.svg)
.svg)
Runtime protection. Without the code injection.
Raven vs RASP
Traditional RASP inspects inputs from inside your application, adding security checks to the work it already does. Raven ADR identifies exploit behavior at the library level and stops dangerous actions through runtime policies, without injecting code into your application.
THE OLD WAY
Traditional RASP
— Security instrumentation in the app runtime
— Inline checks on the request path
— Added latency and stability risk
THE RAVEN WAY
Raven ADR
— No application code injection
— No inline input inspection
— Library-level control
VS
/ 01
RASP puts the checks inside. Your application carries the cost.
To inspect input as it reaches sensitive operations, traditional RASP adds security instrumentation to the application runtime. That architecture brings three costs into production.
01 · PERFORMANCE
Inline checks. Added latency.
Security analysis runs in the execution path. The extra processing consumes CPU and can increase response times as workloads grow. Your application has more work to do before it can finish handling a request.
02 · STABILITY
Injected code. Added stability risk.
The security agent shares your application runtime. Compatibility issues, agent conflicts and bugs can affect the same processes your business depends on.
03 · OPERATIONS
More applications. More integration work.
Different runtimes and frameworks need supported instrumentation. Deployment and upgrades bring compatibility testing and coordination across application teams.
/ 02 — THE DIFFERENCE
Two ways to protect the runtime.
The difference starts with how security connects to the application.
TRADITIONAL RASP
Inspect the input. Inside the application.
RASP follows input into sensitive operations and uses in-app checks to decide whether an action should proceed.
INCOMING INPUT
HTTP
API
QUEUE / FILE
APPLICATION RUNTIME
INPUT INSPECTION · ALLOW OR BLOCK
SENSITIVE OPERATION
Security checks become part of application execution.
Q:
Did suspicious input reach a dangerous sink?
VS
RAVEN ADR
Understand the library. Control the behavior.
Raven observes which libraries and functions execute, traces the call chain behind sensitive actions, and enforces runtime policies on the behavior those libraries cause.
JSON
CRYPTO
TEMPLATE
CLOUD SDK
PROCESS
NETWORK
FILE
SHELL
SYSTEM BOUNDARY
DANGEROUS ACTION BLOCKED BY POLICY
Library-level detection and prevention, without application code injection.
Q:
What ran, what did it do, and should it be allowed?
/ 03 — WHY RAVEN
Know what ran. Stop what should not.
Raven connects application behavior to the library, function and call chain behind it. Security teams can understand the attack and act on the code that caused it.
See the cause.
Trace suspicious activity to the workload, library and execution path behind it. Give your SOC the context to investigate what happened and where it started.
Stop the dangerous action.
Use runtime policies to block risky behavior at the library level, such as an unexpected attempt to launch a shell. Protection can work without a CVE-specific signature.
Deploy without changing application code.
Deploy Raven at the infrastructure level. Get application-level visibility and control without adding security instrumentation to each application runtime.
/ 04 — WHY THIS MATTERS NOW
An exploit can arrive before its CVE.
Much of the code your applications rely on is public. Attackers can study those same open-source components and use increasingly capable AI tools to find weaknesses and develop exploits. A working exploit does not have to wait for a CVE, an advisory or a patch.
Raven focuses on what the code does at runtime. That makes library behavior a basis for protection even when the exploit has no published name.
RESEARCH EXAMPLE
Prevention without a CVE-specific rule.
Raven Research reproduced a Log4j deserialization path that could enable code execution under specific application conditions. Raven blocked the attempted process creation without a CVE-specific rule.
Read the Log4j research
→
/ 05 — COMPARE
What changes when you choose Raven ADR.
WHAT MATTERS
TRADITIONAL RASP
RAVEN ADR
Security model
Input inspection and in-app security checks
Library behavior and execution-path analysis
Application integration
Instrumentation adds security code to the runtime
No application code injection or instrumentation
Performance model
Request-path checks add processing and can add latency
Infrastructure monitoring without an in-app input inspection layer
Stability considerations
Injected instrumentation shares the application runtime
No injected application agent to create instrumentation conflicts
Deployment
Configure and validate instrumentation for supported runtimes and frameworks
Deploy an infrastructure agent; no application code changes
Investigation
Context from instrumented application paths and security checks
Workload, library, function and call-chain context
Prevention
Block actions identified by configured in-app checks
Block dangerous library-attributed behavior through runtime policies
This comparison describes traditional RASP based on in-application instrumentation. Capabilities, coverage and deployment details vary by implementation and environment.
/ 06
Frequently asked questions.
Is Raven ADR another RASP agent?
Raven uses an infrastructure-level agent to observe application execution and attribute behavior to libraries. It does not inject security instrumentation into application code to inspect inputs.
Can Raven prevent attacks, or does it only observe?
Raven combines runtime detection and investigation with policy-based prevention. A policy can block a dangerous action at the system boundary without inserting an input inspection layer into application code.
Does Raven need a known CVE to protect an application?
No. Raven can detect abnormal execution behavior and enforce runtime policies without a CVE-specific signature. The decision is based on the behavior of the running code.
Do developers need to change application code?
No application code changes are required. Raven is deployed through the infrastructure, without adding RASP-style instrumentation to individual applications.
See the library. Stop the exploit.
See how Raven ADR traces an attack to the code behind it and stops dangerous behavior with runtime policies. No application code injection required.
