Appdome, Contrast Security, Guardsquare and Promon

About Contrast Security

Contrast Security sells an Application and API Security platform built to detect and stop live application-layer attacks. Contrast Security delivers real-time visibility and protection from inside running applications, using patented in-app sensors and a unified platform for Application Detection and Response and Application Security Testing. Contrast Security says that, unlike legacy tools that operate outside the application, it protects software from within.^[4]

The approach rests on runtime instrumentation. Contrast instruments an application from within and observes every method, every request and every attack path as it happens. Contrast also says it reports only verified, exploitable vulnerabilities with a fix attached. The Contrast Graph links active attacks to specific lines of code in real time.^[1][5]

CVE Shield deploys inside running applications without requiring code changes. CVE Shield operates within the application runtime to detect and block exploitation attempts against known vulnerabilities in third-party libraries. CVE Shield starts with Java applications on Linux-based systems. The free tier is limited to one user and up to two applications, and it provides real-time monitoring in observation mode with no automated blocking. Blocking mode is available in the Pro and Enterprise plans. Pro is a flat annual price starting at $750 a month billed annually.^[1][6][7]

Contrast One is a managed Application Security service launched by Contrast Security. Contrast One is available for Application Security Testing and Application Detection and Response.^[8]

Contrast Security was launched by its founder, Jeff Williams. Jeff Williams helped create OWASP in 2001. Contrast names Citizens Bank, Backbase and AARP among the companies that follow his plan. Backbase integrated Contrast Application Detection and Response to gain real-time visibility into attacks on its banking platform. Fortuneo replaced manual testing with Contrast automated, real-time protection.^[4][9]

On data handling, Contrast agents minimize the data collected by reporting only confirmed vulnerabilities to the Contrast Team Server. Contrast hosts its application services and data on Amazon Web Services facilities in the United States, Europe, the UK and Japan.^{[1][4][5][8][9][10][11][12]}

About Guardsquare

Guardsquare sells a suite of mobile app security solutions for businesses across industries. Guardsquare began with its open-source mobile app shrinker, ProGuard. ProGuard is the technology behind the minification of Android applications. Guardsquare offers ProGuard as an open source optimizer to shrink and obfuscate Java and Kotlin apps.^[5][6]

DexGuard secures native Android and cross-platform apps and SDKs with multilayered, polymorphic obfuscation and built-in runtime application self-protection (RASP). iXGuard secures native iOS and cross-platform apps and SDKs with multilayered, polymorphic obfuscation and built-in RASP. Guardsquare says its code hardening and RASP techniques are applied polymorphically and automatically, so no two builds feature the same protections. DexGuard and iXGuard use dozens of code obfuscation, encryption and RASP techniques. DexGuard and iXGuard apply their hardening measures differently with each new build.^[7][8][9]

DexGuard obfuscates each of its integrity checks, so an attacker cannot learn where and how the application detects integrity violations. DexGuard and iXGuard implement a diverse set of environment safety checks, including debugger and emulator detection. DexGuard and iXGuard implement root and jailbreak detections as a layer of mobile application protection. DexGuard and iXGuard operate as command-line, post-build compiler tools, run locally or on a CI/CD server.^[6][8][10]

AppSweep is the Guardsquare app security testing product for finding and addressing security issues in mobile apps and SDKs. Developers can integrate the AppSweep CLI into CI pipelines such as Bitrise, Fastlane, Github and Jenkins to detect issues during development. AppSweep groups findings according to OWASP MASVS. AppSweep performs in-depth code analysis beyond common pattern matching approaches. AppSweep findings are backed by advanced control and data flow analysis and can be augmented through interactive runtime testing. AppSweep Enterprise supports the upload of larger apps and lets teams define automated data retention policies. Guardsquare describes AppSweep as designed for developers and ready for enterprise needs.^[7]

ThreatCast monitors threats to mobile apps and SDKs in real time, adapts security configurations and identifies security gaps and vulnerabilities after publication. ThreatCast provides real-time visibility for Android and iOS apps. ThreatCast provides documented evidence of active runtime defenses for auditors. ThreatCast enables server-to-server integration to inform the application server side about mobile threats. Guardsquare app attestation lets developers ensure that any mobile app calling their APIs is authentic and untampered. Guardsquare says policy-based controls can block automated bots, malicious scripts and non-genuine apps from interaction with backend services. App attestation gathers insights about the behavior of users and their devices, helping security teams fine-tune policies without rebuilding the application.^{[6][8][9][10]}

Guardsquare says it simplifies compliance with PCI MPoC, PSD2, PSD3 and PCI DSS standards by enforcing binary code protection, key encryption and cryptographic app attestation. Guardsquare provides multi-layered code obfuscation, resource encryption and RASP checks to safeguard cardholder data and cryptographic keys in mobile payment and SoftPOS apps. Guardsquare aligns directly with OWASP MASVS and the STRIDE frameworks. Guardsquare says teams can streamline FDA, EU-MDR and ISO compliance by integrating automated mobile security testing, multilayered code protection and real-time threat monitoring into the SDLC. Guardsquare says its guided workflow simplifies mobile app protection for teams.^[10][11]

Guardsquare says its clients include global financial services institutions, medical and healthcare organizations, and gaming, retail and eCommerce companies. Guardsquare says mobile banking apps on unmanaged devices are constantly targeted by advanced malware and account takeover fraud. Guardsquare says it combines mobile app testing with multi-layered protections for FinTech developers to prevent fraud and maintain regulatory compliance. Guardsquare says a cloned or repackaged mobile e-commerce app can let threat actors trick customers into providing sensitive information. Roel Caers is CEO of Guardsquare. Sander Bogaert leads the technical teams at Guardsquare, and joined Guardsquare very early on and built iXGuard from scratch.^{[2][5][8][11][12][13]}

About Promon

Promon sells the Runtime Intelligence Platform for apps, which embeds protection into compiled applications with no source code changes and no SDK. The Promon Runtime Intelligence Platform runs inside every protected application and is not added as an external layer or SDK. Every Promon product is part of the Promon Runtime Intelligence Platform, and each product belongs to one of four capability layers: Enforcement, Data, Intelligence, and Tools. Promon products share the same telemetry, controls, and deployment model, so a buyer can adopt one product or combine many.^[2][3][6]

Shield is the base on which the Promon Runtime Intelligence Platform is built. Shield streams trusted telemetry out of the running app and feeds updated protection policies back in, while Shield continues to act autonomously. Shield protects mobile, desktop, web and SDK apps from the inside, embedded into the compiled build, with no code changes and nothing for a team to rewrite. Promon has worked on runtime app protection and app shielding for two decades. App shielding developed from university research.^[3]

Shield for Mobile secures iOS and Android apps post-compile with no code changes. Shield for Mobile integrates into a CI/CD pipeline and supports all major build systems and frameworks. Shield for Mobile enforces runtime protections that align with global regulations like GDPR, PSD2, DORA, and CCPA. Raiffeisenbank released a new version of its mobile eKonto app. Promon protects Raiffeisenbank's mobile app users against malware and threats related to operating system weaknesses.^[7]

Promon Shield for Desktop builds desktop application security into Windows and macOS apps. Shield for Desktop creates a secure execution environment for apps by blocking unwanted interactions initiated by possible malware residing on the system. Shield for Desktop integrates with existing tooling and supports zero-trust architecture.^[8]

Promon Code Protect protects compiled code from static and dynamic analysis by applying multi-layer obfuscation and encryption post-compile. Code Protect integrates post-compile into any CI/CD pipeline. Promon Data Protect encrypts and isolates sensitive assets inside the app package and on the device. SAROM protects information built into an app, like API keys or certificates, before the app is published. SLS protects data stored on the device, like session tokens. Promon Verify ensures that only genuine, untampered apps can connect to backend APIs. Promon Verify authenticates each request through in-band attestation, confirming the integrity of both the app and its runtime environment. Promon Verify is fully self-hosted and stateless.^[9][10][11]

Promon Control is a runtime configuration layer for Shield for Mobile protected apps. Promon Control is a post-deploy app security runtime control layer that lets teams manage runtime protection after an app is already live. Promon Control is the control plane for Shield for Mobile, allowing for continuous protection, autonomous threat response and granular policy tuning. Promon Insight for App Risk is a device-risk signal layer for mobile apps. Insight for App Risk collects, enriches, and delivers security-relevant signals from inside the app, powered by the in-app protection engine of Promon Shield. Insight for App Risk ranks devices by configurable risk scores. Promon Shield embeds directly into the app, collecting on-device signals like RAT detection, emulator activity, VPN use, active-call detection, and motion anomalies. Teams with an existing fraud platform feed signals directly into it, while teams without one get a purpose-built risk workspace.^[3][12][13]

The telemetry, analytics and decisioning layer can run on prem, as SaaS, or hybrid. Prebuilt connectors feed high fidelity telemetry and decisions into existing SIEM, SOAR and data lake tools. Model Context Protocol endpoints let agents query live app posture and act on the loop, within guardrails that customers set.^[3]

Promon states that it has spent two decades safeguarding global banks, gaming companies, public institutions and media giants. Promon protects payment apps and digital wallets against tampering, API abuse, and device-based fraud. Promon protects citizen-facing apps from tampering, repackaging, and data breaches. Promon protects patient data and prevents unauthorized access, and addresses compliance with healthcare regulations. Promon protects connected vehicle apps and in-car software from reverse engineering, data theft, and unauthorized access.^{[2][3][7][8][9][12][14]}