Contrast Security has announced the launch of Northstar, a security platform update that brings developers, security, and operations teams together to address app security in a more unified way.
“We’re calling this release Northstar because it points the way forward. It helps customers see what was once invisible — adding clarity where there was ambiguity, and light where attackers once hid,” Contrast Security wrote in a blog post.
The platform is powered by the Contrast Graph, which creates a model of an organization’s application and API environment. It maps live attack paths, correlates runtime behavior, and provides insights into how vulnerabilities, threats, and assets are connected.
Northstar provides role-specific views for developers, security, and operations so that each team gets the specific visibility they need before, during, and after an attack.
The platform update also introduced dynamic risk scoring, which updates scores based on factors like exploitability, active threat signals, blast radius, and business sensitivity.
“Instead of a backlog filled with vulnerabilities labelled “critical,” teams get clear, actionable priorities — the small subset that actually poses a threat right now, as the applications and APIs are running,” the company said.
Northstar also integrates with Contrast’s AI agent SmartFix, which can plan the optimal remediation path and take action. It understands context about the attack surface, full data flow, stack traces, HTTP requests, existing security defenses, libraries available, and backend connections.
“Northstar is the culmination of everything we’ve learned about defending modern software,” said Jeff Williams, an OWASP Founder, and founder and CTO of Contrast Security Founder. “We didn’t just bolt together another set of tools—we reimagined AppSec from first principles. By combining runtime observability, real-time graph context, and AI-powered automation, we built a platform that doesn’t just find problems—it understands them, prioritizes them, and helps teams fix them fast. This is the platform I’ve wanted since OWASP’s earliest days—one that doesn’t just generate alerts, but actually defends the software that powers our world.”
Additionally, the Contrast MCP Server allows organizations to feed their security data into AI tooling so that they can connect it up to their own AI agents.
“Contrast’s MCP Server powers AI coding agents to generate fix strategies to rapidly and accurately remediate vulnerabilities that Contrast detects, without ever leaving your IDE,” Contrast wrote.
Flex Agent automates deployment of agents across Java, .NET, Python, and Node.js. It ensures that agents are always updated to the latest version as well.
To make setup easier, Northstar includes Deployment Hub, which is a central command center that provides step-by-step guidance for getting things up and running.
And finally, Northstar integrates with platforms like Splunk, Wiz, and Sumo Logic, and more integrations and partnerships will be announced in the next few weeks, Contrast said.
