CISO Tribune

Vendor comparison · 2 companies

Contrast Security vs Promon

Contrast Security sells an Application and API Security platform built to detect and stop live application-layer attacks. Promon sells the Runtime Intelligence Platform for apps, which embeds protection into compiled applications with no source code changes and no SDK. CISO Tribune files both under Application shielding and RASP. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Contrast Security
  • Promon
Contrast Security vs Promon: Products, Customers and Funding Compared
Contrast SecurityContrast Security sells an Application and API Security platform built to detect and stop live application-layer attacks.contrastsecurity.comPromonPromon sells the Runtime Intelligence Platform for apps, which embeds protection into compiled applications with no source code changes and no SDK.promon.io
What it sells
  • Contrast One[8]A managed Application Security service from Contrast Security.
  • Promon Shield for Desktop[4][8]Promon Shield for Desktop builds desktop application security into Windows and macOS apps.
  • Promon Code Protect[4][9]Promon Code Protect protects compiled code from static and dynamic analysis.
  • Promon Data Protect[4][10]Encrypts and isolates sensitive assets inside the app package and on the device.
  • Promon Verify[4][11]Ensures that only genuine, untampered apps can connect to backend APIs.
  • Promon Control[12]Promon Control is a runtime configuration layer for Shield for Mobile protected apps.
  • Promon Insight for App Risk[13]Promon Insight for App Risk is a device-risk signal layer for mobile apps.
Categories
Headquarters
Not stated on its pagesOslo, Norway[1]
Founded
2014[2]Not stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pages
  • June 30, 2026Promon and LexisNexis Risk Solutions announced a strategic alliance to strengthen fraud prevention in mobile apps.[15]
G2 and Gartner Peer Insights
  • G2: listed, seen October 24, 2026[3]
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 10, 2026[5]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Contrast Security sells mainly to security and engineering teams, bringing Dev, AppSec and SecOps around a shared view of what happens inside applications. Its pages say CEOs look to CISOs to solve the problem of application vulnerability breaches, and that more CISOs look to Contrast. The customers it names include a banking platform provider and a financial institution handling sensitive customer data. Contrast One is offered to organizations that lack the resources to build a comprehensive AppSec team.Promon addresses security, fraud, product, and compliance teams. Security teams can respond to new threat intelligence, fraud teams can tighten or relax app-level responses based on live signals, and product teams can enforce upgrade policies. Gaming companies are offered protection against cheaters and reverse engineering, and protection for in-app purchases. The telemetry, analytics and decisioning layer can run on prem, as SaaS, or hybrid.
Last verified
November 2, 2026September 27, 2026

Where they overlap

  • Application shielding and RASP is the primary category of both Contrast Security and Promon.

Where they differ, field by field

  • Contrast Security is also filed under Dynamic application security testing.
  • Contrast Security lists Contrast One. Promon lists Promon Shield for Desktop, Promon Code Protect, Promon Data Protect, Promon Verify, Promon Control and 1 more.
  • Promon is headquartered in Oslo, Norway.
  • Contrast Security was founded in 2014.

How they differ

CISO Tribune files both Contrast Security and Promon under Application shielding and RASP, which is the primary category for each. Contrast Security also appears under Dynamic application security testing. Contrast Security sells an Application and API Security platform that works from inside running applications, using in-app sensors for Application Detection and Response and Application Security Testing. It also sells Contrast One, a managed Application Security service.

Promon sells the Runtime Intelligence Platform, which embeds protection into compiled applications with no source code changes and no SDK. Its products include Promon Shield for Desktop for Windows and macOS apps, Promon Code Protect, Promon Data Protect, Promon Verify, Promon Control and Promon Insight for App Risk. Promon is headquartered in Oslo, Norway. Contrast Security was founded in 2014.

Contrast Security names Backbase, which integrated Contrast Application Detection and Response for visibility into attacks on its banking platform, and Fortuneo, which replaced manual testing with automated protection. Contrast Security hosts its application services and data on Amazon Web Services facilities in the United States, Europe, the UK and Japan. Promon protects the mobile app users of Raiffeisenbank against malware and threats related to operating system weaknesses. On June 30, 2026, Promon and LexisNexis Risk Solutions announced a strategic alliance to strengthen fraud prevention in mobile apps.

What it sells: Contrast Security

What Contrast One does[8]
Contrast One is a managed Application Security service. It is available for Application Security Testing and Application Detection and Response.

What it sells: Promon

What Promon Shield for Desktop does[4][8]
Promon Shield for Desktop builds desktop application security into Windows and macOS apps. Shield for Desktop creates a secure execution environment for apps by blocking unwanted interactions initiated by possible malware residing on the system. Shield for Desktop integrates with existing tooling and supports zero-trust architecture.
What Promon Code Protect does[4][9]
Promon Code Protect protects compiled code from static and dynamic analysis by applying multi-layer obfuscation and encryption post-compile. Encrypts sensitive code and data sections within binaries, preventing attackers from performing static analysis or extracting core logic. Computes hashes and checksums across code regions to detect unauthorized changes.
What Promon Data Protect does[4][10]
Promon Data Protect encrypts and isolates sensitive assets inside the app package and on the device. SAROM protects information built into an app, like API keys or certificates, before the app is published. SLS protects data stored on the device, like session tokens.
What Promon Verify does[4][11]
Promon Verify ensures that only genuine, untampered apps can connect to backend APIs. Promon Verify authenticates each request through in-band attestation, confirming the integrity of both the app and its runtime environment. Promon Verify is fully self-hosted and stateless.
What Promon Control does[12]
Promon Control is a runtime configuration layer for Shield for Mobile protected apps. Promon Control is a post-deploy app security runtime control layer. Teams can update policies, adjust threat responses, and push configuration changes to apps protected by Shield for Mobile without re-shielding, rebuilding, or triggering an app store submission.
What Promon Insight for App Risk does[13]
Promon Insight for App Risk is a device-risk signal layer for mobile apps. Insight for App Risk collects, enriches, and delivers security-relevant signals from inside the app. Insight for App Risk ranks devices by configurable risk scores.

Questions about Contrast Security and Promon

What do Contrast Security and Promon sell?
Contrast Security sells Contrast One. Promon sells Promon Shield for Desktop, Promon Code Protect, Promon Data Protect, Promon Verify, Promon Control and 1 more.
Are Contrast Security and Promon in the same category?
Yes. Application shielding and RASP is the primary category of both on CISO Tribune.
Where are Contrast Security and Promon headquartered?
Promon is headquartered in Oslo, Norway.
When were Contrast Security and Promon founded?
Contrast Security was founded in 2014.
Who are Contrast Security and Promon sold to?
From its own pages, Contrast Security sells mainly to security and engineering teams, bringing Dev, AppSec and SecOps around a shared view of what happens inside applications. Promon addresses security, fraud, product, and compliance teams.
What have Contrast Security and Promon announced recently?
June 30, 2026: Promon and LexisNexis Risk Solutions announced a strategic alliance to strengthen fraud prevention in mobile apps.

About Contrast Security

Contrast Security sells an Application and API Security platform built to detect and stop live application-layer attacks. Contrast Security delivers real-time visibility and protection from inside running applications, using patented in-app sensors and a unified platform for Application Detection and Response and Application Security Testing. Contrast Security says that, unlike legacy tools that operate outside the application, it protects software from within.[4]

The approach rests on runtime instrumentation. Contrast instruments an application from within and observes every method, every request and every attack path as it happens. Contrast also says it reports only verified, exploitable vulnerabilities with a fix attached. The Contrast Graph links active attacks to specific lines of code in real time.[1][5]

CVE Shield deploys inside running applications without requiring code changes. CVE Shield operates within the application runtime to detect and block exploitation attempts against known vulnerabilities in third-party libraries. CVE Shield starts with Java applications on Linux-based systems. The free tier is limited to one user and up to two applications, and it provides real-time monitoring in observation mode with no automated blocking. Blocking mode is available in the Pro and Enterprise plans. Pro is a flat annual price starting at $750 a month billed annually.[1][6][7]

Contrast One is a managed Application Security service launched by Contrast Security. Contrast One is available for Application Security Testing and Application Detection and Response.[8]

Contrast Security was launched by its founder, Jeff Williams. Jeff Williams helped create OWASP in 2001. Contrast names Citizens Bank, Backbase and AARP among the companies that follow his plan. Backbase integrated Contrast Application Detection and Response to gain real-time visibility into attacks on its banking platform. Fortuneo replaced manual testing with Contrast automated, real-time protection.[4][9]

On data handling, Contrast agents minimize the data collected by reporting only confirmed vulnerabilities to the Contrast Team Server. Contrast hosts its application services and data on Amazon Web Services facilities in the United States, Europe, the UK and Japan.[1][4][5][8][9][10][11][12]

Contrast Security on the record

Sources

Contrast Security full record

  1. [1]contrastsecurity.comContrast Security · contrastsecurity.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Contrast security recognized by the 2023 gartner peer insights voice of the customer for application security testing 302008541Contrast Security via PR Newswire · prnewswire.com · published December 7, 2023 · Tier A
  3. [3]Contrast Security Reviews & Product Details - G2G2 · undated page, accessed October 24, 2026 · Tier C
  4. [4]About Us | Get Secure Code Moving | Contrast SecurityContrast Security · undated page, accessed November 3, 2026 · Tier A
  5. [5]Runtime Application Security for AI-Generated Code | Contrast SecurityContrast Security · undated page, accessed November 3, 2026 · Tier A
  6. [6]Protect Applications from CVEs | Contrast SecurityContrast Security · undated page, accessed November 3, 2026 · Tier A
  7. [7]Contrast Security Pricing and Packaging | Application Security Pricing | Contrast SecurityContrast Security · undated page, accessed November 3, 2026 · Tier A
  8. [8]Managed Application Security Launched by Contrast SecurityContrast Security · published October 23, 2024 · Tier A
  9. [9]Customers | Customer Success Stories | Contrast SecurityContrast Security · undated page, accessed November 3, 2026 · Tier A
  10. [10]Contrast Security Honored with Inaugural Wiz Integrations (WIN) Partner AwardContrast Security · published July 30, 2025 · Tier A
  11. [11]Trust Center | Security PracticesContrast Security · undated page, accessed November 3, 2026 · Tier A
  12. [12]CISO Should Prioritize AppSec | Contrast SecurityContrast Security · undated page, accessed November 3, 2026 · Tier A

Promon full record

  1. [1]Promon completes acquisition of codesealer extending protection to web applications and the apis behind themPromon · promon.io · undated page, accessed September 27, 2026 · Tier A
  2. [2]promon.ioPromon · promon.io · undated page, accessed September 27, 2026 · Tier A
  3. [3]Promon Platform | The runtime intelligence platform for app securityPromon · undated page, accessed October 27, 2026 · Tier A
  4. [4]Promon | Runtime app protection and intelligence platformPromon · undated page, accessed October 27, 2026 · Tier A
  5. [5]Promon Shield for Mobile Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed October 27, 2026 · Tier C
  6. [6]Promon products | App security built for every surfacePromon · undated page, accessed November 10, 2026 · Tier A
  7. [7]Promon Shield for Mobile: Always-on mobile app security | PromonPromon · undated page, accessed November 10, 2026 · Tier A
  8. [8]Promon Shield for Desktop: App shielding for Windows & macOS | PromonPromon · undated page, accessed November 10, 2026 · Tier A
  9. [9]Promon Code Protect: Post-compile IP and code protection for mobile apps | PromonPromon · undated page, accessed November 10, 2026 · Tier A
  10. [10]Promon Data Protect: Secure sensitive data and app secrets | PromonPromon · undated page, accessed November 10, 2026 · Tier A
  11. [11]Promon Verify: API trust and attestation for mobile apps | PromonPromon · undated page, accessed November 10, 2026 · Tier A
  12. [12]Promon Control | Post-Deploy Runtime Protection Without Re-ShieldingPromon · undated page, accessed November 10, 2026 · Tier A
  13. [13]Promon Insight for App Risk™ mobile fraud & risk analytics | PromonPromon · undated page, accessed November 10, 2026 · Tier A
  14. [14]Promon solutions | App security by outcome, industry and use casePromon · undated page, accessed November 10, 2026 · Tier A
  15. [15]LexisNexis Risk Solutions and Promon align to strengthen mobile fraud preventionPromon · published June 30, 2026 · Tier A

Spot a factual error? Request a correction.