Contrast Security

Is Mythos the emergency AppSec needed or just a marketing one?

Four AppSec veterans debate it live and they don't fully agree.
→ Why Mythos is making boards pay attention to AppSec for the first time in years
→ Whether that attention is about real risk or just a marketing emergency
→ How attackers use Mythos to find vulnerabilities without source code access
→ Why generating a working exploit is hard but weaponizing it is even harder
→ The Metasploit parallel and what history tells us about how this plays out
→ Why most attacks are opportunistic and what that means for prioritization

3 months ago | [YT] | 0

Contrast Security

Naomi Buckwalter, Product Security at Contrast Security, shows live how a developer can wire a working AI summarization feature into a production application in under a minute, with no pull request, no security review and no SBOM entry — then shows exactly how Contrast Security surfaces it at runtime before the security team ever discovers it manually

3 months ago | [YT] | 0

Contrast Security

James Kavanagh, Founder and CTO of Cyber Vigilance, explains why AI governance has become a core application security control in 2026.

As AI is embedded directly into applications through copilots APIs AI-assisted development and runtime decision-making, traditional AppSec models no longer capture real risk. James breaks down why governance must move from documentation to enforcement and how runtime visibility is required to understand and control AI-driven application behavior.

6 months ago | [YT] | 0

Contrast Security

Jake Milstein speaks with Rémi Lavedrine and Jeff Williams about how a global French luxury company redefined application security across build test and runtime.


WHAT YOU’LL LEARN
--> Why reducing application security to CI/CD pipeline scanning is incomplete and how mature AppSec programs embed security into both development and operations

--> How to think about AppSec architecturally - designing for risk early, not bolting security on after software is built

--> Why one-time testing is not enough - and why continuous security validation is critical in modern DevSecOps environments

--> How IAST in pre-production helps identify real vulnerabilities during actual application behavior and QA testing

--> Why production environments create unique security risk - especially when development teams are no longer actively maintaining applications

--> How runtime protection and virtual patching help secure applications in production while teams work on long-term fixes

6 months ago | [YT] | 0

Contrast Security

In this video, we break down:
🧠 What runtime application security actually is
⚙️ How instrumentation works inside Java, .NET, Node.js and Python
📊 Why runtime dataflow analysis beats static severity scoring
🔎 How Application Vulnerability Monotoring (AVM) finds vulnerable conditions in production
🚨 How Application Detection and Response (ADR) confirms live exploitation
🧱 Why WAF and EDR cannot see inside the app
🪞 How Contrast builds a digital twin of your application
🎯 What “reachable in production” really means
🧹 How runtime reduces false positives to zero
⏱️ Why MTTR drops from months to hours

7 months ago | [YT] | 0

Contrast Security

CISA released a software acquisition tool designed to help vendors prove their security posture to the federal government. On his very first test, Jeff Williams, founder of Contrast Security and creator of the OWASP Top 10, discovered cross-site scripting vulnerabilities throughout the app.

7 months ago | [YT] | 0

Contrast Security

During a POC, a SQL injection vulnerability was identified in production code that had existed for years and was not flagged by multiple scanning tools. The gap was not coverage. It was context.

Static and build-time tooling lacks runtime reachability, execution flow, and attack context. Developers receive large volumes of findings without knowing what is actually exploitable in production.

7 months ago | [YT] | 0

Contrast Security

🚨 Watch AI fix a critical SQL injection in 5 minutes and 11 seconds.

We're introducing Contrast AI SmartFix — it intelligently remediates vulnerabilities in your applications and dramatically reduces your MTTR

This demo shows a critical SQL injection vulnerability. What makes this powerful? This is a confirmed vulnerability pinpointed precisely because Contrast ADR observed its behavior during runtime.

How?
✅ Contrast AI SmartFix — Integrates seamlessly into your existing developer workflows as a GitHub action
✅ Fast automated remediation — The process took 5 min to complete


The result? Clear actionable pull requests with suggested fixes ready for your developers to review.

#DevSecOps #AIRemediation #AICodeSecuity #SQLInjection #ADR

1 year ago | [YT] | 0

Contrast Security

🎯 What you'll learn about MCP server security automation:

✅ How to configure Contrast MCP server with Visual Studio & GitHub Copilot
✅ Real-world SQL injection vulnerability remediation (with actual code fixes)
✅ Complex JNDI/Log4Shell vulnerability patching using AI
✅ Automated security fixes without leaving your IDE
✅ Expert remediation guidance powered by Contrast's security intelligence

1 year ago | [YT] | 0