Runtime hardening is the set of defenses that protect software while it is actively running on a device. Instead of only checking the app at install time or after an update, these controls look for abuse during live execution, when attackers may try to inject code, misuse accessibility features, overlay fake screens, hook functions, or tamper with sensitive flows.
It matters because many modern threats, especially mobile banking trojans, operate inside the user session rather than breaking the app outright. If malware can watch the screen, capture a PIN, or alter what the user sees, normal perimeter defenses may miss it. Runtime hardening helps reduce that risk with checks for integrity, suspicious process behavior, anti-tamper logic, and device signals that suggest the app is being manipulated. In practice, it supports defenses that assume the endpoint may already be hostile.