For two decades, application security worked like a home inspection - someone walked the perimeter, scanned from outside, and handed over a list of things that might be wrong. Contrast Security took a different view. Instead of examining software from the outside, it instruments the application from within, embedding sensors directly into the running code so it can see exactly which vulnerabilities sit on paths that actually execute, and block attacks as they happen.
Founded in 2014 by Jeff Williams and Arshan Dabirsiaghi - both veterans of OWASP, the open-source community that gave the industry its shared vocabulary for software risk - the company set out to replace legacy tools that generated more noise than signal. Williams, who authored the OWASP Top 10, remains chief technology officer.
The technical bet is called instrumentation: the same technique performance-monitoring tools use to watch how code behaves, repurposed to watch for attacks. Because Contrast sits inside the process, it can distinguish a reachable flaw from a theoretical one, which cuts down the false positives that lead developers to ignore security tooling altogether.
Today the platform spans the full arc of application security - interactive testing (IAST), static analysis (SAST), software composition analysis (SCA), runtime self-protection (RASP), and, since 2024, Application Detection and Response (ADR). The through-line is consolidation: one agent doing the work of an entire toolchain.
"Companies have invested in detection and response across the network - EDR, NDR, ITDR - but attackers continue to leverage gaps in applications and APIs. ADR closes that critical gap."
Rick Fitz, Chief Executive Officer
