Anyone using ADR for runtime protection – does it actually work for you?

[Robbert]

I manage security for a growing SaaS platform, and lately, I’ve been running into a problem that keeps me up at night. We have a solid dev cycle, we scan dependencies, we test APIs, we patch CVEs as they come in. And yet, we’re still seeing attacks that our current tools just aren’t catching. Here’s the scenario: we’ve got a handful of customer-facing apps, some internal tooling, and a growing list of third-party integrations. Everything runs in containers on Kubernetes, and we do the usual checks – SCA, SAST, DAST, you name it. But the gap is what happens after deployment. Once an app is live, our visibility drops off a cliff. Logs are too noisy, WAF rules miss weird edge cases, and our EDR isn’t built to look inside the app itself. Last month, we had an incident where someone exploited a vulnerability in an outdated library we didn’t even know we were using. It wasn’t in our main repo – it was pulled in transitively by a dependency of a dependency. The exploit ran, did some damage, and we only caught it hours later by accident. I don’t want to rely on luck anymore. I’ve been reading about ADR – Application Detection and Response – and from what I understand, it’s supposed to solve exactly this problem. It monitors application behavior at runtime, catches anomalies, and blocks malicious activity as it happens. Sounds great on paper. But I have no idea how to actually implement it without breaking things. Has anyone here rolled out ADR in a production environment? What was your experience? Any pitfalls I should be aware of? I’d really appreciate some practical advice – vendor-agnostic if possible.

[Robbert]

Yeah, that’s exactly the gap I keep hearing about. Scanning and patching are cool and all, but they don’t do jack once a shady lib gets loaded at runtime or some legit dependency goes rogue. The real question is whether you can actually catch and shut down the exploit while it’s executing, not just before you push to prod. A buddy of mine ran a small pilot on a non-critical service first, and honestly, the visibility into call chains and library-level stuff was pretty eye-opening. ADR security gave him a way clearer picture of what normal behavior looks like, so weird stuff popped out right away. Not a magic fix, but it definitely filled that blind spot they had post-deployment

[Author]

Posts