# What is Runtime Application Self-Protection (RASP)?

> Runtime application self-protection (RASP) is a variable industry category for controls integrated with or closely coupled to an application’s runtime so they can observe execution context and detect, report, or block selected malicious behavior while the application runs.

- Canonical URL: https://yellowcube.eu/glossary/runtime-application-self-protection/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Implementations may use instrumentation, agents, libraries, runtime hooks, or framework integration. The label does not define one architecture, detection method, enforcement scope, or assurance level.

Because a RASP control can observe application execution, it may connect a request with code paths, queries, data handling, identities, or exceptions that an external control cannot see. Products and implementations differ between monitoring, blocking, and application-specific response.

### Key points

- **Placement and scope:** Document supported runtimes, applications, code paths, inputs, attack classes, operating modes, and any behavior that the control cannot inspect or safely interrupt.
- **Safe operation:** Test detection and blocking against representative traffic, measure latency and resource use, protect policy and management access, stage enforcement, and define fail-open, fail-closed, rollback, and evidence-handling behavior.
- **Validation:** Confirm claimed detections with reproducible tests, monitor false positives and false negatives, reassess after application or runtime changes, and ensure alerts reach an accountable response process.
- **Important limitation:** RASP does not repair vulnerable code or make the application secure. It can be bypassed, misconfigured, or impaired by unsupported paths, and runtime instrumentation can affect performance or stability.

### Related terms

[Application security](<https://yellowcube.eu/glossary/application-security/>) · [Web application firewall (WAF)](<https://yellowcube.eu/glossary/web-application-firewall/>) · [Virtual patching](<https://yellowcube.eu/glossary/virtual-patching/>) · [Dynamic application security testing (DAST)](<https://yellowcube.eu/glossary/dynamic-application-security-testing/>) · [Vulnerability management](<https://yellowcube.eu/glossary/vulnerability-management/>)

### Sources

[NIST SP 800-53 Release 5.2.0, control SI-7(17)](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) · [OWASP AppSensor](https://owasp.org/www-project-appsensor/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.