Try our new research platform with insights from 80,000+ expert users

Contrast Security Assess pros and cons

Vendor: Contrast Security

4.4 out of 5

11 reviews
100% willing to recommend

Pros & Cons summary

Contrast Security Assess excels in runtime scanning, identifying impactful vulnerabilities with high accuracy and a low rate of false positives. It supports continuous monitoring for real-time vulnerability detection, enhancing development security culture by emphasizing careful third-party library use. However, setup and updates can be cumbersome, with limited technology support, automation challenges, and improvement needed in retesting functionality and vulnerability fixing guidance, especially for technologies like jQuery, .NET Core, and PHP.

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.

Prominent pros & cons

PROS

Contrast Security Assess exhibits superior accuracy in identifying vulnerabilities with minimal false positives compared to other tools.

It uniquely performs runtime scanning which happens as the application routes are being exercised, offering a distinctive advantage in real-time vulnerability assessment.

Contrast Security Assess features continuous monitoring which identifies vulnerabilities automatically during regular developer operations, enhancing the development process.

It helps change development culture by prompting developers to consider the use of third-party libraries more carefully, thus improving security and code quality upfront.

Contrast Security Assess has a robust API interface and is backed by extensive experience and a broad customer base internationally, ensuring reliability and advanced support.

CONS

Contrast's ability to support upgrades on deployed agents is limited, requiring new .jar file downloads and server updates, which complicates change management.

Certain technologies, such as Ubuntu and .NET Core, are not yet covered by Contrast, affecting complete coverage.

Lack of client-side support affects identification of libraries such as jQuery or JavaScript.

Instrumenting agents requires application technology compatibility, limiting support for some technologies like PHP.

Reporting requires custom-built APIs for robustness, needing improvements in flexibility and scalability.

Contrast Security Assess Pros review quotes

reviewer1361742

Director of Innovation at a tech services company with 1-10 employees

Jun 2, 2020

The accuracy of the solution in identifying vulnerabilities is better than any other product we've used, far and away. In our internal comparisons among different tools, Contrast consistently finds more impactful vulnerabilities, and also identifies vulnerabilities that are nearly guaranteed to be there, meaning that the chance of false positives is very low.

Read full review

RR

Senior Security Architect at a tech services company with 5,001-10,000 employees

Jun 7, 2020

We use the Contrast OSS feature that allows us to look at third-party, open-source software libraries, because it has a cool interface where you can look at all the different libraries. It has some really cool additional features where it gives us how many instances in which something has been used... It tells us it has been used 10 times out of 20 workloads, for example. Then we know for sure that OSS is being used.

Read full review

reviewer1380801

Product Security Engineer at a tech services company with 10,001+ employees

Jul 2, 2020

No other tool does the runtime scanning like Contrast does. Other static analysis tools do static scanning, but Contrast is runtime analysis, when the routes are exercised. That's when the scan happens. This is a tool that has a very unique capability compared to other tools. That's what I like most about Contrast, that it's runtime.

Read full review

Contrast Security Assess

Free Report: Contrast Security Assess Reviews and More

Learn what your peers think about Contrast Security Assess. Get advice and tips from experienced pros sharing their opinions. Updated: January 2026.

881,082 professionals have used our research since 2012.

reviewer1383270

Manager at a consultancy with 10,001+ employees

Jul 7, 2020

The most valuable feature is the continuous monitoring aspect: the fact that we don't have to wait for scans to complete for the tool to identify vulnerabilities. They're automatically identified through developers' business-as-usual processes.

Read full review

AK

Aggelos Karonis

Technical Information Security Team Lead at Kaizen Gaming

Sep 14, 2020

In our most critical applications, we have a deep dive in the code evaluation, which was something we usually did with periodic vulnerability assessments, code reviews, etc. Now, we have real time access to it. It's something that has greatly enhanced our code's quality. We have actually embedded a KPI in regards to the improvement of our code shell. For example, Contrast provides a baseline where libraries and the usability of the code are evaluated, and they produce a score. We always aim to improve that score. On a quarterly basis, we have added this to our KPIs.

Read full review

reviewer1494855

Senior Customer Success Manager at a tech company with 201-500 employees

Feb 20, 2021

By far, the thing that was able to provide value was the immediate response while testing ahead of release, in real-time.

Read full review

reviewer1605099

Director of Threat and Vulnerability Management at a consultancy with 10,001+ employees

Jun 24, 2021

The solution is very accurate in identifying vulnerabilities. In cases where we are performing application assessment using Contrast Assess, and also using legacy application security testing tools, Contrast successfully identifies the same vulnerabilities that the other tools have identified but it also identifies significantly more. In addition, it has visibility into application components that other testing methodologies are unaware of.

Read full review

Lead Application and Data Security Engineer at a insurance company with 5,001-10,000 employees

Aug 1, 2022

Assess has an excellent API interface to pull APIs.

Read full review

PD

Founder at a tech services company with self employed

May 2, 2023

It is a stable solution...Contrast Security Assess is one of the first players in this market, so they have experience and customers, especially abroad. Overall, it's a good product.

Read full review

AK

Senior Manager of Information Security at Kaizen Gaming

May 2, 2023

I am impressed with the product's identification of alerts and vulnerabilities.

Read full review

Show 1 more reviews (out of 11)

Contrast Security Assess Cons review quotes

reviewer1361742

Director of Innovation at a tech services company with 1-10 employees

Jun 2, 2020

Contrast's ability to support upgrades on the actual agents that get deployed is limited. Our environment is pretty much entirely Java. There are no updates associated with that. You have to actually download a new version of the .jar file and push that out to your servers where your app is hosted. That can be quite cumbersome from a change-management perspective.

Read full review

RR

Senior Security Architect at a tech services company with 5,001-10,000 employees

Jun 7, 2020

Contrast Security Assess covers a wide range of applications like .NET Framework, Java, PSP, Node.js, etc. But there are some like Ubuntu and the .NET Core which are not covered. They have it in their roadmap to have these agents. If they have that, we will have complete coverage.

Read full review

reviewer1380801

Product Security Engineer at a tech services company with 10,001+ employees

Jul 2, 2020

I would like to see them come up with more scanning rules.

Read full review

Contrast Security Assess

Free Report: Contrast Security Assess Reviews and More

Learn what your peers think about Contrast Security Assess. Get advice and tips from experienced pros sharing their opinions. Updated: January 2026.

881,082 professionals have used our research since 2012.

reviewer1383270

Manager at a consultancy with 10,001+ employees

Jul 7, 2020

Regarding the solution's OSS feature, the one drawback that we do have is that it does not have client-side support. We'll be missing identification of libraries like jQuery or JavaScript, and such, that are client-side.

Read full review

AK

Aggelos Karonis

Technical Information Security Team Lead at Kaizen Gaming

Sep 14, 2020

Personalization of the board and how to make it appealing to an organization is something that could be done on their end. The reports could be adaptable to the customer's preferences.

Read full review

reviewer1494855

Senior Customer Success Manager at a tech company with 201-500 employees

Feb 20, 2021

I think there was activity underway to support the centralized configuration control. There are ways to do it, but I think they were productizing more of that.

Read full review

reviewer1605099

Director of Threat and Vulnerability Management at a consultancy with 10,001+ employees

Jun 24, 2021

To instrument an agent, it has to be running on a type of application technology that the agent recognizes and understands. It's excellent when it works. If we're using an application that is using an unsupported technology, then we can't instrument it at all. We do use PHP and Contrast presently doesn't support that, although it's on their roadmap. My primary hurdle is that it doesn't support all of the technologies that we use.

Read full review

Lead Application and Data Security Engineer at a insurance company with 5,001-10,000 employees

Aug 1, 2022

The out-of-the-box reporting could be improved. We need to write our own APIs to make the reporting more robust.

Read full review

PD

Founder at a tech services company with self employed

May 2, 2023

The solution needs to improve flexibility...The scalability of the product is a problem in the solution, especially from a commercial perspective.

Read full review

AK

Senior Manager of Information Security at Kaizen Gaming

May 2, 2023

The product's retesting part needs improvement. The tool also needs improvement in the suggestions provided for fixing vulnerabilities. It relies more on documentation rather than on quick fixes.

Read full review

Show 1 more reviews (out of 11)

Product Categories

Product Categories

Static Application Security Testing (SAST)

Application Security Tools

Popular Comparisons

Popular Comparisons

SonarQube vs Contrast Security Assess

Snyk vs Contrast Security Assess

GitLab vs Contrast Security Assess

Checkmarx One vs Contrast Security Assess

Veracode vs Contrast Security Assess

Coverity Static vs Contrast Security Assess

CrowdStrike Falcon Cloud Security vs Contrast Security Assess

GitHub Advanced Security vs Contrast Security Assess

OpenText Core Application Security vs Contrast Security Assess

OWASP Zap vs Contrast Security Assess

Mend.io vs Contrast Security Assess

Acunetix vs Contrast Security Assess

Sonatype Lifecycle vs Contrast Security Assess

PortSwigger Burp Suite Professional vs Contrast Security Assess

HCL AppScan vs Contrast Security Assess

See all alternatives

Product Categories

Product Categories

Static Application Security Testing (SAST)

Application Security Tools

Popular Comparisons

Popular Comparisons

SonarQube vs Contrast Security Assess

Snyk vs Contrast Security Assess

GitLab vs Contrast Security Assess

Checkmarx One vs Contrast Security Assess

Veracode vs Contrast Security Assess

Coverity Static vs Contrast Security Assess

CrowdStrike Falcon Cloud Security vs Contrast Security Assess

GitHub Advanced Security vs Contrast Security Assess

OpenText Core Application Security vs Contrast Security Assess

OWASP Zap vs Contrast Security Assess

Mend.io vs Contrast Security Assess

Acunetix vs Contrast Security Assess

Sonatype Lifecycle vs Contrast Security Assess

PortSwigger Burp Suite Professional vs Contrast Security Assess

HCL AppScan vs Contrast Security Assess

See all alternatives

Related questions

130

What Application Security Solution Do You Use That Is DevOps Friendly?

14

Which is the most comprehensive open source Web Security Testing tool?

39

What is the best Application Security Testing platform?

16

When evaluating Application Security Testing, what aspect do you think is the most important to look for?

38

SAST vs. DAST: Which is better for application security testing?

30

What tools do you rely on for building a DevSecOps pipeline?

56

What does the Log4j/Log4Shell vulnerability mean for your company?

36

Checkmarx or Veracode. Which should we choose?

70

What are your recommended automated penetration testing tools?

24

What are the OWASP top 10 in 2020?