Best RASP Tools
Contrast Protect remains the dedicated RASP anchor, Waratek the JVM virtual-patching specialist, and the platform lanes (Datadog with Hdiv inside, Dynatrace, Fastly at the edge) show where runtime protection actually went.
Ten entries, honestly counted from twelve sheet rows this is a category consolidation rewrote, and the comparison says so.
• Best dedicated RASP: Contrast Security (Protect) same agents as its IAST
• Best JVM virtual patching: Waratek patch without redeploying
• Best observability-delivered: Datadog (Hdiv engine inside) | Dynatrace
• Best edge-adjacent: Fastly (Signal Sciences) next-gen WAF at RASP’s job
• Best WAAP-estate: Imperva | Suite lane: OpenText (Fortify)
• Client-side shielding (different job): Jscrambler | OSS artifact: OpenRASP
• Status watch: K2 Cyber listed twice, likely defunct
| Product | Lane | Standout | Pricing structure | Editor’s rating* |
| Contrast (Protect) | Dedicated | IAST-to-RASP continuity | Per-app/quote | 4.5/5 |
| Waratek | JVM specialist | Virtual patching | Quote | 4.3/5 |
| Datadog (incl. Hdiv) | Observability | APM-delivered protection | Published usage | 4.3/5 |
| Dynatrace | Observability | OneAgent runtime defense | Published usage | 4.2/5 |
| Fastly (Signal Sciences) | Edge | NGWAF at runtime’s job | Tiered/quote | 4.2/5 |
| Imperva | WAAP estate | Defense-in-depth pairing | Quote | 4.1/5 |
| OpenText (Fortify) | Suite | Governance unity | Quote | 3.9/5 |
| Jscrambler | Client-side | JS shielding + skimming defense | Tiered | 4.2/5 |
| HCL AppScan | AppSec suite | SAST/DAST and application vulnerability testing | Quote | 4.0/5 |
| Veracode | AppSec platform | Integrated application security testing and remediation | Quote | 4.2/5 |
Editorial, research-based; no lab testing or paid placement. n/r = not rated.
Research-based: protection depth, overhead reputation, deployment model, consolidation accuracy, pricing transparency. No lab claims; no vendor influence. Priority: honest survivor mapping RASP’s ideas won inside platforms while its standalone market thinned.
Modern security strategies often pair runtime controls with software composition analysis tools to address underlying code risks alongside live protection.
Best for: Production protection from the instrumented anchor.
The same agents that verify in testing (Assess) block in production exploit prevention with code-level context, the category’s standard-bearer.
Coupling runtime agents with interactive application security testing (IAST) provides complete visibility into runtime execution flows.
Key features: In-app blocking; attack visibility; IAST continuity; broad language agents.
Pros: Depth; one-agent story.
Cons: Agent lifecycle; per-app economics.
Pricing: Per-app/quote.
Differentiator: Testing and protection from one instrumentation.
Best for: Java estates that can’t redeploy fast.
JVM-level rules patch vulnerable behavior without code changes legacy Java’s pragmatic shield, including log4j-class emergencies.
Applying virtual patches directly inside the runtime engine protects critical enterprise workloads against high-severity zero-day exploits.
Key features: Virtual patching; JVM instrumentation; legacy Java support; rule library.
Pros: Patch-without-deploy; Java depth.
Cons: JVM scope.
Pricing: Quote.
Differentiator: The emergency patch that skips the release train.
Best for: Datadog-instrumented estates.
Hdiv’s acquired engine inside App & API Protection exploit detection and blocking through tracing agents already deployed, one entry despite two sheet rows.
Leveraging tracing context allows teams to detect active exploitation alongside API security solutions.
Key features: Runtime blocking; trace context; APM unity; usage pricing.
Pros: Zero-new-agent; published pricing.
Cons: Dedicated-depth contests.
Pricing: Published usage.
Differentiator: RASP as a toggle on the APM you run.
Best for: Dynatrace estates activating protection.
Application Security’s detect-and-block on OneAgent with Davis exposure prioritization. Integrating runtime threat intelligence with broader cloud workload protection platforms ensures end-to-end security across distributed microservices.
Key features: OneAgent delivery; runtime detection/blocking; exposure ranking.
Pros: Deployment-free adoption.
Cons: Platform gravity.
Pricing: Published usage.
Differentiator: Protection riding the agent estate you own.
Best for: Teams wanting RASP outcomes at the edge/service layer.
The next-gen WAF that ate much of RASP’s demand app-aware blocking deployed as module/agent/edge without in-process depth.
Deploying app-aware modules alongside web application firewall (WAF) solutions stops web layer attacks before they hit application servers.
Key features: NGWAF; flexible deployment; app-aware rules; edge unity.
Pros: Deployment pragmatism; developer trust.
Cons: Not in-process context.
Pricing: Tiered/quote.
Differentiator: The reason many never bought classic RASP.
Best for: Imperva estates layering runtime defense.
RASP capability within the veteran WAAP portfolio defense-in-depth with WAF/API/DDoS under one vendor (Thales family).
Integrating in-app agents with top-tier DDoS protection services safeguards application endpoints from multi-vector automated attacks.
Key features: RASP module; WAAP unity; virtual patching support.
Pros: Estate synergy.
Cons: Standalone momentum.
Pricing: Quote.
Differentiator: In-app depth behind the WAF you tuned.
Best for: Fortify-governed estates.
Runtime protection integrated with Software Security Center governance. Unifying static analysis and runtime governance helps bridge the gap between static application security testing (SAST) and production threat visibility.
Key features: Runtime agents; SSC unity; policy.
Pros: Governance continuity.
Cons: Category momentum.
Pricing: Quote.
Differentiator: Runtime defense inside the compliance plane.
Best for: Protecting JavaScript in hostile browsers.
Lane label: client-side, not server RASP code obfuscation/integrity, and payment-page skimming defense (PCI DSS 6.4.3-era controls).
Implementing client-side JavaScript protection guards payment portals against web skimming and supply chain attacks.
Key features: JS protection; anti-tamper; skimming detection; PCI-aligned monitoring.
Pros: Owns its lane; compliance tailwind.
Cons: Not server-side RASP.
Pricing: Tiered.
Differentiator: RASP’s spirit, applied to the browser.
Best for: Organizations seeking application security testing across the software development lifecycle.
HCL AppScan provides application security testing capabilities to help teams identify vulnerabilities in web applications, APIs, and source code. It is a broader application security platform, not a direct replacement for dedicated RASP.
Key features: Static application security testing (SAST); dynamic application security testing (DAST); interactive application security testing (IAST), depending on the product and edition; vulnerability assessment.
Pros: Multiple testing approaches; development lifecycle integration; enterprise security workflows.
Cons: Not equivalent to dedicated in-process runtime blocking; capabilities vary by AppScan product and edition.
Pricing: Contact vendor for a quote; varies by product and licensing.
Differentiator: Application security testing across development and testing workflows.
Best for: Organizations managing application vulnerabilities and security testing across development teams.
Veracode offers application security testing and risk management capabilities that help developers identify, prioritize, and remediate software vulnerabilities. It is a broader application security platform, not a direct replacement for dedicated RASP.
Key features: Static analysis (SAST); dynamic analysis (DAST); software composition analysis (SCA); application risk management and remediation guidance, depending on the product and plan.
Pros: Multiple application testing capabilities; developer workflow integration; centralized vulnerability management.
Cons: Does not provide the same in-process protection model as dedicated RASP; capabilities depend on the selected products and subscription.
Pricing: Contact vendor for a quote; varies by package and licensing.
Differentiator: Consolidated application security testing and vulnerability remediation workflows.
| Product | Lane | In-process depth | New agent needed | Pricing |
| Contrast | Dedicated | Deepest | Yes | Per-app |
| Waratek | JVM | JVM-deep | Yes | Quote |
| Datadog | Observability | Good | No (APM) | Usage |
| Dynatrace | Observability | Good | No (OneAgent) | Usage |
| Fastly | Edge | Service-layer | Module | Tiered |
| Imperva | WAAP | Module | Yes | Quote |
| Fortify | Suite | Good | Yes | Quote |
| Jscrambler | Client-side | Browser | JS build | Tiered |
| HCL AppScan | AppSec suite | Limited | Depends on product / integration | Quote |
| Veracode | AppSec platform | Limited | Depends on product / integration | Quote |
Check platform toggles first: Datadog/Dynatrace estates may own runtime blocking unactivated.
Buy dedicated (Contrast) where in-process context is the requirement, Waratek where Java can’t redeploy, Jscrambler where the browser is the battlefield.
Standardizing automated builds through CI/CD security tools ensures protection policies are configured before code reaches production.
Common mistakes: counting K2 twice (or at all, pending status); expecting server RASP from client-side tools; ignoring the WAAP/edge lane that answers most runtime needs; agent politics unplanned.
Contrast Protect for dedicated in-process protection, Waratek for JVM virtual patching, Datadog/Dynatrace for observability-delivered blocking, Fastly’s Signal Sciences for edge-adjacent defense, Jscrambler for the client-side lane.
The capability thrives; the standalone market thinned. Observability and edge platforms absorbed the demand our twelve sheet rows yielding nine going concerns tells the story.
Hdiv was acquired by Datadog (2022) and powers its runtime protection; K2 Cyber’s status warrants verification before any consideration signals point to wind-down.
Different vantage: WAFs filter at the edge; RASP blocks with code context in-process. Estates commonly run WAAP broadly and add in-process depth on crown-jewel apps. Combining runtime agents with dynamic application security testing (DAST) validates that edge controls and in-app defenses block live attack payloads.
A distinct job script integrity and skimming defense in browsers (Jscrambler-class), now compliance-driven for payment pages. Don’t confuse it with server RASP; budget it separately.
Contrast keeps the dedicated crown, Waratek the JVM niche, and the platforms own distribution activate what your agents already can, buy depth where context demands it, and retire the dead names from your shortlists.
Partnering with experienced penetration testing companies ensures runtime defenses are properly tested against sophisticated exploit vectors.
Next step: audit your APM’s security toggles before any RASP RFP.
About the author: [AUTHOR NAME], [credential]. Reviewed by: [REVIEWER NAME]. Last updated: September 2026.
Disclosure: GBHackers editorial is independent; vendors do not pay for inclusion or ranking.
• Best IAST Tools, Compared and Priced
• Best WAF Solutions, Compared and Priced
• Best API Security Tools, Compared and Priced
• Best DAST Tools, Compared and Priced
• Best SAST Tools, Compared and Priced
• Best Observability Security, Compared and Priced
• Best Bot Management, Compared and Priced
• Best CDN Security, Compared and Priced
• Best Client-Side Security, Compared and Priced
• Best ASPM Platforms, Compared and Priced
• Best DevSecOps Tools
A likely Russian-speaking threat actor used hundreds of AI agents to exploit PaperCut NG/MF servers,…
Microsoft and international partners have disrupted infrastructure supporting CoGUI. This phishing kit Proofpoint says generates…
Researchers at pwn.ai used an AI-assisted research harness to find a critical Linux kernel networking…
NowSecure and Data Theorem mobile security lead automated mobile testing, Guardsquare owns shielding/obfuscation, and Corellium’s…
Anchore’s Syft SBOM generator is the free generation standard, FOSSA and Cybeats lead SBOM management,…
Your CI platform’s native controls (GitHub Advanced Security, GitLab Ultimate) are the baseline, Cycode and…