No more typing reviews! Try our Samantha, our new voice AI agent.

Cisco SecureX [EOL] vs Contrast Security Assess comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cisco SecureX [EOL]
Average Rating
9.0
Reviews Sentiment
8.2
Number of Reviews
13
Ranking in other categories
No ranking in other categories
Contrast Security Assess
Average Rating
8.6
Reviews Sentiment
7.1
Number of Reviews
12
Ranking in other categories
Application Security Tools (31st), Static Application Security Testing (SAST) (26th)
 

Featured Reviews

Alon K - PeerSpot reviewer
CTO & VP of Cyber Solutions, Israel at Rockwell Automation
Gives our customers visibility and they don't have to go multiple management consoles anymore
One of the examples is related to forensics. The forensics are amazing because when you have enrichment, and the solutions talk with each other, when you need it, you have the ability to know everything in the organization: when, why, whatever. With just one click you have information from email, from the endpoint, from the web. Let's say that tomorrow morning, you have a ransom[ware] attack in your organization and you would like to know from which email it came, or where the customer saved the file, even though the incident didn't occur at the same moment. With SecureX, you have Cisco Threat Response inside. [With] one click, you get all of the flow. That's amazing value. That also releases resources for our customers. The customers don't have to connect many systems and try to register the event on each system, or to go to the SIEM and do a correlation. That's the one-stop shop for the customers, and that's amazing.
Eucharia Okafor - PeerSpot reviewer
DevSecOps Engineer at a tech vendor with 1,001-5,000 employees
Continuous in-app security has transformed our development workflow and has reduced manual checks
Contrast Security Assess changes how the team thinks about security. Instead of us waiting for a security audit at the end of any sprint, vulnerabilities surface as developers are writing and testing code. That shift is significant because fixing a bug in development costs more than fixing it later. It captures everything right there and remediates it because it catches vulnerability and remediates immediately while the application is running. It improves our collaboration between development and security teams, as developers get clear actionable findings immediately. We get continuous visibility into our application risk posture. Ultimately, it helps us to shift fast and save money, which is usually a trade-off, but Contrast Security Assess makes both possible. The feature that stands out most to me in Contrast Security Assess is the ability to capture vulnerability while the application is running. Another standout feature is the real-time detection that finds vulnerabilities as code runs. It has fewer false positives and works continuously in the application; you install it and it is there. It captures issues during development quickly and is easily integrated with a CI/CD pipeline, especially if you are using GitLab or GitHub. The real-time detection feature of Contrast Security Assess helps us very well compared to traditional SAST tools. Traditional tools scan from the outside and guess where problems might be. Contrast Security Assess works from the inside because it is embedded into the application. The agent lives inside the running application, allowing it to see exactly what is happening in real-time. This means we are getting accurate alerts instead of a long list of potential issues that require manual investigation. When it comes to the CI/CD pipeline, Contrast Security Assess really shines for our daily work, as it plugs directly into tools like Jenkins, GitHub, or Azure DevOps. When a developer commits code and triggers a build, Contrast Security Assess is already testing it in the background. If there is any vulnerability, the pipeline automatically flags or stops the application before bad code reaches production. This means security becomes everyone's responsibility, not just the security team's, and it gives us real-time, accurate security that fits into how our team already works.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"SecureX takes all the separate pieces of security within your company, adds in intelligence from different sites and services on the internet, and makes them work together."
"It is one of my favorite things that has ever been built."
"SecureX has been keeping our devices safe during the pandemic and we haven't had any major threats that have come in or that have been found on our devices."
"The automation and orchestration tools are the most valuable features."
"The SecureX solution has the best impact for the customer because it has all the visibility of my applications and my users' applications."
"The forensics are amazing because when you have enrichment, and the solutions talk with each other, when you need it, you have the ability to know everything in the organization: when, why, whatever."
"This solution definitely helps us meet our cyber security goals and we haven't had any problems so far."
"Using SecureX, a tool provided by Cisco, we can easily integrate it with many of our other Cisco products such as Cisco ISE and many networking devices."
"One of the key takeaways is that in order to have a secure application, you cannot rely on just the pentest, vulnerability assessments, and the periodicity of the reviews; you need the real-time feedback on that, and Contrast Assess offers that."
"The accuracy of the solution in identifying vulnerabilities is better than any other product we've used, far and away."
"Contrast was a very complete solution; it met all of our technical requirements and it was really the only IAST product that felt like a real product."
"From a percentage perspective, somewhere around 90 percent of the time we used to spend has been given back to our team, because the false positive rate with Contrast is less than 5 percent."
"By far, the thing that was able to provide value was the immediate response while testing ahead of release, in real-time."
"In our most critical applications, we have a deep dive in the code evaluation, which was something we usually did with periodic vulnerability assessments, code reviews, etc. Now, we have real time access to it. It's something that has greatly enhanced our code's quality. We have actually embedded a KPI in regards to the improvement of our code shell. For example, Contrast provides a baseline where libraries and the usability of the code are evaluated, and they produce a score. We always aim to improve that score. On a quarterly basis, we have added this to our KPIs."
"It is a stable solution...Contrast Security Assess is one of the first players in this market, so they have experience and customers, especially abroad. Overall, it's a good product."
"When we access the application, it continuously monitors and detects vulnerabilities."
 

Cons

"If they could make the Cisco Umbrella piece a little bit more advanced or easier to manage, that would help. We use it for filtering and when you compare it to a normal content filter, it lacks some functionality."
"I'm not sure that I would call it a bug, but sometimes the solution is a little slow."
"The automation and orchestration could be simpler."
"Sometimes it's a little slow so that is also something Cisco should check."
"It would be nice if they had a different pricing model. Most of our budget for projects goes towards Cisco."
"I would like it to integrate with another solution, e.g., DNA. I would like it to connect to that solution, but not the security aspect."
"It is good that it provides information. However, I think that there needs to be more actionable items for us based on the information provided."
"what's missing right now is the multi-tenant capability."
"I would like to see them come up with more scanning rules."
"Contrast Security Assess covers a wide range of applications like .NET Framework, Java, PSP, Node.js, etc. But there are some like Ubuntu and the .NET Core which are not covered. They have it in their roadmap to have these agents. If they have that, we will have complete coverage."
"The product's retesting part needs improvement. The tool also needs improvement in the suggestions provided for fixing vulnerabilities. It relies more on documentation rather than on quick fixes."
"Personalization of the board and how to make it appealing to an organization is something that could be done on their end. The reports could be adaptable to the customer's preferences."
"Their level of support and troubleshooting for the product is limited because of how they handle troubleshooting. It's done through a log file that's very cumbersome to work with."
"I think there was activity underway to support the centralized configuration control. There are ways to do it, but I think they were productizing more of that."
"Contrast Security Assess could improve in the reporting and the dashboard experience."
"My primary hurdle is that it doesn't support all of the technologies that we use."
 

Pricing and Cost Advice

"It would be nice if they had a different pricing model. Most of our budget for projects goes towards Cisco."
"It comes free with all Cisco products. So, it is a good price."
"It is free. It can't get any better than that."
"For the value you get, the pricing of the solution is excellent."
"You can spend less money for another solution, but if you really want to have a good solution you have to pay. We are happy that we are getting such a good solution for what we are spending."
"The pricing is the best part of this solution. It is free if you buy Umbrella or Duo Security. It is also a good solution."
"Cisco SecureX is more expensive than Trend Micro. However, considering the integration capabilities with other solutions and the quality of technical support, I believe there's justification for the price difference."
"The pricing is competitive, especially for education institutions. Licensing can be a little bit difficult to navigate, especially with resellers with Cisco, but for us it has been pretty easy."
"For what it offers, it's a very reasonable cost. The way that it is priced is extremely straightforward. It works on the number of applications that you use, and you license a server. It is something that is extremely fair, because it doesn't take into consideration the number of requests, etc. It is only priced based on the number of onboarded applications. It suits our model as well, because we have huge traffic. Our number of applications is not that large, so the pricing works great for us."
"The product's pricing is low. I would rate it a two out of ten."
"The good news is that the agent itself comes in two different forms: the unlicensed form and the licensed form. Unlicensed gives use of that software composition analysis for free. Thereafter, if you apply a license to that same agent, that's when the instrumentation takes hold. So one of my suggestions is to do what we're doing: Deploy the agent to as many applications as possible, with just the SCA feature turned on with no license applied, and then you can be more choosy and pick which teams will get the license applied."
"You only get one license for an application. Ours are very big, monolithic applications with millions of lines of code. We were able to apply one license to one monolithic application, which is great. We are happy with the licensing. Pricing-wise, they are industry-standard, which is fine."
"It's a tiered licensing model. The more you buy, as you cross certain quantity thresholds, the pricing changes. If you have a smaller environment, your licensing costs are going to be different than a larger environment... The licensing is primarily per application. An application can be as many agents as you need. If you've got 10 development servers and 20 production servers and 50 QA servers, all of those agents can be reporting as a single application that utilizes one license."
"I like the per-application licensing model... We just license the app and we look at different vulnerabilities on that app and we remediate within the app. It's simpler."
"The solution is expensive."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
902,417 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
15%
Outsourcing Company
10%
Marketing Services Firm
9%
Computer Software Company
8%
Financial Services Firm
16%
Manufacturing Company
11%
Construction Company
9%
Comms Service Provider
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise7
Large Enterprise3
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise3
Large Enterprise7
 

Also Known As

Kenna.AppSec, Kenna.VI
Contrast Assess
 

Overview

 

Sample Customers

NHS, Rackspace, UNC Pembroke, University of North Carolina at Charlotte, Missing Piece
Williams-Sonoma, Autodesk, HUAWEI, Chromeriver, RingCentral, Demandware.
Find out what your peers are saying about SonarSource Sàrl, Checkmarx, Veracode and others in Application Security Tools. Updated: June 2026.
902,417 professionals have used our research since 2012.