What Is Runtime Self-Protection (RASP)?
On this page
Runtime Application Self-Protection (RASP) builds security into a running application so it can detect and block attacks from the inside. Unlike a WAF, which inspects traffic from outside and guesses at intent, RASP lives within the app and sees the actual execution — the real query, the real user, the exact code path. That context lets it judge whether an attack is genuinely happening.
How does RASP work?#
RASP instruments the application (via agents, libraries, or runtime hooks) so it can observe security- relevant operations as they happen — a database query about to run, a file about to be opened, a command about to execute. When input would turn a legitimate operation into an attack (an injection reaching the query), RASP can block it with full knowledge of the context, not just a pattern match.
RASP vs WAF#
| WAF | RASP | |
|---|---|---|
| Position | In front of the app | Inside the app |
| Sees | HTTP traffic | Actual execution and context |
| Precision | Pattern-based, more false positives | Context-aware, fewer |
| Deployment | Simple, app-agnostic | Requires integration |
| Coverage | Any app behind it | The instrumented app |
The trade-off is deployment complexity: a WAF protects anything behind it with no code changes, while RASP must be integrated into each application — but rewards that with far better precision.
RASP is defense embedded in the application runtime. More at the Defense & Hardening hub.
Frequently asked questions#
What is RASP?
Runtime Application Self-Protection (RASP) instruments an application from the inside so it can monitor its own execution and block attacks in real time. Because it runs within the app, it has full context — the actual query, the real user, the exact code path — letting it detect exploitation more precisely than an external filter that only sees traffic.
How is RASP different from a WAF?
A WAF sits in front of the application and inspects HTTP traffic from the outside, matching patterns without knowing what the app will do with a request. RASP runs inside the application and sees the actual execution, so it can tell whether input truly reaches a dangerous operation. RASP has more context; a WAF is simpler to deploy.