Tools like web application protection platforms, application detection and response (ADR), and application security posture management (ASPM) are better suited to protecting modern web applications (see Figure 19). Divest: Runtime Application Self-Protection (RASP) This graphic shows the maturity, business value, example use cases, and sample vendors for runtime application self-protection and provides a definition, maturity rationale, and business value rationale for this technology.

The rise of cloud-native application protection platforms (CNAPPs), observability, and runtime protection commoditizes the traditional policy-based WAF. Early runtime application self-protection (RASP) tools presented WAF solutions with a potential challenger but were stymied by limited language support and agent management challenges.

Runtime application self-protection (RASP) as a product category is in decline, and very few vendors still use the terminology; they instead tie these products to security observability, CNAPP, or runtime ASPM. However, the need for runtime application protection remains: A whopping 31% of security decision-makers in the utilities and telecom industries said they plan to adopt RASP in the next 12 months.

Today, there are few vendors offering both runtime application security and the standard web application protection platform components, and there is no platform that includes runtime security tools. However, such expansions are not inconceivable, given that a few WAF vendors used to sell runtime application security protection.

Business agility, cloud workload complexity and visibility, and cost reduction are driving the adoption of cloud-native application protection (CNAPP, formerly CWS). In this report, we highlight the level of use of CNAPP components to defend cloud compute, storage, and network infrastructure components as well as to provide application security for cloud-hosted apps.

Runtime application self-protection as interest and adoption plummets. Runtime application self-protection (RASP) burst onto the scene several years ago as an alternative to web application firewalls (WAF). While RASP helps protect against code security flaws in production, the downsides — language limitations and agent management — have proven to be too much for most security leaders. In the last couple of years, Forrester clients have expressed little interest in RASP.

In this sector, security decision-makers indicated plans to adopt container security (16%), IAST (14%), and runtime application self-protection (RASP) (14%). Business services lags other industries on container security adoption: 74% of these respondents said that they were adopting container security, compared with 82% in retail, 82% in manufacturing, and 80% in financial services — so the heavy planned investment will help business services catch up.

Tencent offers compelling CSPM/CIEM though lacks hypervisor protections. Tencent has been investing in improving vulnerability defenses: Host security provides runtime application self-protection (RASP) with vulnerability defense to protect against zero-day vulnerabilities. Tencent has on-par vision, roadmap execution, and IPNS R&D spend as a proportion of IPNS revenues.

Figure 1 A Runtime Architecture, Not An AI Development Or Data Platform Forrester’s ARA is deliberately designed as a multi-agent execution layer, not an AI development platform or data platform, which may come with their own runtimes.

Figure 3 Cloud-Native Application Protection Platform Solutions: Extended Use Cases Cloud-native application protection solutions have six extended use cases: AI security posture management, API discovery and protection, app code scanning, cloud infrastructure entitlement management, data security posture management, and infrastructure-as-code scanning. This graphic has an associated spreadsheet that includes the objectives and top differentiators of each.