contra-dev.com

What It Is

Kontra by Security Compass is an application security training platform for developers. Kontra was acquired by Security Compass in 2024; Security Compass is headquartered in Toronto, with offices in the United States and the United Kingdom. Rather than relying on traditional video courses or static quizzes, the product focuses on interactive, immersive Web security simulation training based on real enterprise scenarios, helping developers turn industry-relevant skills into practical application security capabilities.

Core Capabilities and Deployment

Based on the available content, Kontra is more accurately described as a “security capability-building” solution rather than a direct protection product. It mainly covers application security training, secure coding, Web security simulations, and shifting DevSecOps left. Security Compass also says its solutions can integrate with existing DevSecOps tools and workflows, and it offers SD Elements, a threat modeling product for developer centers. However, the page does not specify supported integrations, APIs, SSO, LMS connections, reporting, learning progress management, or alerting capabilities, nor does it disclose whether private deployment is supported.

Pricing and Suitable Scale

There are no public plans or unit prices. To request a demo, users need to submit a business email, name, company, job title, number of developers, and country, after which sales will follow up. The form covers developer team sizes from 1-25 to 5001+, and combined with the page’s statement that it serves “organizations of all sizes,” it appears suitable for evaluation by teams ranging from SMBs to large enterprises, especially large organizations in finance, technology, government, and other industries.

Pros and Cons

Its strengths are clear positioning: developer-first, interactive training, and real enterprise scenarios, backed by Security Compass’s years of experience in application security, finance, technology, and government. Compared with training that simply checks a compliance box, Kontra puts more emphasis on engagement and translating learning into skills. The downsides are also obvious: the page is marketing-heavy and lacks key procurement details such as course coverage, vulnerability types, learning paths, assessment methods, compliance certifications, data security, and administrator capabilities. The lack of public pricing also increases the upfront evaluation cost.

Who It’s For and Access from China

Kontra is better suited to mid-sized and large enterprises promoting shift-left security, SDL/DevSecOps, and developer security training, as well as security teams looking to replace dull training materials. The available content provides no evidence about access from mainland China, and payment methods are not disclosed. Before purchasing, it is advisable to confirm network accessibility, contracting entity, payment options, data compliance, and local support. If alternatives are needed, consider comparing Checkmarx Codebashing, Secure Code Warrior, PortSwigger Web Security Academy, OWASP WebGoat, and domestic secure development training services.