What it means
Techniques can include web application firewalls, runtime application self-protection, API enforcement, workload policy, memory protections, behavioral detection, and exploit mitigation. Runtime controls should complement secure design, patching, and testing rather than replace them.
Why it matters
Runtime visibility can detect or block attacks that reach production and provide evidence about actual exploitation attempts.
Practical focus
- Tune controls using application context and expected behavior
- Monitor blocked and allowed events for bypass and false positives
- Protect management interfaces and policy changes
- Feed runtime findings back into development and vulnerability management
Common mistakes
- Treating a WAF as a substitute for fixing vulnerable code
- Deploying blocking rules without testing business impact
- Ignoring attacks that are logged but not prevented
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: