No more typing reviews! Try our Samantha, our new voice AI agent.

Contrast Security Assess pros and cons

Vendor: Contrast Security

4.3 out of 5

12 reviews
100% willing to recommend

Pros & Cons summary

Contrast Security Assess offers unmatched accuracy in vulnerability detection, minimizing false positives and reducing costs while enhancing security posture with runtime analysis. Continuous monitoring promotes careful use of third-party libraries. API interfaces enable efficient integration and management, yet the program lacks coverage for technologies like PHP and does not support all client-side libraries. Additionally, scalability issues and cumbersome upgrade processes, combined with limited support and troubleshooting, pose challenges for tech buyers.

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.

Prominent pros & cons

PROS

Contrast Security Assess demonstrates unparalleled accuracy in identifying vulnerabilities, minimizing false positives and providing comprehensive detection.

Continuous monitoring within Contrast Security Assess delivers real-time feedback, changing development culture by prioritizing thoughtful use of third-party libraries.

Contrast Security Assess significantly decreases development and security assessment time, substantially reducing costs.

Contrast Security Assess provides a unique runtime analysis capability, enhancing overall security posture and trust among customers.

Embedded API interfaces in Contrast Security Assess facilitate deeper integration and efficient vulnerability management for development teams.

CONS

Contrast's agent upgrade process is cumbersome, requiring manual downloading and deployment of .jar files.

The level of support and troubleshooting is limited, relying on cumbersome log files.

Contrast does not support all technologies, lacking coverage for some used, such as PHP.

Client-side support is lacking in contrast's OSS feature, missing libraries like jQuery or JavaScript.

The scalability of Contrast is problematic, especially from a commercial perspective.

Contrast Security Assess Pros review quotes

Eucharia Okafor

DevSecOps Engineer at a tech vendor with 1,001-5,000 employees

Jun 12, 2026

Security feedback comes to developers instantly with Contrast Security Assess, reducing costs by about 50%.

Read full review

Lead Application and Data Security Engineer at a insurance company with 5,001-10,000 employees

Aug 1, 2022

Assess has an excellent API interface to pull APIs.

Read full review

reviewer1605099

Director of Threat and Vulnerability Management at a consultancy with 10,001+ employees

Jun 24, 2021

The solution is very accurate in identifying vulnerabilities. In cases where we are performing application assessment using Contrast Assess, and also using legacy application security testing tools, Contrast successfully identifies the same vulnerabilities that the other tools have identified but it also identifies significantly more. In addition, it has visibility into application components that other testing methodologies are unaware of.

Read full review

Contrast Security Assess

Free Report: Contrast Security Assess Reviews and More

Learn what your peers think about Contrast Security Assess. Get advice and tips from experienced pros sharing their opinions. Updated: June 2026.

900,747 professionals have used our research since 2012.

Mustufa Bhavnagarwala

CyberRisk Solution Advisor at a consultancy with 10,001+ employees

Nov 27, 2023

When we access the application, it continuously monitors and detects vulnerabilities.

Read full review

RR

Senior Security Architect at a tech services company with 5,001-10,000 employees

Jun 7, 2020

We use the Contrast OSS feature that allows us to look at third-party, open-source software libraries, because it has a cool interface where you can look at all the different libraries. It has some really cool additional features where it gives us how many instances in which something has been used... It tells us it has been used 10 times out of 20 workloads, for example. Then we know for sure that OSS is being used.

Read full review

AK

Senior Manager of Information Security at Kaizen Gaming

May 2, 2023

I am impressed with the product's identification of alerts and vulnerabilities.

Read full review

AK

Aggelos Karonis

Technical Information Security Team Lead at Kaizen Gaming

Sep 14, 2020

In our most critical applications, we have a deep dive in the code evaluation, which was something we usually did with periodic vulnerability assessments, code reviews, etc. Now, we have real time access to it. It's something that has greatly enhanced our code's quality. We have actually embedded a KPI in regards to the improvement of our code shell. For example, Contrast provides a baseline where libraries and the usability of the code are evaluated, and they produce a score. We always aim to improve that score. On a quarterly basis, we have added this to our KPIs.

Read full review

reviewer1383270

Manager at a consultancy with 10,001+ employees

Jul 7, 2020

The most valuable feature is the continuous monitoring aspect: the fact that we don't have to wait for scans to complete for the tool to identify vulnerabilities. They're automatically identified through developers' business-as-usual processes.

Read full review

reviewer1361742

Director of Innovation at a tech services company with 1-10 employees

Jun 2, 2020

The accuracy of the solution in identifying vulnerabilities is better than any other product we've used, far and away. In our internal comparisons among different tools, Contrast consistently finds more impactful vulnerabilities, and also identifies vulnerabilities that are nearly guaranteed to be there, meaning that the chance of false positives is very low.

Read full review

PD

Founder at a tech services company with self employed

May 2, 2023

It is a stable solution...Contrast Security Assess is one of the first players in this market, so they have experience and customers, especially abroad. Overall, it's a good product.

Read full review

Show 2 more reviews (out of 12)

Contrast Security Assess Cons review quotes

Eucharia Okafor

DevSecOps Engineer at a tech vendor with 1,001-5,000 employees

Jun 12, 2026

Contrast Security Assess could improve in the reporting and the dashboard experience.

Read full review

Lead Application and Data Security Engineer at a insurance company with 5,001-10,000 employees

Aug 1, 2022

The out-of-the-box reporting could be improved. We need to write our own APIs to make the reporting more robust.

Read full review

reviewer1605099

Director of Threat and Vulnerability Management at a consultancy with 10,001+ employees

Jun 24, 2021

To instrument an agent, it has to be running on a type of application technology that the agent recognizes and understands. It's excellent when it works. If we're using an application that is using an unsupported technology, then we can't instrument it at all. We do use PHP and Contrast presently doesn't support that, although it's on their roadmap. My primary hurdle is that it doesn't support all of the technologies that we use.

Read full review

Contrast Security Assess

Free Report: Contrast Security Assess Reviews and More

Learn what your peers think about Contrast Security Assess. Get advice and tips from experienced pros sharing their opinions. Updated: June 2026.

900,747 professionals have used our research since 2012.

Mustufa Bhavnagarwala

CyberRisk Solution Advisor at a consultancy with 10,001+ employees

Nov 27, 2023

The solution should provide more details in the section where it shows that third-party libraries have CVEs or some vulnerabilities.

Read full review

RR

Senior Security Architect at a tech services company with 5,001-10,000 employees

Jun 7, 2020

Contrast Security Assess covers a wide range of applications like .NET Framework, Java, PSP, Node.js, etc. But there are some like Ubuntu and the .NET Core which are not covered. They have it in their roadmap to have these agents. If they have that, we will have complete coverage.

Read full review

AK

Senior Manager of Information Security at Kaizen Gaming

May 2, 2023

The product's retesting part needs improvement. The tool also needs improvement in the suggestions provided for fixing vulnerabilities. It relies more on documentation rather than on quick fixes.

Read full review

AK

Aggelos Karonis

Technical Information Security Team Lead at Kaizen Gaming

Sep 14, 2020

Personalization of the board and how to make it appealing to an organization is something that could be done on their end. The reports could be adaptable to the customer's preferences.

Read full review

reviewer1383270

Manager at a consultancy with 10,001+ employees

Jul 7, 2020

Regarding the solution's OSS feature, the one drawback that we do have is that it does not have client-side support. We'll be missing identification of libraries like jQuery or JavaScript, and such, that are client-side.

Read full review

reviewer1361742

Director of Innovation at a tech services company with 1-10 employees

Jun 2, 2020

Contrast's ability to support upgrades on the actual agents that get deployed is limited. Our environment is pretty much entirely Java. There are no updates associated with that. You have to actually download a new version of the .jar file and push that out to your servers where your app is hosted. That can be quite cumbersome from a change-management perspective.

Read full review

PD

Founder at a tech services company with self employed

May 2, 2023

The solution needs to improve flexibility...The scalability of the product is a problem in the solution, especially from a commercial perspective.

Read full review

Show 2 more reviews (out of 12)

Product Categories

Product Categories

Static Application Security Testing (SAST)

Application Security Tools

Popular Comparisons

Popular Comparisons

SonarQube vs Contrast Security Assess

Snyk vs Contrast Security Assess

Checkmarx One vs Contrast Security Assess

GitLab vs Contrast Security Assess

Veracode vs Contrast Security Assess

CrowdStrike Falcon Cloud Security vs Contrast Security Assess

PortSwigger Burp Suite Professional vs Contrast Security Assess

Acunetix vs Contrast Security Assess

Coverity Static vs Contrast Security Assess

Mend.io vs Contrast Security Assess

Sonatype Lifecycle vs Contrast Security Assess

OpenText Core Application Security vs Contrast Security Assess

GitHub Advanced Security vs Contrast Security Assess

GitGuardian Platform vs Contrast Security Assess

OWASP Zap vs Contrast Security Assess

See all alternatives

Product Categories

Product Categories

Static Application Security Testing (SAST)

Application Security Tools

Popular Comparisons

Popular Comparisons

SonarQube vs Contrast Security Assess

Snyk vs Contrast Security Assess

Checkmarx One vs Contrast Security Assess

GitLab vs Contrast Security Assess

Veracode vs Contrast Security Assess

CrowdStrike Falcon Cloud Security vs Contrast Security Assess

PortSwigger Burp Suite Professional vs Contrast Security Assess

Acunetix vs Contrast Security Assess

Coverity Static vs Contrast Security Assess

Mend.io vs Contrast Security Assess

Sonatype Lifecycle vs Contrast Security Assess

OpenText Core Application Security vs Contrast Security Assess

GitHub Advanced Security vs Contrast Security Assess

GitGuardian Platform vs Contrast Security Assess

OWASP Zap vs Contrast Security Assess

See all alternatives

Related questions

325

What Application Security Solution Do You Use That Is DevOps Friendly?

61

Which is the most comprehensive open source Web Security Testing tool?

88

What is the best Application Security Testing platform?

82

When evaluating Application Security Testing, what aspect do you think is the most important to look for?

123

SAST vs. DAST: Which is better for application security testing?

100

What tools do you rely on for building a DevSecOps pipeline?

190

What does the Log4j/Log4Shell vulnerability mean for your company?

127

Checkmarx or Veracode. Which should we choose?

246

What are your recommended automated penetration testing tools?

101

What are the OWASP top 10 in 2020?