Kontra Application Security Training
Kontra is a developer-focused interactive application security training platform offering hands-on labs covering OWASP Top 10 threats across 25+ languages, with SCORM-compliant content for enterprise LMS deployment and an AI Quiz Builder; it was acquired by Security Compass in 2024 and serves AppSec teams at hundreds of companies globally.
- Company typePrivate
- Founded2020
- HeadquartersLondon, United Kingdom
- Headcount1–10
- GTM typeB2B
- OfferingSoftware
What Kontra Application Security Training does
Kontra Application Security Training is a developer-focused interactive application security training platform, founded in 2020 by Gyan Chawdhary (creator of Codebashing, which was acquired by Checkmarx in 2018) and acquired by Security Compass in 2024. The platform delivers hands-on, browser-based security labs grounded in real-world breach scenarios such as Capital One's SSRF exposure and the Log4j vulnerability, explicitly rejecting gamified quizzes, badge mechanics, and scripted training videos as teaching mechanisms. Content spans 25+ programming languages and frameworks across front-end, back-end, mobile, embedded, and DevOps stacks, with course lines covering OWASP Top 10 for Web, API, LLM (2025), and Kubernetes, alongside compliance training for PCI DSS, HIPAA, SOC2, and ISO27001 obligations.
The product surface includes a cloud-hosted learning management system with SAML/SSO integration across Okta, Azure AD, Google Workspace, Ping Identity, Microsoft AD, SailPoint, OneLogin, and Auth0, plus an LMS API for programmatic learning-data access. A distinctive technical position is the only-known offering of interactive application security training packaged as SCORM 1.2 and SCORM 2004-compliant modules, enabling drop-in deployment into Workday, SAP SuccessFactors, Skillsoft, Docebo, Cornerstone, Saba, Oracle PeopleSoft, Moodle, and 15+ additional enterprise LMS platforms. In 2024 Kontra added an AI Quiz Builder inside the SCORM portal that uses Retrieval-Augmented Generation over its own lab corpus to produce stack-tailored scenario, code-identification, and code-highlighting questions in minutes.
Kontra operates as a wholly-owned subsidiary of Security Compass Technologies Ltd., headquartered in Toronto. Revenue is generated through annual subscription pricing—Squad at $400 for teams of 5–15 developers and Brigade for 16+ developers with volume discounts—plus SCORM content licensing. GTM combines direct enterprise field sales ("Book a Demo"), a 14-day self-serve free trial on OWASP courses, free no-registration Web/API/LLM exercises as top-of-funnel lead magnets, a LinkedIn referral program, and LMS-channel distribution to L&D buyers. The platform reports 50,000+ developers and hundreds of corporate customers including Snap Inc, SoundCloud, Zai, Iress, GitLab, and ShiftLeft.
Kontra Application Security Training firmographics
Firmographics- Name
- Kontra Application Security Training
- Legal name
- Security Compass Technologies Ltd.
- Website
- https://application.security
- Company type
- Private
- Founded year
- 2020
- Operating status
- Operating
- Headcount range
- 1–10 employees
- Short description
- Kontra is a developer-focused interactive application security training platform offering hands-on labs covering OWASP Top 10 threats across 25+ languages, with SCORM-compliant content for enterprise LMS deployment and an AI Quiz Builder; it was acquired by Security Compass in 2024 and serves AppSec teams at hundreds of companies globally.
- Ownership category
- akta.pro rank
Kontra Application Security Training industry classification
Industry- Product category
- Application Security Training
- NAICS
- Software Publishers (5132), Computer Training (61142), Business Schools and Computer and Management Training (6114)
- SIC
- Services-Prepackaged Software (7372), Services-Educational Services (8200)
- akta.pro primary industry
- Secure Software & DevOps Awareness (Secure Coding Basics) (EDABAGAN)
- akta.pro secondary industries
- Cybersecurity Learning Platforms (EDAFANAF), Secure Collaboration & Communication Tools Training (Chat, File Sharing, Video) (EDABAGAK)
Keywords
Where Kontra Application Security Training is headquartered
LocationHeadquarters
- HQ city
- London
- HQ country
- United Kingdom
- HQ region
- Europe
Offices1 record
Markets served
Kontra Application Security Training business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Marketing or Sales, Infrastructure
Revenue model
- Team Subscription Plans: Subscription-based pricing for teams of developers. Plans include Squad (5-15 developers at $400) and Brigade (16+ developers with volume discounts). Includes premium course access, full language and framework coverage, SSO integration, compliance reporting, and SCORM packages.
- SCORM Package Licensing: SCORM-compliant content packages licensed to enterprise customers for deployment on their own LMS infrastructure. Customers can deploy content through their existing enterprise learning management systems.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Squad plan for 5-15 developers at $400 |
| Subscription | Annual | Brigade plan starting from 16 developers |
Go-to-market motion3 records
Distribution channels3 records
Marketing channels4 records
Kontra Application Security Training product offering
Product offeringCore offering
Kontra sells an interactive application security training platform that delivers hands-on labs and simulations rather than videos or multiple-choice quizzes, designed to teach developers to identify and remediate real-world vulnerabilities in modern languages and frameworks. The platform is offered both as a cloud-hosted LMS with SSO and reporting, and as SCORM 1.2/2004 compliant packages deployable into enterprise learning management systems, with an AI Quiz Builder that generates custom stack-specific assessments.
Product overview
Kontra Application Security Training is a developer-first application security training platform built for companies of all sizes, from startups to large enterprises. The core product is the Kontra Application Security Training Platform, which provides interactive hands-on labs and simulations rather than videos or code quizzes. The platform offers SCORM-compliant content that integrates with enterprise Learning Management Systems, and is accompanied by the AI Quiz Builder feature that generates custom security assessments using Retrieval-Augmented Generation. Course offerings include OWASP Top 10 for Web, OWASP Top 10 for API, OWASP Top 10 for LLM - 2025, and OWASP Top 10 for Kubernetes. The platform supports SAML/SSO integration with identity providers and offers two pricing tiers (Squad for 5-15 developers and Brigade for 16+ developers). Kontra is now part of Security Compass following its 2024 acquisition.
Differentiator
Problem solved
Functional benefit
Products and services
- Kontra Application Security Training Platform Interactive, cloud-hosted application security training platform offering hands-on labs and simulations rather than videos or multiple-choice quizzes, with SSO, reporting dashboards, and APIs for enterprise developers and security teams.
- AI Quiz Builder AI-powered quiz generation module that produces custom security assessments tailored to tech stack, vulnerabilities, and difficulty level, including scenario-based multiple choice, code-based vulnerability identification, and code-based line highlighting questions.
- Kontra SCORM Content SCORM 1.2 and SCORM 2004 compliant interactive application security training content that integrates out-of-the-box with enterprise LMS platforms such as Workday, SAP SuccessFactors, Skillsoft, Docebo, and Cornerstone Learning.
- OWASP Top 10 for Web Course Interactive training modules covering OWASP Top 10 web vulnerabilities including SQL Injection, XSS, CSRF, and Command Injection, grounded in real-world vulnerability case studies.
- OWASP Top 10 for API Course Free interactive training teaching developers to identify and mitigate security vulnerabilities in web APIs, covering Broken Object Level Authorization, SQL Injection, XXE, and related risks.
- OWASP Top 10 for LLM - 2025 Course Interactive training covering common security threats and vulnerabilities in Large Language Models based on the OWASP Top 10 for LLMs, including Prompt Injection and Sensitive Information Disclosure.
- OWASP Top 10 for Kubernetes Course All-new interactive course covering OWASP Top 10 for Kubernetes security, released as a free trial offering for developer teams.
- Kontra Cloud LMS Enterprise-grade learning management system purpose-built for application security training, with compliance and reporting dashboards, SAML/SSO integration, team/group management, and API access for programmatic data retrieval.
Quantifiable outcome
- 50,000+ developers trained on the platform
Companies that use Kontra Application Security Training
Customer profileNamed customers6 records
Segments6 records
Ideal customer profiles2 records
Kontra Application Security Training technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration26 records
AI capability4 records
Feature5 records
Kontra Application Security Training partnerships and signals
Strategic signalPartnerships
Eight partnerships are on record, tiered core.
- Security CompasscoreSecurity Compass acquired Kontra's application security training in 2024 to expand its offerings and provide immersive web-based security simulations. Security Compass brings 20 years of application security experience serving finance, technology, and government sectors. Kontra operates as a product under the Security Compass portfolio alongside SD Elements threat modeling solution.
- WorkdaycoreLMS integration partner. Kontra's SCORM-compliant content works out-of-the-box with Workday Learning Management System for enterprise deployment.
- SAP Success FactorscoreLMS integration partner. SCORM-compliant content deployable through SAP SuccessFactors for enterprise training deployment.
- SkillsoftcoreLMS integration partner. Kontra SCORM packages compatible with Skillsoft learning platform for enterprise deployment.
- DocebocoreLMS integration partner. SCORM-compliant content deployable on Docebo platform.
- Cornerstone LearningcoreLMS integration partner. SCORM-compliant content compatible with Cornerstone learning management system.
- OktacoreSSO integration partner. SAML 2.0 compliant identity provider for seamless single sign-on onboarding.
- Azure ADcoreSSO integration partner. Microsoft Azure Active Directory for enterprise identity and access management integration.
Scale indicators4 records
Recent moves7 records
Expansion highlights5 records
Kontra Application Security Training competitors and assessment
Company assessmentBroad incumbents
- KnowBe4: KnowBe4 dominates enterprise security awareness and compliance training. While not developer-focused, KnowBe4's broad LMS/SAML distribution muscle and platform bundling threaten to absorb AppSec training into general security awareness suites at scale.
- SANS Institute: SANS is the largest incumbent in security training, offering broad certifications and courses including SEC540/542 developer-focused AppSec tracks. While SANS is instructor-led and certification-heavy rather than interactive SaaS, it competes for the same enterprise security training budgets and developer upskilling mandates.
- Cybrary: Cybrary is an online cybersecurity training platform with substantial AppSec and secure coding content for individual practitioners and enterprise teams. It competes for the same developer/security engineer learning audience with a broader catalog and subscription pricing.
- Pluralsight: Pluralsight is a broad technology learning platform with extensive security and secure coding course libraries. It frequently appears in enterprise L&D procurement alongside Skillsoft and competes for the same compliance-driven developer training budgets, though its content is video-heavy rather than interactive.
- Hack The Box: Hack The Box offers hands-on cybersecurity training labs for enterprises, with modules covering web application attacks, secure coding, and red-team skills. While broader than AppSec, it competes for the same developer security training budget and uses an interactive lab format similar to Kontra's.
- OffSec (Offensive Security): OffSec is known for OSCP and hands-on offensive security training, with content including secure coding and web application attacks. While more offense-skewed than Kontra, it competes for the same enterprise developer-security training budget with a similarly lab-based learning approach.
Direct peers
- Secure Code Warrior: Secure Code Warrior is the most direct competitor to Kontra, offering an interactive, hands-on developer application security training platform with tournament-style learning, language/framework-specific challenges, and enterprise SSO/SCORM integrations. It competes head-to-head for the same AppSec manager and L&D buyer personas.
- Security Journey: Security Journey provides hands-on application security training for developers and QA teams via a SaaS platform with role-based learning paths. It targets the same developer secure-coding use case as Kontra and sells into enterprise security and L&D buyers.
- Checkmarx (Codebashing): Checkmarx acquired Codebashing—the predecessor product invented by Kontra's founder—in 2018. Checkmarx now bundles Codebashing-style interactive AppSec training with its SAST platform, directly competing with Kontra in enterprise developer security training.
Emerging players
- SafeStack: SafeStack provides application security training specifically built for software development and product teams, with a focus on smaller, fast-moving organizations. It overlaps with Kontra's developer-first positioning and competes for similar SMB and mid-market AppSec training buyers.
Market position
Strengths4 records
Weaknesses5 records
Competitive moat5 records
Key risks6 records
Key highlights7 records
Customer concentration
Kontra Application Security Training social profiles
Digital presenceKontra Application Security Training compliance and trust
Trust signalCompliance4 records
Kontra Application Security Training financial estimates
Financial estimateRevenue estimate
Valuation estimate
Kontra Application Security Training leadership team
Management profileNumber of profiles
Profiles1 record
Kontra Application Security Training funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Kontra Application Security Training M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Kontra Application Security Training
What does Kontra Application Security Training do?
Kontra sells an interactive application security training platform that delivers hands-on labs and simulations rather than videos or multiple-choice quizzes, designed to teach developers to identify and remediate real-world vulnerabilities in modern languages and frameworks. The platform is offered both as a cloud-hosted LMS with SSO and reporting, and as SCORM 1.2/2004 compliant packages deployable into enterprise learning management systems, with an AI Quiz Builder that generates custom stack-specific assessments.
Is Kontra Application Security Training a public or private company?
Kontra Application Security Training is a private company. It is classified as corporate owned and is currently operating.
When was Kontra Application Security Training founded?
Kontra Application Security Training was founded in 2020. It employs 1 to 10 people.
Where is Kontra Application Security Training based?
Kontra Application Security Training is headquartered in London, United Kingdom, in the Europe region.
How does Kontra Application Security Training make money?
Two revenue lines are on record. Team Subscription Plans are the primary driver. The others are SCORM Package Licensing.
Who are Kontra Application Security Training's main competitors?
Broad incumbents on record are KnowBe4, SANS Institute, Cybrary, Pluralsight, Hack The Box and OffSec (Offensive Security). Direct peers are Secure Code Warrior, Security Journey and Checkmarx (Codebashing). SafeStack is listed as an emerging player.
Does Kontra Application Security Training have an API?
Yes. Kontra's LMS API enables customers to programmatically download all learning and progress data for every learner, and use this information in internal dashboards or reporting tools.
What industry is Kontra Application Security Training in?
Kontra Application Security Training's product category is Application Security Training. Its primary akta.pro industry code is EDABAGAN, Secure Software & DevOps Awareness (Secure Coding Basics), with a secondary code of EDAFANAF, Cybersecurity Learning Platforms. Its NAICS code is 5132 and its SIC code is 7372.