.svg)
.svg)
Use case · Stop Unknown Exploits
Stop the exploit. Without knowing the vulnerability.
Exploitation can happen before a CVE exists, or through behavior that never receives one. Raven enforces what libraries are allowed to do, blocking unauthorized actions without needing to recognize the underlying vulnerability first.
/ 02 — SCENARIOS
Your application can be exploited without a CVE.
SCENARIO A
Before the vulnerability is published
An attacker finds a weakness before your security tools have a vulnerability record to match. Your application still needs protection.
SCENARIO B
When the behavior is working as designed
A library exposes a legitimate capability. An unsafe integration turns it into an attack path. The danger is in how the code is used, even when no CVE is assigned.
/ 03 — MECHANISM
Know which code is acting.
Control what it can do.
1
Identify the library chain
Raven connects a sensitive action to the libraries and execution path behind it.
2
Evaluate the action
The action is checked against the permissions for that library chain in your application.
3
Block what is not allowed
An unauthorized action can be stopped without first identifying the vulnerability that triggered it.
/ 04 — EVIDENCE
No CVE. No exploit-specific rule. Blocked.
In Raven's reproduction of Log4j #4255, the exploit attempted to launch a process. Raven blocked the action without a CVE mapping or a rule written for that exploit.
3
2
1
1
The library chain
The deserialization path in the Libraries Call Chain panel.
2
The attempted action
The Payload Process field at the top of the event.
3
The blocked outcome
The message stating that the sensor blocked the event via policy.
See how Raven stopped the Jinja exploit
→
"The new reality is that zero-days are inevitable so having Raven blocking execution deviations means real protection"
Pippin Wallace
Security Leader at Favor Delivery
Runtime protection that fits production.
Deploy without modifying application source code.
Enforce prevention policy locally.
See the library, action, and policy behind a block.
/ 06 — FAQ
Questions before you deploy
Does Raven need a CVE or an exploit signature?
No. Prevention evaluates runtime actions against library-level permissions. It does not depend on a published vulnerability identifier.
What actions can Raven block?
Actions such as process execution, file access, and network activity, according to the library chain, active policy, and supported coverage.
How do we confirm coverage for our applications?
Review your languages, platforms, and deployment model with Raven, then validate prevention on the relevant workloads.
See prevention without prior vulnerability knowledge.
