Contrast Security named leader in IDC DAST assessment

Contrast Security has been named a Leader in the IDC MarketScape assessment for Worldwide Dynamic Application Security Testing, which evaluated 16 vendors.

The recognition places the application security company among the leading suppliers in a market that has moved beyond traditional external scanning tools. Dynamic Application Security Testing, or DAST, has expanded into runtime testing as software teams seek more direct evidence of exploitable weaknesses in applications and APIs.

Contrast said its approach differs from conventional DAST products by placing sensors inside running applications. The sensors track how data moves through code during execution, giving teams visibility into vulnerabilities that external testing tools may miss.

Those same sensors can also operate across development, staging and production environments. This allows security teams to keep monitoring live applications while developers work on fixes, rather than relying solely on scheduled scans.

Market shift

The assessment comes as artificial intelligence changes how security testing is carried out. In the DAST market, AI-driven tools are increasingly used to probe applications from the outside and adapt tests based on how applications and APIs respond.

Against that backdrop, suppliers are trying to show that their products can reduce false positives, provide clearer proof of exploitability and work at scale across large software estates. Contrast argued that its internal runtime view addresses several long-standing complaints about traditional DAST, including limited application context and noisy results.

Contrast said its platform can identify vulnerabilities including weak cryptography, blind injection and server-side request forgery. It added that the system can detect vulnerabilities in open-source libraries and determine whether the vulnerable code is in use, reachable and exploitable.

According to the company, the platform provides detailed findings, including data flow information, stack traces and affected lines of code. It added that the technology can test large numbers of applications and APIs in parallel.

Company view

Jeff Williams commented on the ranking and the direction of the market.

"We believe being named a Leader reflects our strengths in bringing together Dev, AppSec and SecOps to give them a shared view of what is happening inside their applications," said Jeff Williams, Founder and CTO, Contrast Security.

Williams also linked the company's position to changes in software development and security operations.

"As AI reshapes how software gets built, DAST is mission-critical for stopping threats before they spread. Contrast's revolutionary DAST technology can test all your applications, APIs and libraries in parallel without disruption. Your development teams get fully tested patches, not research projects. And if you have vulnerabilities in production, Contrast provides visibility and protection to keep you safe," said Williams.

Broader context

IDC MarketScape assessments are used in the technology sector as comparative studies of suppliers within a given market. The model combines qualitative and quantitative criteria to position companies against one another, giving technology buyers a view of relative strengths and weaknesses.

For Contrast, the placement is likely to strengthen its pitch in a crowded application security market, where vendors are trying to differentiate themselves as software environments grow more complex. Security teams are under pressure to find flaws earlier in development, reduce alert fatigue and maintain protection once applications move into production.

Contrast said its production deployment can also detect and block attacks targeting a known vulnerability while a fix is under way. This gives organisations a compensating control during remediation, which the company said DAST tools alone do not provide.

Contrast focuses on application detection and response, as well as runtime security for applications and APIs. Its products are aimed at developers, application security teams and security operations teams that need a shared view of threats inside running software.

The latest ranking underlines how DAST vendors are repositioning their products around continuous testing, runtime evidence and closer alignment between development and security teams in modern software delivery environments.