# Raven

> Raven is a Runtime Application Protection platform that lives inside the application to stop malicious code execution before it ever runs — with or without a CVE. It uses eBPF-based, function-level runtime analysis to prevent exploits, detect application attacks, control AI agents, and de-prioritize up to 99% of vulnerability noise.

Raven runs inside the application itself, not outside it like traditional WAFs or EDRs. This gives it visibility into real runtime execution at the library and function level, so it can detect when an exploit changes an application's normal execution flow and block it at the moment of execution. The platform works across Kubernetes, containers, and compute instances on AWS, GCP, Azure, and on-prem, and supports Java, Python, Node.js, Go, Ruby, PHP, .NET, Scala, C, and C++. Deployment takes about five minutes with no code injection or instrumentation, and overhead is under 0.2% CPU and under 300MB RAM with all modules active. Raven is SOC 2 compliant and headquartered at 550 California Ave, Palo Alto, CA.

## Product

- [Runtime Prevention](https://raven.io/runtime-prevention): Stops abnormal execution at runtime before malicious code runs — works on known CVEs and on CVE-less attacks like zero-days, malicious packages, and supply chain compromise.
- [Runtime ADR](https://raven.io/runtime-adr): Application Detection and Response — monitors libraries and runtime behavior to detect deviations and exploit attempts at the first step of the kill chain, with full application-level forensics. Positioned as a RASP alternative.
- [Runtime AI-Agents](https://raven.io/runtime-ai-agents): Discovers, monitors, and controls every AI agent operating in the environment — eliminates rogue and shadow AI agents.
- [Runtime SCA](https://raven.io/runtime-sca): Reachability-based software composition analysis that focuses only on vulnerabilities whose code actually executes in production, cutting SCA noise by up to 99% and mapping every vulnerable execution path back to commit, author, build, image, and deployment.
- [Runtime Gatekeeper](https://raven.io/runtime-gatekeeper): CI/CD security gate that blocks builds based on predicted runtime behavior, exploitability, secrets, malware, and license risk — not just CVSS scores.

## Solutions

- [Internet Facing Applications](https://raven.io/solutions/internet-facing-applications): Runtime prevention for public-facing apps — stops exploits and malicious code from ever running inside the application.
- [Application-Aware Cloud Threat Hunting](https://raven.io/solutions/application-aware-cloud-threat-hunting): Threat hunting based on real application execution rather than infrastructure-only signals.
- [Database Protection](https://raven.io/solutions/database-protection): Prevents SQL injection at execution time, before malicious queries reach the database.
- [High-Compliance Environments](https://raven.io/solutions/high-compliance-environments): Runtime enforcement for regulated industries.

## Use Cases

- [Delay a Fix and Stay Protected](https://raven.io/use-cases/delay-a-fix-and-stay-protected): Use runtime prevention to safely defer patching until a planned release, instead of disrupting engineering with hot patches.
- [Eliminate the Exposure Window](https://raven.io/use-cases/eliminate-the-exposure-window): Closes the ~9-day patch lag and ~8-day exploit window between CVE disclosure and vendor fix.
- [CVSS 10 With No Risk](https://raven.io/use-cases/cvss-10-with-no-risk): Demonstrates how a CVSS 10 vulnerability in a non-executed code path carries no real risk under runtime reachability analysis.
- [Stop Attack](https://raven.io/use-cases/stop-attack): How Raven blocks attacks at the moment of execution.
- [Protect Third-Party Applications Independently](https://raven.io/use-cases/protect-third-party-applications-independently): Shields vulnerable libraries in third-party apps without source-code access or vendor patches, using runtime virtual patching plus Runtime ADR.
- [Shift Left](https://raven.io/use-cases/shift-left): Feeds runtime intelligence back into CI/CD to flag vulnerabilities that static checks miss.
- [SBOM & AIBOM](https://raven.io/use-cases/sbom-aibom): Generates Software Bill of Materials and AI Bill of Materials enriched with runtime reachability data.
- [VEX](https://raven.io/use-cases/vex): Adds Vulnerability Exploitability eXchange data to SBOMs/AIBOMs based on function-level runtime reachability, so teams patch only what is actually exploitable.
- [Transitive Dependencies](https://raven.io/use-cases/transitive-dependencies): Visualizes full dependency paths to surface and remediate hidden risks in deep transitive dependencies.
- [Protect AI and LLM Models](https://raven.io/use-cases/protect-ai-and-llm-models): Defends LLM frameworks (LangChain, Auto-GPT, etc.) against malicious-package and supply-chain risks in their dependency stack.

## Company

- [Company](https://raven.io/company): Founders Roi, Guy, and Omer — cybersecurity veterans from Symantec (Broadcom) and elite IDF intelligence units. Raven started as a performance-optimization company and pivoted to cybersecurity after the XZ library backdoor incident exposed a gap in cloud application security.
- [Pricing](https://raven.io/pricing): Plan and pricing information.
- [Book a Demo](https://raven.io/book-a-demo): Schedule a product demo.

## Resources

- [Blog](https://raven.io/blog): Articles on runtime application security, CVE-less threats, eBPF, runtime reachability, and cloud-native security.
- [Resources Center](https://raven.io/resources-center): eBooks, white papers, webinars, customer stories, solution briefs, and analyst reports.
- [The Rise of CVE-Less Attacks (eBook)](https://raven.io/resources-center/cve-less-ebook): eBook on the growth of pre-CVE exploitation and how to adapt protection strategies — the AI exploitation era beyond zero-day.
- [Four Ninjas of the Cloud (eBook)](https://raven.io/ninjas-landing-page): Why Java, Python, Node.js, and Go power 90% of cloud workloads and how to protect them.
- [AI vs WAF (Webinar)](https://raven.io/ai-vs-waf): Webinar showing a Claude Agent bypassing static, signature-based WAFs and how to defend against AI-driven attacks.

## Blog Posts

- [Axios Wasn't Just Compromised. It Was Weaponized.](https://raven.io/blog/axios-wasnt-just-compromised-it-was-weaponized): Analysis of the malicious Axios npm releases as a multi-stage malware campaign using npm install paths as a deployment mechanism.
- [Raven Raises $20M Seed Round](https://raven.io/blog/raven-raises-20m-seed-round-to-protect-applications-at-runtime-even-without-signatures-or-cves): Funding announcement — Raven secures $20M to stop application exploits at runtime even without CVEs or signatures.
- [The Deepest Research on React2Shell (CVE-2025-55182)](https://raven.io/blog/the-deepest-research-on-the-react2shell-cve-2025-55182-and-why-your-waf-rule-patch-leaves-you-exposed): Deep analysis of the React2Shell RCE in the RSC Flight protocol and why WAF rule patches fail to protect modern React and Next.js apps.
- [Reachability, Re-Imagined](https://raven.io/blog/reachability-re-imagined): How a runtime-reachability approach built from the ground up can cut traditional SCA noise by 97%.
- [Debugging eBPF Verifier: Best Practices for High-Performance Kernel Programming](https://raven.io/blog/debugging-ebpf-verifier-best-practices-for-high-performance-kernel-programming): Practical tips on tail calls, maps, helper functions, instruction-count limits, and performance.
- [Why Static Analysis Falls Short in Dynamic Programming Languages](https://raven.io/blog/why-static-analysis-falls-short-in-dynamic-programming-languages): Why static analysis is unreliable for Python, JavaScript, and Ruby.
- [The Need for Runtime ADR](https://raven.io/blog/the-need-for-runtime-adr-if-your-app-is-a-black-box-your-security-strategy-is-too): Why black-box monitoring fails and how Runtime ADR delivers full-stack visibility.
- [Next-Gen Phishing for Developers](https://raven.io/blog/next-gen-phishing-for-developers-the-rise-of-supply-chain-attacks-and-third-party-exploits-in-cloud-security): How attackers exploit developer tools, third-party integrations, and CI/CD pipelines for cloud supply-chain attacks.
- [If It Doesn't Execute, Ignore It](https://raven.io/blog/if-it-doesnt-execute-ignore-it): The five stages of Kubernetes library risk and how runtime analysis eliminates 99% of vulnerability noise.
- [Why It's So Hard to Triage Application Vulnerabilities](https://raven.io/blog/why-its-so-hard-to-triage-application-vulnerabilities): The state of CVE triage for AppSec teams and how runtime context helps.
- [Application Security vs. Product Security](https://raven.io/blog/application-security-vs-product-security): The distinction between AppSec and ProdSec.
- [Runtime Reachability vs. Static Reachability](https://raven.io/blog/runtime-reachability-vs-static-reachability): Comparison of static reachability vs. function-level runtime reachability, and why runtime wins on accuracy and false positives.
- [Analyzing Python rpc.py RCE Exploit Using PANDA (Step-by-Step)](https://raven.io/blog/analyzing-python-rpc-py-rce-exploit-using-panda-step-by-step): Walkthrough of exploiting and analyzing a Python rpc.py RCE vulnerability with PANDA.
- [Alice in Java-land](https://raven.io/blog/alice-in-java-land-an-adventure-with-loaders-the-classpath-and-whimsical-wisdom): Java's class loading explained — dynamic loading, classpath, and custom ClassLoaders.
- [Understanding the Relationship Between Vulnerabilities and Exploits](https://raven.io/blog/understanding-the-relationship-between-vulnerabilities-and-exploits): Why not every vulnerability is exploitable and how to prioritize real threats.
- [eBPF Unleashed: The Future of Runtime Application Security](https://raven.io/blog/ebpf-unleashed-the-future-of-runtime-application-security): How eBPF enables runtime application security.
- [7 Reasons Why Attackers Shifted Towards Cloud Applications](https://raven.io/blog/7-reasons-why-attackers-shifted-towards-cloud-applications): Why attackers moved from infrastructure to applications and what defenders should do.
- [The Critical Need for Cloud Runtime Application Security](https://raven.io/blog/the-critical-need-for-cloud-runtime-application-security): Why "shift left" alone is insufficient and runtime "protect right" is essential.
- [What Are CVE-Less Threats?](https://raven.io/blog/what-are-cve-less-threats): Definition of CVE-less threats — malicious packages, AI package hallucinations, NVD backlog, library misconfigurations, and zero-days — and why they accounted for 70% of exploits in 2023.

## Optional

- [Privacy Policy](https://raven.io/privacy-policy)
- [Terms of Service](https://raven.io/terms-of-services)
- [Terms and Conditions](https://raven.io/terms-and-conditions)