RASP (Runtime Application Self-Protection)

RASP instruments the application runtime — for example via Java agents, .NET CLR hooks or Node.js wrappers — to observe data flow, function calls and security-relevant APIs. When it detects that user-controlled input is reaching a dangerous operation (e.g., a SQL parser, a deserializer, a command executor), it can log, alert or block the request. Unlike a WAF, which sits at the network edge and inspects traffic, RASP has full application context: it knows which user, which session and which code path. RASP is most useful as a last line of defense for high-value applications where signatures and WAF rules struggle, but it adds runtime overhead and complexity.