.svg)
.svg)
Use case · Prevent Known Exploits
Prevent known exploits.
Verify the protection.
Raven prevents the unauthorized runtime action an exploit depends on, before that action takes place. Validate protection against a relevant exploit and see the policy that enforced it, with runtime evidence of the result.
/ 02 — SCENARIOS
The CVE is known. The application is still running.
SCENARIO A
The fix is waiting for a release
An upgrade needs compatibility testing, approval and deployment. Put verified runtime protection in place while that work moves forward.
SCENARIO B
The fix is outside your control
A vendor application or legacy dependency cannot be updated on your schedule. Protect the covered exploit path without waiting for a code change.
/ 03 — MECHANISM
From a CVE to verified prevention.
1
Choose the relevant exploit
Start with a CVE affecting your workload and a reproducible exploit path.
2
Enforce the protection
Apply a runtime policy that denies the unauthorized action before it takes place, scoped to the relevant workloads.
3
Verify the prevention
Test the exploit against the protected application to verify prevention. Inspect the attempted action, the library chain and the policy that prevented it.
/ 04 — EVIDENCE
Verify protection against the exploit. See prevention in action.
Use a reproducible exploit to verify prevention for a relevant CVE. See the sensitive action Raven prevented, the code behind the attempt, and the policy that denied it before it took place.
3
2
1
1
The code behind the exploit
The relevant library chain in the recorded event.
2
The action Raven prevented
The actual attempted action and its recorded prevention outcome.
3
The policy that enforced it
The policy identifier linked to that same event.
Baseline scenario from Raven's Runtime Exploit Validation Kit — separate from the CVE-less Log4j #4255 reproduction in Use Case 01.
Protection on your schedule.
Enforce protection without modifying application source code.
Scope the policy to the workloads that need it.
Give security and engineering a shared record of the prevented action.
/ 06 — FAQ
Questions before you deploy
What does verified protection mean?
An active policy prevented the unauthorized action required by a reproduced exploit in the tested version and configuration. Runtime evidence identifies the action and policy. The result applies to the exploit path tested.
Can Raven eliminate the exposure window?
An already-active policy can protect a covered exploit path from the moment vulnerable code goes live. If activated later, protection starts then. Verify the path and deployment scope.
Do we still need to patch?
Yes. Patching fixes the underlying flaw. Runtime policy prevents exploitation through validated paths while your team prepares and deploys remediation.
Know the CVE. Verify the protection.
See exploitation prevented, with runtime evidence showing the action denied and the policy that enforced it.
