WAF vs. RASP vs. ADR: How Runtime Application Security Works

A breakdown of three layers of application security: WAF (edge), RASP/in-app ADR (inside the app), and eBPF-based in-kernel ADR (OS level). WAFs excel at volumetric threats like DDoS but lack app context, leading to false positives. RASP instruments the app directly, tracing user input to dangerous sinks for precise blocking with low false positives and zero-day coverage. In-kernel ADR uses eBPF to watch syscalls post-exploitation but is blind to injection attacks. The recommendation is to deploy both a WAF and an in-app security tool first, adding in-kernel ADR only when post-exploitation visibility is needed. Aikido Zen is highlighted as a modern in-app ADR that also monitors outbound activity and enforces tenant scoping to prevent IDOR vulnerabilities.