15 best RASP tools for 2026

Security teams do not lose sleep because a scanner flagged another vulnerability in a report. They lose sleep because production applications are already running, already exposed, and changing faster than perimeter controls can follow. A WAF sees what enters the door. It does not see what happens inside the room.

Runtime Application Self-Protection puts detection and blocking inside or near the running application itself. That shift matters most during the moments that count: a zero-day hits before a patch is ready, an attacker probes a third-party component you did not write, or a buyer's security team asks exactly what runtime controls you have in place.

Verizon's 2025 Data Breach Investigations Report found that vulnerability exploitation featured in 20% of breaches, and that 42% of the exploited vulnerabilities it analysed sat in a web application. That is the gap runtime controls are meant to cover while a patch works its way through the release process. This guide compares 15 current RASP and runtime protection tools across deployment model, language support, blocking posture, and operational fit, so you can build or defend a shortlist with confidence.

What's inside

This guide is for security engineers, AppSec leaders, DevSecOps teams, and presales engineers supporting security reviews. Tools were selected to cover:

• Open-source, commercial, platform-native, mobile, browser, and cloud workload options
• Runtime placement: server-side agents, browser integrity, mobile shielding, Kubernetes detection, and WAF-adjacent protection
• Practical evaluation criteria for POC planning, performance testing, and security questionnaire support
• Pricing as each vendor publishes it, and G2 scores as G2 reports them, with the review count behind thin scores stated

One note on composition before the table. RASP has consolidated heavily. Two entries below belong to the same corporate owner, one product has reached the end of its support schedule, and several vendors publish no list pricing at all. Each case is called out where it appears.

TL;DR

• Best open-source RASP starting point: OpenRASP for server-side learning and evaluation
• Best for enterprise application protection: Contrast Protect for runtime agent coverage with application context
• Best for Java and JVM-heavy stacks: Waratek for virtual patching without source code changes
• Best for observability-led runtime security: Datadog Application Security Management or Dynatrace Application Security for teams already in those platforms
• Best for mobile app shielding: Appdome or OneSpan for regulated and consumer-facing mobile apps
• Best for browser JavaScript integrity: Jscrambler for client-side code protection and third-party script governance

What is RASP?

Runtime Application Self-Protection (RASP) is an application security approach that monitors a running application from inside or near its runtime, then detects, alerts on, or blocks malicious behavior using application context rather than only traffic patterns.

Unlike a WAF, which inspects requests before they reach application code, RASP observes what the application is actually doing: which code paths execute, which database queries run, which libraries get called, and whether a request is trying to abuse application behavior. That context lets RASP catch attacks a request filter cannot classify from the request alone, including abuse that arrives inside an authenticated session, or a deserialization payload that looks unremarkable at the edge.

RASP tools can detect attacks including SQL injection, XSS, command injection, path traversal, deserialization exploits, and privilege escalation. They complement, rather than replace, SAST, DAST, WAF, and endpoint controls.

Key capabilities to look for:

• Runtime monitoring and contextual exploit detection
• Alert and block modes with policy tuning
• Language and framework instrumentation (Java, .NET, Node.js, Python, Go, PHP)
• SIEM, DevSecOps, and CI/CD integrations
• Performance controls and audit reporting

RASP versus WAF

These are complementary controls, not substitutes.

Control	Where it runs	What it sees	Best use case
WAF	In front of the application, as a CDN or edge service, reverse proxy, or appliance	HTTP requests and responses, inspected after TLS termination	Block known attack signatures and protocol anomalies at volume
RASP	Inside or adjacent to the application runtime	Request context, code execution, library calls	Detect and block exploitation using application-layer awareness
ADR (Application Detection and Response)	Runtime agent with response capabilities	Behavioral signals across application execution	Modern RASP framing with investigation and triage workflows
Application shielding	Client runtime (browser or mobile)	Code integrity, anti-tampering, runtime environment	Protect distributed client-side code from tampering and reverse engineering

A common misconception is that RASP is needed because a WAF cannot read encrypted traffic. Most WAFs terminate TLS and inspect the decrypted request, so that is not the real difference. The real difference is context. A WAF judges a request on its contents and on reputation signals. RASP watches what that request causes the application to do, which is how it separates a string that merely looks like SQL injection from one that actually reaches a query.

Most mature AppSec programs run WAF and RASP together. WAF handles high-volume filtering in front of the application. RASP adds depth where application context decides whether behavior is actually malicious.

When to use RASP tools

Protect production applications from runtime exploits

Scanning and code review catch issues before deployment. RASP handles the window between detection and patching, which in complex environments can run weeks or months. Teams with Java monoliths, third-party components, or legacy applications benefit most, since those stacks accumulate exploitable surface area faster than development cycles can close it. Check out related coverage of application security testing software for what to run before production.

Support security reviews during enterprise deals

When a buyer's security team asks how your product responds to runtime attacks, static scan reports and SOC 2 attestations only go so far. RASP evidence, showing that your application detects and blocks injection attempts in production, gives technical evaluators a concrete answer. Presales engineers supporting API security conversations often field the same runtime questions.

Add context to AppSec and DevSecOps workflows

RASP alerts become more useful when they connect exploit attempts to affected routes, library versions, and runtime behavior. That context reduces investigation time and helps prioritize which findings actually matter in production. Teams evaluating attack surface management software often discover runtime gaps that RASP fills.

Roll out blocking after monitor mode

Enabling blocking on day one without tuning is how RASP becomes a production incident. Start in observe or monitor mode, measure false positive rates and latency impact, then enable blocking for high-confidence attack classes first. Give operations teams time to review alert volume before expanding coverage. Related guidance for application performance monitoring applies here too: baseline before you block.

RASP tools comparison

The table below covers 15 tools across server-side agents, mobile shielding, browser protection, cloud-native detection, and WAF-adjacent runtime protection.

Three composition notes apply to this lineup. Datadog owns Hdiv, which it acquired in 2022, so rows 5 and 8 share a corporate parent rather than competing independently. Imperva RASP is published on an end-of-life schedule whose final end-of-support date is 31 October 2026, and Imperva itself is now part of Thales. Most vendors here publish no list price, and the pricing column says so rather than estimating.

#	Product	Best for	Key differentiator	Pricing	G2 rating
1	OpenRASP	Open-source RASP evaluation	Embeddable runtime protection engine for Java and PHP	Free, open source	No G2 profile
2	Contrast Protect	Enterprise application runtime protection	Runtime agent with application security context; CVE shields	Custom quote; separate CVE Shield tiers are published	4.5/5 (49 reviews, Contrast platform)
3	Imperva RASP	Existing Imperva estates only; on an end-of-life schedule	LANGSEC techniques; no signatures or learning mode	Contact Thales	5.0/5 (2 reviews)
4	Waratek	Java and JVM protection	Virtual patching without source code changes	Contact vendor	4.7/5 (roughly 10 reviews)
5	Datadog Application Security Management	Observability-led AppSec	Runtime threats tied to APM traces and service context	$31/host/mo (annual) or $36/host/mo monthly	4.4/5 (726 reviews, Datadog platform)
6	Dynatrace Application Security	Runtime security inside observability	Vulnerability and attack insights via OneAgent	$13/mo per 8 GiB host for Runtime Application Protection	4.5/5 (Dynatrace platform)
7	New Relic	AppSec inside observability workflows	Security signals connected to APM telemetry	Free tier; Standard from $10/mo for the first full platform user	4.4/5 (586 reviews, New Relic platform)
8	Hdiv	Datadog customers; sold inside Datadog, not standalone	Runtime dataflow analysis with source file attribution	Sold within Datadog	No reviews on G2
9	K2 Cyber Security	Production application runtime defense	OWASP Top 10 and memory-based attack detection	Contact vendor	Not listed on G2
10	Falco	Cloud-native runtime detection	Open-source eBPF threat detection for Kubernetes and Linux	Free, open source	3 reviews on G2, too few for a meaningful score
11	Jscrambler	Browser JavaScript integrity	LLM-resilient obfuscation and third-party script governance	Contact vendor	4.4/5 (31 reviews)
12	Appdome	Mobile app shielding	No-code CI/CD security builds for Android and iOS	Contact vendor	4.8/5 (99 reviews)
13	OneSpan	Mobile application shielding for regulated industries	App shielding with overlay, jailbreak, and hooking detection	Contact vendor	App shielding has no G2 profile
14	Fastly Next-Gen WAF	WAF-adjacent application protection	Edge-to-origin deployment with application attack visibility	Contact sales	Reviewed under Fastly's Web Application and API Security profile
15	OpenText Fortify Application Defender	Fortify portfolio users needing runtime protection	Runtime protection integrated with Fortify AppSec programs	Contact OpenText	4.1/5 (34 reviews) for OpenText Core Application Security, a different product

The 15 tools in detail

1. OpenRASP

OpenRASP is a free, open-source Runtime Application Self-Protection engine originally developed by Baidu Security. It embeds a detection agent directly into the application runtime, monitoring database queries, network calls, and file system interactions to catch attacks using behavioral context rather than static signatures. The project supports Java and PHP applications and is configurable through JavaScript detection plugins that can push alerts via HTTP, syslog, or Kafka.

Best for: Security engineers who want to evaluate open-source RASP concepts and build proof-of-concept deployments before committing to a commercial platform.

Key features

• Embeddable runtime protection engine for Java and PHP
• Zero-signature threat detection using semantic analysis and request context
• Configurable JavaScript detection plugins
• Detection coverage for SQL injection, command injection, SSRF, XSS, and deserialization
• Alert output to HTTP, syslog, or Kafka

Why choose OpenRASP: OpenRASP is the right starting point for teams that want hands-on experience with runtime instrumentation before evaluating commercial tools. It is not the right fit for teams that need SLAs, enterprise governance, or broad language coverage beyond Java and PHP. Treat it as a learning and evaluation project: the public repository shows no tagged releases, so check commit activity against your own support expectations before relying on it in production.

OpenRASP pricing: OpenRASP is free and open source. The project has no paid tier or commercial license requirement.

2. Contrast Protect

Contrast Protect is the production runtime protection product within the Contrast Security application security platform. It instruments applications using a lightweight agent that monitors behavior from inside the runtime, detecting and blocking injection attacks, CVE exploitation attempts, and other application-layer threats. Supported languages include Java, .NET, .NET Core, Node.js, Ruby, and Python.

Best for: Enterprise AppSec teams that need production runtime coverage across multiple application stacks, with policy tuning and DevSecOps integrations.

Key features

• Runtime attack monitoring and blocking for application-layer threats
• CVE shields and virtual patches without redeployment
• Monitor or block modes per protection rule
• IP denylist and allowlist management
• Support for Java, .NET, Node.js, Ruby, and Python

Why choose Contrast Protect: Strong fit when runtime protection needs to connect with broader code security workflows, including SAST and IAST findings. Teams that want ADR-style investigation capabilities alongside RASP blocking will find the platform coverage useful.

Contrast Protect pricing: Production Protect licensing is quoted per production host on an annual consumption basis, so model your host count before requesting a quote. The published Free and Pro tiers on the Contrast pricing page apply to Contrast CVE Shield, a narrower product, not to Protect: the Free tier covers two applications in observation mode only, and the $750 per month Pro tier, billed annually, adds active blocking for eight applications and is listed as not yet released. Ask Contrast which product a quote covers before comparing figures.

G2 rating: 4.5/5 from 49 reviews. The score covers the Contrast platform rather than Protect alone.

3. Imperva RASP

Imperva RASP embeds runtime protection directly within the application using LANGSEC techniques, detecting and blocking known and zero-day attacks without requiring signature updates or a learning period. Protection deploys through autonomous plugins that sit inside the application, supporting on-premises, cloud, and containerized environments.

Product status, read this first: Imperva RASP is on a published end-of-life schedule. Imperva's October 2024 RASP end-of-life notice sets 31 October 2025 as the end-of-life date for the 4.4.x LTS branch and 31 October 2026 as its end-of-support date, with every earlier 3.x and 4.x release already past end of support. Imperva is also no longer an independent vendor: Thales completed its acquisition of Imperva in December 2023, and Imperva's support community now sits on a Thales domain. Treat this entry as relevant to organisations that already run Imperva RASP and need a migration plan, not as a product to adopt new. Ask Thales directly whether a supported successor is available on your platform before planning any work around it.

Best for: Existing Imperva RASP deployments that need to plan a supported path forward.

Key features

• LANGSEC-based detection without signatures or a learning mode
• Autonomous plugins deploy inside applications
• Blocks application-layer attacks including injection and deserialization
• Supports on-premises, cloud, and container deployments
• Runtime attack visibility and application context

Why choose Imperva RASP: The LANGSEC approach reduces tuning overhead compared with rule-based systems, which is what made it practical for teams that could not dedicate engineering cycles to ongoing policy management. Given the end-of-support dates above, new buyers should weigh that design against the migration work that follows rather than against the alternatives on this list.

Imperva RASP pricing: Pricing now runs through Thales, so contact Thales for any figures.

G2 rating: 5.0/5, from two reviews

4. Waratek

Waratek delivers compiler-based runtime application security for Java applications, covering both pre-production vulnerability detection through IAST and production attack prevention through RASP. Its virtual patching capability lets organizations protect vulnerable Java, Spring, Tomcat, and WebLogic applications without modifying source code or scheduling downtime. Security rules are expressed using ARMR, a declarative policy language.

Best for: Security and engineering teams protecting Java-heavy production applications where patching cycles are slow or source access is limited.

Key features

• Compiler-based IAST with runtime vulnerability reporting
• RASP protection against zero-day and AI-generated attacks
• Virtual patching without source code changes or application restarts
• ARMR declarative security rules
• CI/CD integrations and policy management through a central portal

Why choose Waratek: When Java applications are too critical or too old to patch quickly, Waratek's virtual patching provides production coverage while the development backlog catches up. The compiler-based approach gives deeper runtime visibility than agent-only alternatives for JVM stacks. Scope matters here: Waratek is Java and JVM only, so it covers one stack rather than a mixed estate.

Waratek pricing: Its G2 profile lists two editions, Secure and Elevate, with no figure attached and a note to contact the vendor, and a free trial is offered. Licensing is structured per agent, so count the agents you would deploy before asking for a quote.

G2 rating: 4.7/5. The score rests on roughly ten reviews, so read the individual reviews rather than the headline number.

5. Datadog Application Security Management

Datadog Application Security Management connects runtime application threat detection to Datadog's observability data, so security findings appear alongside APM traces, service maps, and infrastructure metrics. The product detects OWASP Top 10 attacks and protects against suspicious requests in real time, with investigation built around the distributed tracing and runtime context already flowing through the platform. Datadog now markets this capability as App and API Protection, so expect that name on current pricing and documentation pages.

Vendor relationship: Datadog acquired Hdiv Security, entry 8 on this list, in 2022. The two are not independent options.

Best for: DevSecOps teams already running Datadog APM who want application security signals inside their existing operational dashboards and alert workflows.

Key features

• Real-time detection of OWASP and application-layer attacks
• Protection against suspicious requests and bad-actor patterns
• Investigation using distributed traces and runtime context
• APM-linked service and vulnerability context
• Cloud workload and serverless security add-ons available separately

Why choose Datadog ASM: The primary advantage is context proximity. Security findings attach to the same traces and services operations teams already investigate, which cuts the time between detection and triage. Teams not already on Datadog will not realize the same benefit.

Datadog Application Security Management pricing: App and API Protection is priced at $31 per host per month billed annually, or $36 per host per month billed monthly. Serverless application security is priced separately.

G2 rating: 4.4/5 from 726 reviews.

6. Dynatrace Application Security

Dynatrace Application Security delivers runtime vulnerability analysis and attack protection through the same OneAgent that powers Dynatrace observability. The product covers three capability areas: Runtime Vulnerability Analytics for first- and third-party library risks, Runtime Application Protection with active blocking of SQL injection, JNDI injection, command injection, and SSRF, and Security Posture Management for compliance and configuration issues.

Best for: Enterprise teams already standardizing on Dynatrace for observability who want runtime security risk mapped to application services and ownership.

Key features

• Runtime Vulnerability Analytics for first- and third-party components
• Runtime Application Protection with active attack blocking
• Security Posture Management for misconfiguration and compliance
• Service dependency context and risk prioritization
• Integrated with existing Dynatrace OneAgent deployments

Why choose Dynatrace Application Security: Runtime protection deploys through an existing OneAgent without separate instrumentation, which reduces rollout friction for Dynatrace shops. The service ownership mapping lets teams assign risk to the right engineering team quickly.

Dynatrace Application Security pricing: Runtime Vulnerability Analytics is $13 per month per 8 GiB host, billed at $0.00225 per memory-GiB-hour. Runtime Application Protection, the capability that does the blocking, is also $13 per month per 8 GiB host on the same unit. Security Posture Management is $5 per host per month, billed at $0.007 per host-hour, and does not include attack blocking, so do not budget the $5 figure for runtime protection.

G2 rating: 4.5/5. The score covers the Dynatrace platform rather than the security module.

7. New Relic

New Relic is an observability platform that includes application security capabilities alongside APM, infrastructure monitoring, log management, and browser and mobile telemetry. For teams already running New Relic agents, security findings surface within the same dashboards used to investigate performance issues, reducing context switching during incident response. This positions New Relic as observability-first runtime security rather than standalone RASP.

Best for: Engineering-led teams that want application security findings close to performance telemetry, without adding a dedicated security agent.

Key features

• Application performance monitoring with distributed tracing
• Vulnerability visibility and security signal correlation
• Infrastructure, Kubernetes, and log monitoring
• Browser, mobile, and synthetic monitoring
• Service ownership mapping and team-level alert routing

Why choose New Relic: If the team already uses New Relic and wants security findings without a second agent, the platform covers both jobs from one data stream. Teams that need dedicated RASP blocking policies or deep injection prevention should evaluate purpose-built RASP products alongside New Relic.

New Relic pricing: A free tier is available with 100 GB of data ingest per month and one full platform user. On Standard, the first full platform user is $10 per month and each additional one is $99 per month, capped at five. Pro is $349 per full platform user per month on an annual commitment, or $418.80 per user per month pay-as-you-go. Core users are $49 per user per month on both paid tiers, basic users are free and unlimited, and data beyond the free allowance is $0.40 per GB per month. Enterprise pricing requires contacting sales.

G2 rating: 4.4/5 from 586 reviews, covering the New Relic platform.

8. Hdiv

Hdiv provides application security through both RASP and Interactive Application Security Testing (IAST) capabilities, focusing on runtime dataflow analysis to detect security bugs and active attacks. The RASP component protects web applications at runtime, while the IAST engine reports vulnerabilities with source file and line number attribution to give developers actionable context.

Product status, read this first: Hdiv is not an independent vendor. Datadog announced a definitive agreement to acquire Hdiv Security in May 2022 and closed the deal that year, and Hdiv's technology was folded into Datadog's application security line. That makes this entry and entry 5 two products from one company rather than two competing choices, and it means Hdiv is not something you buy standalone today. If the Hdiv capability is what appeals, the route to it is a Datadog conversation.

Best for: Teams already evaluating Datadog who want to understand where the Hdiv dataflow analysis lineage sits in that platform.

Key features

• Runtime application self-protection (RASP) for web apps
• IAST-based runtime dataflow analysis
• Vulnerability reporting with source file and line number
• Application context for attack detection
• Runtime policy controls

Why choose Hdiv: The combination of RASP blocking and IAST-style reporting gave developers more actionable output than alert-only tools, and the code attribution is the part worth asking about. Ask Datadog which parts of that capability are available in the current product rather than treating Hdiv as a separate shortlist entry.

Hdiv pricing: Pricing runs through Datadog, whose published App and API Protection rate is $31 per host per month billed annually.

9. K2 Cyber Security

K2 Cyber Security focuses on application workload protection for web applications and container environments, including runtime defense against OWASP Top 10 attacks and memory-based exploits. The platform covers both production application protection and real-time identification of vulnerable code paths in testing environments, making it relevant across the development-to-production lifecycle.

Product status, read this first: K2 is a small vendor with a thin public footprint. Company trackers still list it as active and privately held, having raised around $6 million, but the most recent dated public news about the company is from 2022 and it has no G2 profile. That is not evidence the company has closed, and it is not evidence it is thriving either. Confirm that K2 is still trading, still shipping releases, and able to support your estate before you spend evaluation time on it.

Best for: Security teams willing to do vendor diligence on a small supplier in exchange for dedicated runtime application defense.

Key features

• Runtime protection for web applications and container workloads
• Detection of OWASP Top 10 and memory-based attacks
• Application behavior analysis at runtime
• Real-time identification of vulnerable code paths
• Security event reporting and policy enforcement

Why choose K2 Cyber Security: Consider K2 when the evaluation requires dedicated runtime application defense rather than an observability platform with security add-ons. The container and Kubernetes workload coverage extends RASP concepts toward cloud-native application environments. See also the application shielding software roundup for adjacent options.

K2 Cyber Security pricing: Contact the vendor for a quote, and ask about support terms and release cadence in the same conversation.

10. Falco

Falco is an open-source cloud-native runtime security tool for detecting abnormal behavior across hosts, containers, Kubernetes, and cloud environments. It captures Linux kernel events through eBPF or kernel modules, applies customizable rules to detect suspicious activity, and alerts on policy violations. Falco occupies a different niche than classic embedded RASP: it protects the environment around applications rather than instrumenting the application runtime itself.

Best for: Cloud-native security and platform teams that need runtime threat detection for containers, Kubernetes activity, and Linux host behavior.

Key features

• Real-time runtime threat detection via eBPF and kernel-module event capture
• Customizable rule-based alerting for Linux, container, and Kubernetes events
• Monitoring of syscalls, Kubernetes API activity, and cloud events
• Plugin-based extensibility and contextual metadata enrichment
• CNCF-hosted open-source project, graduated in 2024

Why choose Falco: Falco is the right pick when the primary runtime risk sits in Kubernetes workload behavior and container activity rather than in application code paths. It is not a substitute for embedded RASP in application runtimes, but it adds a detection layer that agent-based tools miss. Teams evaluating best endpoint protection software often consider Falco as the cloud-native complement.

Falco pricing: Falco is free and open source. Commercial support is available through ecosystem vendors and managed security providers, including Sysdig, which originally created the project. Check individual vendors for pricing.

11. Jscrambler

Jscrambler is a client-side security platform that protects proprietary JavaScript code, governs third-party scripts, and secures sensitive browser data including payment page information. It uses polymorphic obfuscation, which the vendor describes as LLM-resilient, to make code harder to reverse engineer, and runtime anti-tampering controls to detect and respond to manipulation attempts in the browser. The platform addresses Magecart-style attacks, supply chain script risks, and PCI DSS compliance for web applications.

Best for: Organizations protecting browser-side JavaScript code, payment pages, and third-party script supply chains from tampering and data theft.

Key features

• Polymorphic code obfuscation
• Runtime anti-tampering, anti-debugging, and anti-monkey-patching
• Third-party script monitoring and data fencing
• PCI DSS compliance workflows for payment pages
• Webpage integrity monitoring and reporting

Why choose Jscrambler: When the critical runtime is the browser rather than the server, Jscrambler addresses risks that server-side RASP cannot reach. Teams with consumer-facing web applications, payment flows, or heavy JavaScript should evaluate it alongside, not instead of, backend runtime controls.

Jscrambler pricing: Free trials are available, and plan pricing comes from the vendor on request.

G2 rating: 4.4/5 from 31 reviews.

12. Appdome

Appdome is an agentic mobile security platform that builds and maintains runtime application protection in Android and iOS apps through CI/CD automation, without requiring manual SDK integration or source code changes. It covers mobile RASP, app shielding, code obfuscation, root and jailbreak detection, MitM attack prevention, and mobile data encryption. Threat monitoring is handled through ThreatScope and Threat-Events.

Best for: Mobile development and security teams that need automated runtime protection across Android and iOS without embedding SDKs manually.

Key features

• Mobile RASP and app shielding for Android and iOS
• Code obfuscation and MitM attack prevention
• Root and jailbreak detection
• Mobile data encryption
• ThreatScope monitoring and Threat-Events telemetry

Why choose Appdome: The no-code CI/CD integration model means security builds scale with the release pipeline without creating an engineering bottleneck. Fintech, banking, health, and retail app teams find Appdome useful because it handles the breadth of mobile threats without requiring a mobile security specialist on every build.

Appdome pricing: Appdome publishes no numeric pricing. A free trial is available and quotes come from the vendor, so confirm the current trial length when you request one.

G2 rating: 4.8/5 from 99 reviews.

13. OneSpan

OneSpan provides digital identity, electronic signature, and application security for regulated industries, including banking, payments, insurance, and government. Its application shielding component protects mobile apps against overlay attacks, jailbreak and root detection, debugger and emulator detection, and hooking-based tampering. OneSpan's positioning centers on digital trust and identity-sensitive workflows, where app integrity is part of a broader fraud and authentication program.

Best for: Regulated mobile applications in financial services, payments, or identity programs where runtime protection and anti-tampering are compliance requirements.

Key features

• Application shielding with overlay, jailbreak, and hooking detection
• Runtime protection and mobile threat detection
• Multi-factor authentication and identity verification
• Electronic signatures with reusable templates and audit trails
• API and SDK integrations for embedded workflows

Why choose OneSpan: OneSpan fits best when mobile app shielding is part of a larger digital trust or fraud prevention program, rather than a standalone security project. Teams in fintech or regulated financial services evaluating identity and app security together should include it in their shortlist.

OneSpan pricing: OneSpan pricing is quoted by the vendor. The per-user and per-transaction plans that appear on OneSpan's public pricing page belong to OneSpan Sign, the e-signature product, and do not apply to shielding, so do not use them to model a shielding budget.

14. Fastly Next-Gen WAF

Fastly Next-Gen WAF, which evolved from Signal Sciences after Fastly acquired that company in 2020, is a unified web application and API firewall that deploys across edge, cloud, on-premises, and containerized environments. It protects applications against account takeover, bot abuse, API attacks, and OWASP threats through request monitoring, attack detection, and blocking. Fastly packages the product across Security Core, Security Core Plus, and Security Total tiers.

Category note: Signal Sciences marketed its product as RASP before the acquisition. Fastly does not, and positions this as a WAF and API firewall. It belongs on this list as the WAF-adjacent comparison point, not as an embedded runtime agent.

Best for: Teams that want WAF-first application protection with strong deployment flexibility and application attack visibility across hybrid environments.

Key features

• Protection against account takeover, malicious bots, and API abuse
• Deployment across Fastly Edge Cloud, cloud, on-premises, and hybrid environments
• Request monitoring, attack detection, and customizable blocking rules
• CVE virtual patches and advanced rate limiting
• Dashboards, logging, and custom signals

Why choose Fastly Next-Gen WAF: Fastly is the right pick when the organization wants strong application protection without embedding an agent inside each application runtime. The edge-to-origin deployment model gives operations teams flexibility that classic RASP agents do not, particularly for mixed technology stacks. See also the API security tools guide for related coverage.

Fastly Next-Gen WAF pricing: All Security Core, Security Core Plus, and Security Total packages are contact-sales pricing. Contact Fastly for current figures.

15. OpenText Fortify Application Defender

OpenText Fortify Application Defender provides runtime application self-protection for organizations already running Fortify SAST, DAST, or software security programs. It gives real-time protection against vulnerability exploits, centralized visibility into application use and abuse, and supports both SaaS and on-premises deployment. The product fits teams that want runtime protection as an extension of an existing Fortify AppSec investment rather than a standalone tool.

Product status, read this first: Application Defender dates from the Micro Focus era of the Fortify portfolio, which OpenText acquired in 2023. OpenText now markets its application security line under the Fortify and OpenText Core Application Security names, and Application Defender does not feature prominently in that current line-up. Ask OpenText to confirm in writing that Application Defender is still sold, still supported, and on the roadmap for your platform before you build it into a shortlist.

Best for: Fortify customers evaluating runtime protection as part of a broader application security program.

Key features

• Real-time protection against application attacks and vulnerability exploits
• Centralized visibility into application use and abuse patterns
• SaaS and on-premises deployment options
• Fortify portfolio alignment and policy enforcement
• Enterprise AppSec reporting

Why choose OpenText Fortify Application Defender: The integration with existing Fortify workflows is the main reason to choose this product over standalone RASP alternatives. Teams that already have Fortify managing SAST findings can extend that program into runtime protection without introducing a separate vendor relationship. Teams without existing Fortify investment should evaluate other options first.

OpenText Fortify Application Defender pricing: Contact OpenText for a quote, and confirm product status in the same conversation.

Considerations when choosing RASP tools

Start with runtime placement

Server-side RASP, browser JavaScript integrity, mobile shielding, cloud workload detection, and WAF-adjacent protection each address a different attack surface. Before comparing tools head-to-head, decide which runtime you need to protect. Mixing categories in the same evaluation leads to comparing tools that are not substitutes for each other. This guide covers the application shielding software space in more detail if mobile or browser coverage is the primary requirement.

Check who owns the product

This category has consolidated. Several well-known RASP names were acquired and folded into larger application security or observability platforms, and at least one is running out its support schedule. Before a product reaches your shortlist, confirm that it is still sold standalone, who owns it, and what the published end-of-life dates are. Two entries on this list share a corporate parent, which is the kind of thing that turns a three-vendor bake-off into a two-vendor one.

Verify language and framework support

RASP agents instrument language runtimes, so coverage depends heavily on which languages your applications use. Ask vendors for current documentation on Java, .NET, Node.js, Python, Go, PHP, and any mobile platform requirements. Agent maturity varies by language, and some platforms have strong coverage for one stack but limited support for others.

Measure performance before enabling blocking

Runtime instrumentation adds latency. The overhead is usually small in monitor mode, but blocking mode adds processing at the critical path of each request. Run performance baselines in a staging environment that mirrors production traffic, measure p95 and p99 latency impact, review false positive rates, and only expand blocking to high-confidence attack classes first. Teams evaluating automation testing tools will find the same baseline-first approach applies.

Check integrations with the security stack

Ask whether the tool integrates with your SIEM, SOAR, ticketing system, APM platform, CI/CD pipeline, and cloud security tooling. Alert data is only useful if it reaches the team and workflow that acts on it. Integrations with tools like Datadog or New Relic, for example, decide how quickly findings get routed to the right engineer.

Ask what pricing unit drives cost

Security tool pricing varies widely across billing models. Some charge per host, some per application or agent, some per service, some per request volume, and some per mobile app build. Most vendors in this category publish nothing at all, so the quote is the first real number you will see. Before requesting one, calculate your footprint in those units so you can model total cost realistically. An enterprise deal where costs scale with request volume can look very different at 10 million versus 100 million monthly requests.

Conclusion

RASP is not one product. It is a category that spans server-side application agents, browser code protection, mobile app shielding, cloud-native workload detection, and WAF-adjacent runtime filtering. Picking the right tool means matching the runtime placement to the actual attack surface.

Choose OpenRASP or Falco when you need an open-source starting point: OpenRASP for Java and PHP application instrumentation learning, Falco for Kubernetes and container workload detection. Choose Contrast Protect, Waratek, or K2 Cyber Security when the focus is production application runtime protection, bearing in mind that Waratek covers JVM stacks only and K2 warrants vendor diligence first. Choose Datadog Application Security Management, Dynatrace Application Security, or New Relic when runtime security needs to sit inside an existing observability platform. Choose Jscrambler when browser-side JavaScript integrity is the primary concern. Choose Appdome or OneSpan for mobile app shielding. Choose Fastly Next-Gen WAF when the team wants WAF-first application protection with strong deployment flexibility.

Three entries here are reference points rather than live options. Imperva RASP is running out its end-of-support schedule under Thales ownership. Hdiv is sold inside Datadog rather than on its own. OpenText Fortify Application Defender needs a status check with the vendor before it earns shortlist space. Knowing that going in saves a round of calls.

For broader AppSec evaluation support, see related coverage of AI security posture management tools and application security testing software.

Presales and solutions engineers field most of these runtime questions live, in a security review, where describing how detection and blocking behave is harder than showing it. An interactive demo lets you walk an evaluator through the console, the alert, and the blocked request in a guided environment, without standing up an exploit in front of them or booking time on a shared sandbox. Guideflow is an interactive demo platform built for presales and product marketing teams who need that kind of repeatable, shareable interactive demo of a technical product.

Start your journey with Guideflow today!

FAQs