MM

MATTHIEU M.

Mid-Market (51-1000 emp.)

3/2/2023

"best IAST of the market"

4/5

What do you like best about Contrast Security?

the IAST and the flow map part to trigger seurity bugs Review collected by and hosted on G2.com.

What do you dislike about Contrast Security?

To add a taint analysis and solution for route coverage Review collected by and hosted on G2.com.

TP

Tomer P.

Application Security engineer

Enterprise (> 1000 emp.)

3/1/2023

"great tool with a little bit of false positives"

3.5/5

What do you like best about Contrast Security?

easy integration

the support is very responsive Review collected by and hosted on G2.com.

What do you dislike about Contrast Security?

false positives

support in ruby/scala isnt the best

getting logs is a bit annoying Review collected by and hosted on G2.com.

RK

Rameshwar K.

Senior Technical Lead

Small-Business (50 or fewer emp.)

3/2/2023

"Full secured feeling"

5/5

What do you like best about Contrast Security?

All the security features which makes me more productive. Review collected by and hosted on G2.com.

What do you dislike about Contrast Security?

It sometimes makes the system very slow but that is ok. Review collected by and hosted on G2.com.

DK

D Santhosh K.

Data Engineer

Retail

Enterprise (> 1000 emp.)

3/2/2023

"Best and fast security scanner"

4/5

What do you like best about Contrast Security?

It's free to some extent

Fast then most security scanners Review collected by and hosted on G2.com.

What do you dislike about Contrast Security?

Nothing other than the learning and usage curve Review collected by and hosted on G2.com.

AK

Aggelos K.

Technical Security Manager

Enterprise (> 1000 emp.)

11/19/2021

"IAST tool that will boost your Application Security Programme"

4.5/5

What do you like best about Contrast Security?

The tool is straightforward to use; alerts and errors do not overpower developers during the Coding phase. The experience of Security Analyst, Developer, and Management is very positive.

The reports against Standards (OWASP Top 10 and PCI) are very convenient for audits allowing for better efficiency. Review collected by and hosted on G2.com.

What do you dislike about Contrast Security?

I have not been able to identify a feature that does not help the organization achieve the results aimed when implementing the solution. The features on the roadmap, along with the ones already in place, offer a complete suite that leaves no room for disliking. Review collected by and hosted on G2.com.

Recommendations to others considering Contrast Security:

Try Contrast out! Easy setup for a PoC and very flexible to adjust to your environment to get a quick glimpse and results Review collected by and hosted on G2.com.

What problems is Contrast Security solving and how is that benefiting you?

Our main Customer-facing applications are checked for vulnerabilities against widespread threats (OWASP Top 10). Checking the production version of our applications allows for identifying and resolving actual exploitable vulnerabilities in our Environment. Additionally, due to the level of detail on how to fix section, we train our Software Engineers boosting the security by design culture we have in mind. Review collected by and hosted on G2.com.

CH

Verified User in Hospital & Health Care

Enterprise (> 1000 emp.)

11/24/2021

"Solid option for IAST scanning within certain languages & public clouds"

3/5

What do you like best about Contrast Security?

Simple UI with solid IAST & SCA scans built into Contrast Assess/OSS product. Review collected by and hosted on G2.com.

What do you dislike about Contrast Security?

Less robust features for .NET-based workloads: Azure functions/serverless not available (only app services), Azure DevOps integrations work but are not intensive, Contrast support are generally less-knowledgeable on .NET environments (optimized for Java & AWS environments). Review collected by and hosted on G2.com.

Recommendations to others considering Contrast Security:

Contrast is easy to use once integrated, but it depends on your development stack. Contrast is heavily-optimized towards Java and AWS workloads/environments but are creating more and more in the .NET and Azure fields as well. Unfortunately for my client, they are heavily .NET and Azure-based so some features are not available at the time of this review. If you are looking for an IAST, SCA, RASP option, Contrast is solid. Review collected by and hosted on G2.com.

What problems is Contrast Security solving and how is that benefiting you?

Implementing DevSecOps initiatives for a large health care client.

Building Assess & OSS into pipelines & app service scans are helpful feedback loops for our dev teams. This project is the first time our client has prioritized this sort of work and the client is very excited to have security more baked-in to the development lifecycle. Review collected by and hosted on G2.com.

EI

Verified User in Information Technology and Services

Enterprise (> 1000 emp.)

9/30/2021

"Application Security Testing at scale."

5/5

What do you like best about Contrast Security?

The tool helps find high-quality security vulnerabilities at the speed of DevOps. "Fail fast, fail often" at the requirement of daily changes to the application landscape. Traditional SAST and DAST tools struggle to keep up with the rate of change and cause more noise than acceptable. Contrast Security helped us reach our goal of coverage without the hassle of the terrible signal-to-noise ratio common to other application security tools. Review collected by and hosted on G2.com.

What do you dislike about Contrast Security?

The main struggle that is inherit with this style of tool is the agent. However, it's unclear how you could have the best of both worlds without it. Review collected by and hosted on G2.com.

EH

Verified User in Hospital & Health Care

Enterprise (> 1000 emp.)

10/5/2021

"Less Noise, More Security, Room to Improve"

4/5

What do you like best about Contrast Security?

I like the proprietary way in which it scans for vulnerabilities compared to some of the traditional application scanning tools we use/used. Noise is the number one issue we hear from our engineers, and Contrast is really good at reducing the noise and focusing on actual vulnerabilities. The team we have been working with at Contrast has also been very helpful and responsive. It comes with a really good reporting solution out of the box, even though we use our own vulnerability aggregation solution. Review collected by and hosted on G2.com.

What do you dislike about Contrast Security?

The biggest thing we are dealing with on Contrast is code coverage. We currently his a much smaller code coverage than what you would see with a traditional SAST or SA scanning solution. We need to figure out a better way to increase that coverage to reduce the amount of risk that we are trying to employ with these new security test methods. Review collected by and hosted on G2.com.

What problems is Contrast Security solving and how is that benefiting you?

The problems we are solving is stated above in what I like about the solution. We are reducing the noise that is a part of traditional security scanning solutions and offering actual vulnerabilities for development teams to focus on. With less noise, this allows our team to work closer with our Engineers on being security analysts and not tool administrators. We are still in the process of rolling out at a larger scale, so some of the benefits are still being measured. Review collected by and hosted on G2.com.

IT

Verified User in Telecommunications

Enterprise (> 1000 emp.)

10/4/2021

""Gives the guidance and learning to developers to improve security of application""

4/5

What do you like best about Contrast Security?

-Technology used to detect the vulnerabilities, the way it's presented along with complete tracing, guidance for teams to learn about the vulnerability and associated risk are plus.

-Another great advantage is giving visibility into route coverage which helps to identify the route's that not exercised or having high number of vulnerabilities, but please note that it's not supported for all Java frameworks.

-Ease of implementation, works great for both SDLC/DevOps model. Review collected by and hosted on G2.com.

What do you dislike about Contrast Security?

- Log collection could be improved, for any troubleshooting/debugging require coordination with application teams to set required configuration to collected required logs. Heard that they are changing this approach, looking forward to same.

- Integration with systems like JIRA and other ticketing systems have issues. Again in roadmap to fix.

- Some of the updates require configuration change at the app end, which is hard to implement as it requires coordination with app teams - very hard to adopt to new enhancements.

- Technical support could be improved, slowly seeing the quality of support going down.

- For certain frameworks and app servers, vulnerabilities within commercial app server/framework is getting reported - kind of mess if it's one of the unsupported framework. Review collected by and hosted on G2.com.

AF

Verified User in Financial Services

Mid-Market (51-1000 emp.)

9/30/2021

"Great Tool - Easy to setup - Great Support"

4.5/5

What do you like best about Contrast Security?

As an administrator, the tool being saas, I do not have to worry about the server and I just need to take care of the agents. Installation is easy and the configuration is not much harder. The documentation is well written and you will usually find what you need. For the maintenance, on some machines, I periodically update the agent, which is as simple as executing the installer. In the CI build, with docker image, I always fetch the latest version.

For the developer, they get a warning in our security slack channel when something in their code needs to be "improved".

Support has always been stellar when I needed them for clarification. Review collected by and hosted on G2.com.

What do you dislike about Contrast Security?

There is nothing I dislike about that tool. It does the job we bought it for, in the background, with minimal maintenance. Review collected by and hosted on G2.com.

Recommendations to others considering Contrast Security:

Ask them for a demo, try it out on your product. You will be surprised how good it is. Review collected by and hosted on G2.com.

What problems is Contrast Security solving and how is that benefiting you?

The developers get feedback on their code quickly, and they can fix it while it is fresh in their memory. You end up with a better, more secure application. Review collected by and hosted on G2.com.