RASP, or runtime application self-protection, is a security control that watches an application while it is executing and can block suspicious behavior in real time. Unlike scanners that find issues before release, RASP sits close to the live code path, where it can inspect requests, application state, and runtime decisions as they happen.
This matters because many attacks only become dangerous after input reaches business logic. RASP can help stop injection attempts, abuse of weak validation, and other malicious actions that perimeter tools may miss. Defenders use it for in-process inspection, virtual patching, or enforcement through agents and edge services. Its main advantage is context: it sees how an application actually behaves, which can make blocking decisions more precise than network-only defenses.