I manage security for a growing SaaS platform, and lately, I’ve been running into a problem that keeps me up at night. We have a solid dev cycle, we scan dependencies, we test APIs, we patch CVEs as they come in. And yet, we’re still seeing attacks that our current tools just aren’t catching. Here’s the scenario: we’ve got a handful of customer-facing apps, some internal tooling, and a growing list of third-party integrations. Everything runs in containers on Kubernetes, and we do the usual checks – SCA, SAST, DAST, you name it. But the gap is what happens after deployment. Once an app is live, our visibility drops off a cliff. Logs are too noisy, WAF rules miss weird edge cases, and our EDR isn’t built to look inside the app itself. Last month, we had an incident where someone exploited a vulnerability in an outdated library we didn’t even know we were using. It wasn’t in our main repo – it was pulled in transitively by a dependency of a dependency. The exploit ran, did some damage, and we only caught it hours later by accident. I don’t want to rely on luck anymore. I’ve been reading about ADR – Application Detection and Response – and from what I understand, it’s supposed to solve exactly this problem. It monitors application behavior at runtime, catches anomalies, and blocks malicious activity as it happens. Sounds great on paper. But I have no idea how to actually implement it without breaking things. Has anyone here rolled out ADR in a production environment? What was your experience? Any pitfalls I should be aware of? I’d really appreciate some practical advice – vendor-agnostic if possible.
.
