What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Runtime application self-protection (RASP) monitors an application from inside its runtime and can detect or block some attacks as the application processes them. DZone’s Introduction to RASP is Refcard #283, authored by Jeff Williams, cofounder and CTO of Contrast Security. It remains a useful conceptual introduction, but its examples and product landscape are historical. This guide explains the idea, its limits, how it fits with other security controls, and what to test before deployment.
What is RASP?
RASP stands for runtime application self-protection. It is a security control embedded in, linked to, or otherwise operating alongside an application while that application runs. By observing application-level execution, a RASP product may detect and interrupt operations associated with exploitation.
The key distinction is context. A web application firewall (WAF) primarily evaluates traffic at the network or edge. RASP can observe how the application parses and uses that traffic: which code path handles it, what value reaches a sensitive operation, and what backend call follows. A scanner, by contrast, seeks weaknesses; RASP primarily aims to protect a running application from attacks.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRASP is a category, not one standard architecture. Implementations may use agents, bytecode or binary instrumentation, framework hooks, runtime rules, taint tracking, or other techniques. Their visibility and blocking capabilities therefore vary. The DZone Refcard surveys several architectural approaches rather than prescribing one universal design.
#1 Best Overall
Why application context matters
The same request can be harmless in one application and dangerous in another. Network controls see bytes and protocol behavior; the application may decode, parse, transform, and combine those bytes before using them. A payload’s risk may become apparent only when it reaches a database query, file operation, command interpreter, or outbound network request.
For example, a WAF may flag a suspicious SQL-like string in an HTTP request. A runtime control may instead observe whether a value derived from that request reaches a database operation, and under what conditions. This context can help distinguish attempted attacks from benign input, but it does not guarantee fewer false positives, complete coverage, or resistance to bypass. Those outcomes depend on the product, supported runtime and frameworks, instrumentation, policies, and deployment.
How RASP works
A generic runtime-protection flow looks like this:
input → parsing and transformation → sensitive operation → policy decision → allow, log, or block
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Observe input. Data may enter through an HTTP request, API payload, WebSocket, file, database, message queue, or another source.
- Follow processing. The application parses and transforms the data. Depending on the implementation, an agent may track the data or observe relevant runtime calls.
- Inspect a sensitive operation. Examples include executing a database query, opening a file, invoking a command, deserializing data, or making an outbound request.
- Apply policy. The product decides whether the observed behavior should be permitted, logged, or blocked.
- Send telemetry. Events may be delivered to a product console, SIEM, case-management system, or response workflow.
Waratek’s documentation describes one Java-oriented implementation: its agent observes method calls and arguments, applies rules, can abort disallowed operations, and records events. That is an example of a particular product approach, not a definition of all RASP. See Waratek’s documentation.
Where RASP fits among security controls
RASP complements controls that work at different stages or observe different parts of a system. It does not make them interchangeable.
| Control | Primary role | What it does not establish by itself |
|---|---|---|
| WAF | Filters and evaluates web traffic at an edge, proxy, or application-delivery layer. | Whether the application interpreted a request in a vulnerable way. |
| SAST | Analyzes source, bytecode, or binaries without normal application execution. | Whether a weakness is reachable or exploited in a live deployment. |
| DAST | Tests a running application externally for vulnerabilities. | Complete coverage of every code path or vulnerability. |
| IAST | Observes application behavior during testing and relates activity to code. | Continuous production protection equivalent to RASP. |
| SCA | Identifies software components, versions, licenses, and known dependency vulnerabilities. | That a vulnerable component has been removed or that exploitation is prevented. |
| RASP | Monitors application execution and may detect or block selected exploit behavior. | A complete vulnerability inventory or a fix for the underlying defect. |
| SIEM | Collects and correlates security events across systems. | Application-level prevention unless paired with an enforcement control. |
RASP is not IAST. IAST is primarily a testing and vulnerability-analysis approach; RASP is primarily a runtime protection approach. Some products combine related capabilities, but the evidence and outcomes are distinct. Likewise, blocking an exploit does not remediate the vulnerable code or dependency. The DZone Refcard makes this distinction and frames RASP as one part of defense in depth.
What attacks may RASP address?
Depending on the product and supported stack, runtime controls may target behaviors associated with:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches- SQL or NoSQL injection and command injection;
- path traversal and unsafe file access;
- untrusted deserialization, expression-language injection, or template injection;
- XML external entity (XXE) processing;
- server-side request forgery (SSRF);
- cross-site scripting (XSS), cross-site request forgery (CSRF), or HTTP method tampering;
- regular-expression denial of service and other unsafe runtime operations.
The DZone Refcard also lists OGNL injection and padding-oracle attacks among its use cases. Treat all such lists as potential coverage, not a universal product guarantee. Before relying on a control, verify the specific language, framework, library, operation or sink, and deployment mode. Ask whether protection extends to APIs, asynchronous jobs, message consumers, and backend interfaces, not just web requests.
Rank #3
- Comes with secure packaging
- It can be a gift item
- Easy to read text
What RASP cannot replace
RASP only protects behavior it can observe and instrument. It does not replace secure design, code fixes, dependency patching, identity and access management, secrets management, network segmentation, endpoint security, DDoS protection, TLS management, API inventory and authentication controls, database security, or incident response.
It may offer runtime evidence that an attack reached a sensitive operation, but that is not the same as finding every vulnerability. It cannot be assumed to protect unsupported code, native components outside its visibility, authorization and business-logic mistakes, credential abuse, or attacks that do not pass through the monitored process. Protection against a new or unknown vulnerability is also conditional: a product may stop an exploit if its behavior matches a protected pattern, but no general guarantee of zero-day coverage follows.
RASP can serve as a temporary compensating control while a fix is prepared, but the defect still needs remediation and regression testing. The Refcard also cautions against treating DAST plus RASP as IAST.
RASP and WAF: complementary, not competing by definition
| Question | WAF | RASP |
|---|---|---|
| Typical position | Network edge, reverse proxy, cloud service, or appliance | Inside or attached to the application runtime |
| Primary visibility | Requests, responses, sessions, and protocols | Execution paths, runtime values, sensitive operations, and sometimes backend calls |
| Typical strength | Broad, centralized filtering across applications | Application-specific context and runtime telemetry |
| Typical deployment | Edge or traffic-path configuration | Agent, library, instrumentation, or runtime integration |
| Key trade-off | Can require tuning for application behavior, encoding, and traffic patterns | Can introduce compatibility, overhead, policy, and process-level risks |
The DZone Refcard presents WAF and RASP as controls that can coexist: a WAF can filter broad classes of traffic while RASP assesses behavior within an application. That is a defense-in-depth option, not a requirement. A managed edge control may be sufficient for a simple workload; a WAF may be the practical choice where instrumentation is impossible. Running both also means operating and tuning both, and a RASP agent may be unacceptable where runtime risk outweighs the added context.
How to deploy RASP safely
Two ownership patterns are common. In an operations-led approach, security or operations installs and manages the runtime component through existing automation such as Chef, Puppet, Ansible, or container images. In a DevSecOps approach, the component is incorporated into builds, CI/CD, images, or deployment templates so teams can validate it earlier and promote it through environments. The DZone Refcard discusses both models.
- Inventory the application estate. Record languages, runtime versions, frameworks, application servers, containers, cloud services, APIs, background workers, and native-code boundaries.
- Confirm support before rollout. Check exact versions and integrations with the vendor; do not infer support from a language name alone.
- Install in a representative test environment. Exercise startup, normal workloads, asynchronous paths, connection pools, and application-specific framework behavior.
- Begin in monitoring or log mode. Review events against realistic traffic and identify legitimate operations that could be affected.
- Measure performance and stability. Compare with and without the agent, including tail latency, throughput, CPU, memory, startup time, garbage collection, and behavior under attack traffic.
- Validate block mode outside production. Confirm which operations are interrupted, how events are recorded, and how policy changes affect application behavior.
- Plan rollback and emergency bypass. Document who can disable or change a policy, how to do so without an emergency rebuild, and how to restore the previous state.
- Roll out progressively. Separate detection-only policies from blocking policies, monitor agent health, and connect actionable events to existing ownership and response workflows.
Performance varies by implementation and workload. The Refcard recommends testing with and without RASP; its historical numerical latency range should not be treated as a current industry benchmark. Measure your own applications rather than relying on a generic claim.
What to evaluate in a RASP product
Coverage and deployment fit
- Supported languages, runtime versions, frameworks, libraries, and application servers.
- Coverage for APIs, WebSockets, background jobs, message consumers, containers, serverless, and hybrid or air-gapped environments where relevant.
- Whether installation requires source changes, build changes, runtime flags, or deployment integration.
- How native code, third-party services, and unsupported components are treated.
Detection and blocking evidence
- Whether the product tracks tainted data or relies on observed behavior and rules.
- How it handles encoding, nested parsing, custom frameworks, and application-specific sinks.
- Whether it can show the affected endpoint, code path or stack, operation, and evidence behind a decision.
- How legitimate traffic is tested, how policies are tuned, and what happens when a rule blocks a valid operation.
Performance and operations
- Request latency and tail latency, throughput, CPU, memory, startup time, garbage-collection behavior, and policy-update effects.
- Central policy management, versioning, staged rollout, rollback, role-based access, audit logs, and agent health monitoring.
- Integrations with SIEM, SOAR, ticketing, SSO, and notification systems that your team actually uses.
- Upgrade compatibility, data retention and residency, incident ownership, and the support path for agent failures.
Developer and response workflow
Check whether findings identify the affected application and endpoint, relevant request or event details, source location or stack information, vulnerable component where known, exploitability evidence, remediation guidance, severity based on runtime exposure, and an actionable owner or ticket path. More telemetry is not automatically more useful: deduplication, prioritization, and ownership determine whether alerts can be acted on.
Threat-model the runtime agent
Because RASP operates in or alongside the application process, ask what happens if an attacker gains code execution in that same environment. A 2024 technical analysis discusses Java-specific bypass research involving instrumentation, JVMTI, JNI, repatching instrumented classes, and interference with an agent. It is a secondary technical source and does not establish that every RASP product is vulnerable to the same techniques. Read the analysis as a prompt for product-specific questions.
- Can application code disable or detach the agent, or change its configuration?
- How are agent configuration and policy integrity protected?
- What is the threat model for native libraries, class loaders, debugging, and memory tampering?
- What happens if the agent crashes or loses access to its policy service?
- Does protection cover process integrity, or only selected application operations?
Current terminology and product categories
The DZone Refcard names products including Contrast, Immunio, Prevoty, and Waratek. Those are historical examples, not a current shortlist; do not assume the products remain independently available under the same names or retain the same capabilities.
Some vendors now position runtime protection as part of application detection and response (ADR). Contrast describes ADR as an evolution beyond traditional RASP, a vendor position rather than settled industry terminology. Its current ADR explanation and pricing and packaging page describe its offering; the pricing page states that ADR is priced by concurrent host but does not publish a simple standard dollar price.
Waratek continues to present a Java-focused RASP agent and portal in its product information and documentation. Evaluate its claims against your own workloads rather than treating vendor assertions about detection or false positives as independently established.
Recommended Free Tools
Mobile in-app RASP is a separate category from server-side protection for web applications and APIs. Talsec’s RASP+ offering targets mobile application protection, including Android, iOS, and Flutter. Its listed entry plans and download allowances should be checked on the vendor site for current availability and terms; they do not indicate fit for backend runtime protection.
Imperva is a caution against relying on old product lists. A Thales community notice says Imperva decided to end-of-life its RASP product and pursue migration toward Elastic WAF. Do not treat historical Imperva RASP material as a new-purchase recommendation without confirming support and migration status.
When should you consider RASP?
RASP is worth evaluating when a high-value application faces meaningful exploit risk, runtime evidence would improve response, the stack is supported, and the organization can test, operate, and roll back an agent or instrumentation layer. It may be particularly useful as a compensating control when remediation takes longer than the exposure window, provided the underlying defect is still fixed.
Do not prioritize it simply because it is called runtime protection. It is a poor fit if the main risks are DDoS, credential compromise, authorization or business-logic flaws, or attacks outside application execution; if the stack is unsupported; if instrumentation creates unacceptable operational risk; or if no team can own policy and alerts. Mobile-only requirements may call for an in-app SDK category rather than server-side RASP.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
