Contrast Protect

Contrast Protect, now rebranded as Contrast ADR (Application Detection and Response), is an enterprise-grade runtime security solution that embeds security directly into applications using instrumentation technology.

What is Contrast ADR (formerly Protect)?

Contrast ADR represents an evolution beyond traditional RASP, operating from within applications to detect and block exploits in real-time using behavioral analysis rather than signature matching.

It works by instrumenting application code at runtime, allowing it to detect and block attacks from within the application itself rather than relying on external network-based defenses.

Unlike traditional WAFs that analyze traffic patterns, Contrast Protect understands application context and can distinguish between legitimate requests and actual attacks with high accuracy.

Key Features

Runtime Attack Prevention

Contrast Protect blocks common attack types in real-time:

• SQL injection
• Cross-site scripting (XSS)
• Command injection
• Path traversal
• SSRF attacks

Virtual Patching

When vulnerabilities are discovered, Contrast Protect can provide immediate protection without requiring code changes or application restarts.

This virtual patching capability is valuable for zero-day vulnerabilities.

Deep Code Instrumentation

The agent instruments the application at the bytecode level, providing visibility into:

• Data flow through the application
• Security-sensitive API calls
• Actual exploitation attempts vs. benign requests

How It Works

Contrast Protect uses the same agent technology as Contrast Assess (IAST).

The agent is deployed alongside the application and monitors security-sensitive operations.

Application Server
    └── Contrast Agent (instrumented)
            ├── Monitors data flow
            ├── Detects attack patterns
            └── Blocks malicious requests

When an attack is detected, Protect can:

1. Block the request entirely
2. Sanitize malicious input
3. Log the event for analysis
4. Alert security teams

Deployment

Contrast Protect is deployed as an agent within the application runtime:

Java applications:

java -javaagent:contrast.jar -jar myapp.jar

Node.js applications:

node -r @contrast/agent app.js

Integration with Contrast Platform

Contrast Protect integrates with the broader Contrast Security platform, sharing data with:

• Contrast Assess (IAST) for development-time testing
• Contrast SCA for dependency analysis
• Contrast Serverless for function protection

When to Use Contrast Protect

Contrast Protect is suitable for organizations that:

• Need runtime protection beyond WAF capabilities
• Want to protect legacy applications without code changes
• Require accurate attack detection with low false positives
• Already use other Contrast Security products