RASP, or Runtime Application Self-Protection, is a security technology that is embedded within or tightly integrated into an application so that it can detect and block attacks in real time, from inside the application itself, as it runs. Unlike defenses that sit at the network perimeter and inspect traffic before it reaches the application (such as firewalls and web application firewalls), RASP operates within the application’s runtime environment, giving it deep visibility into the application’s actual behavior, data flow, and context. This “self-protection” capability means the application can defend itself against threats as they occur, rather than relying solely on external controls.
The key advantage of RASP is context. Because it runs inside the application, RASP can see not just the incoming request but how that request is actually processed – what code executes, what data is accessed, what queries are run, and what the application’s internal state is. This allows it to distinguish genuine attacks from benign traffic more accurately than perimeter tools that see only the request. For example, RASP can observe that a particular input is about to be used in a database query in a way that would constitute SQL injection, or that a request is triggering unexpected and dangerous behavior, and block it at the moment of execution. This internal vantage point can reduce false positives and catch attacks that evade perimeter defenses.
RASP can detect and respond to a range of threats, including injection attacks, and can take actions such as terminating a session, blocking a request, or alerting security teams when malicious behavior is detected. Because it is integrated with the application, it protects the application wherever it runs and does not depend on network topology.
RASP is often discussed alongside other application security approaches. It complements static and dynamic testing (SAST, DAST, IAST), which find vulnerabilities before deployment, by providing protection at runtime for applications in production. It also complements perimeter defenses like WAFs, adding an inside-the-application layer to a defense-in-depth strategy.
RASP has limitations. It requires integration into the application (which may involve performance overhead and language/platform support), and, like many tools focused on recognizable attack patterns, it may not fully address business-logic and authorization vulnerabilities – such as Broken Object Level Authorization or abuse of legitimate functionality – where requests are valid and the problem lies in entitlement or intent rather than a technically malicious payload. For APIs specifically, protecting against these logic-based risks generally requires context and understanding of API behavior that goes beyond traditional RASP capabilities. Nonetheless, RASP is a valuable runtime protection layer that leverages its position inside the application to detect and stop many attacks with high accuracy, contributing to a layered defense.