policy-based protection and virtual patching with no measurable performance impact, which tends to mean fewer surprises on Java workloads. The trade-offs are its Java-only scope, a small review base, and ruleset updates that a few reviewers wished were automated.</li>
</ul><p class="elv-tracking-normal elv-text-default elv-font-figtree elv-text-base elv-leading-base elv-font-normal" elv="true">For your Java apps, would you rather start an agent in monitor-only mode and graduate to blocking, or trust accurate blocking from the start?</p>

##### Post Metadata
- Posted at: 21 days ago
- Author title: Marketer
- Net upvotes: 1


## Comments
### Comment 1

&lt;p&gt;All three make a real claim about false positives, but each backs it with a different amount of ongoing manual work: Contrast still gets flagged by a minority of reviewers for tuning after the fact, OpenText leans on expert review as an available service rather than the tool doing it alone, and Waratek&#39;s precision is baked into the JVM-level policy but its ruleset updates aren&#39;t automated, so someone still has to keep that current by hand. None of the three is really &quot;set it and trust it&quot; the way the question hopes for, they just move the manual work to a different stage. Has anyone actually measured how much tuning time Contrast needed in the first month versus what Waratek&#39;s manual ruleset upkeep costs over the same period?&lt;/p&gt;

##### Comment Metadata
- Posted at: 14 days ago
- Author title: SEO Content Writer





## Related discussions
- [How well does Trello scale into a larger team?](https://www.g2.com/discussions/1-how-well-does-trello-scale-into-a-larger-team)
  - Posted at: about 13 years ago
  - Comments: 6
- [Can we please add a new section](https://www.g2.com/discussions/2-can-we-please-add-a-new-section)
  - Posted at: about 13 years ago
  - Comments: 0
- [Quantifiable benefits from implementing your CRM](https://www.g2.com/discussions/quantifiable-benefits-from-implementing-your-crm)
  - Posted at: about 13 years ago
  - Comments: 4