How Runtime Vulnerability Detection Works and Why It Matters
If you've ever worked in a vulnerability management role (or oversee people who do), you already know the answer. Most VM programs rely on outdated tools and are overwhelmed by CVE noise, making it nearly impossible to focus on what actually matters.
Only 12% of security leaders say they're "extremely confident" in their security operation center's (SOC's) understanding of vulnerabilities in their environment, according to KPMG. In practice, that number might be even lower.
This article introduces the core concepts behind Runtime Vulnerability Detection, an emerging approach that shifts the focus from theoretical risks to actual exploitability. It's a smarter, more actionable way to manage vulnerabilities.
Most vulnerability scanning tools (e.g., Tenable, Qualys, Rapid7, etc…) rely on what we'll call "traditional" vulnerability detection.
This method scans systems for known issues by comparing software versions and configurations against a regularly updated database of known vulnerabilities.
Tools like these use pattern-matching and fingerprinting techniques to identify affected components. Signatures are tied to CVEs, and the CVEs (and CVSS scores) are used to present risk findings.
Modern scanners often enrich these CVSS scores with additional sources of exploitability information, such as EPSS (Exploit Prediction Scoring System) data or In the Wild exploitation indicators, to provide more nuanced risk assessments. Many of these tools also generate their own proprietary risk scores, which may or may not correlate with CVSS.
However, even with additional sources of data, vulnerability management still becomes a matter of looking for needles in an ever-growing haystack of CVEs.
This CVE-driven approach presents serious limitations.
There are too many (far too many) CVEs in most environments to ever fully remediate, real risks don't always have CVEs attached to them, and prioritization based on static risk scores alone rarely reflects actual business risk.
This approach also omits software without CVEs, including tools built within your organization.
Scanners can tell you, "You have a problem (theoretically speaking)," but not, "Here's what the problem means for your business and what you should do about it right now."
Unsurprisingly, although approximately 98% of organizations utilize vulnerability scanning, only 34% find it highly effective.
This leaves vulnerability management teams, the people they report to, and ultimately, the companies relying on cyber risk reduction efforts to protect business continuity with issues like:
These and other issues make the traditional approach to vulnerability management, which starts with scanning for signatures of CVEs, unsustainable.
At the same time, the number of vulnerabilities reported as CVEs is growing at an exponential rate, rising by 38%(!) last year compared to the previous year. As such, the challenge keeps getting harder.
It's well past time for a better approach. Ignoring increasing volumes of vulnerabilities (as many teams now do) is not it. The best option is to go upstream and plan risk reduction on live data that is evident in your environment.
Runtime vulnerability detection identifies signs of real-world exploitability by analyzing software behavior during execution.
It is a type of behavior-based scanning that provides visibility into threats that traditional scanners miss, including zero days, risks in third-party or shadow IT software, and insecure configurations with no CVEs attached.
When an exploitable (or exploited) software application runs, it will exhibit indicators of exploitable behavior during runtime, such as:
With a lightweight passive Runtime Vulnerability Management (RVM) sensor, you can monitor for these runtime exploitation indicators in your environment continuously.
Learn more about Runtime Vulnerability Management here.
Runtime detection can monitor all software currently installed in your environment, including software you may not be aware of, such as shadow IT or custom-built tools. The environment itself is unchanged, and there is no risk of misconfiguration.
Our runtime vulnerability detection solution, Spektion, tracks how live applications interact with memory, make system calls, request privileges, and communicate over networks.
It builds a baseline of normal behavior for each application and flags anomalies that indicate real risk, such as a trusted tool suddenly requesting admin access or accessing sensitive files it had never touched before.
Runtime vulnerability detection detects risks in the runtime environment.
The key advantage of runtime vulnerability detection over what we could call traditional vulnerability management is runtime detection cuts through CVE overload, highlighting the very small subset of vulnerabilities that are exploitable and impactful in your environment.
Runtime vulnerability detection adds value simply by showing which CVE-affected components never actually run, so you don't waste time patching irrelevant risks.
Since runtime vulnerability detection is the natural evolution of traditional vulnerability scanning tools, it makes sense to compare the two methods of vulnerability detection.
The critical thing to note is that runtime vulnerability detection tools still typically perform CVE scanning, but scanner findings are supplementary, not essential. They are used to enrich runtime data and enhance risk understanding where relevant and possible.
Runtime vulnerability detection transforms vulnerability management by shifting the starting point from static CVE databases to live software behavior.
This upstream approach unlocks critical capabilities that traditional tools struggle to deliver:
Runtime detection alerts teams to risky software behavior even when there's no CVE.
By analyzing how software behaves at runtime, runtime detection can surface privilege misuse, unsafe memory behavior, and suspicious activity in third-party and shadow IT software.
If a CVE exists, a runtime detection tool like Spektion also shows you whether it's actually dangerous in your environment, giving teams a focused, risk-based prioritization flow that traditional scanners can't match.
Traditional tools for third-party risk management rely on Software Bill of Materials (SBOMs) and scanner output.
Runtime vulnerability detection tools enable real-time software governance by identifying what software is deployed and what it does once executed, identifying insecure or exploited processes in real time. This can be anything from an AI-coded tool to a niche vendor app installed outside of approved processes.
Runtime detection reveals live exploitability and risk, regardless of where the software came from or how visible its code base is.
Runtime detection tools can be used to assess an application during its proof-of-concept stage within your environment to assess the actual security risk it introduces.
By observing POC software runtime behavior early, teams can identify insecure processes before introducing the software into their environments.
Zero-day attacks don't come with CVEs or advisories, but this doesn't matter if you have a tool such as Spektion capable of runtime detection of the behavior at the root of the zero-day vulnerability.
Exploited behavior, such as abnormal memory use, unexpected system calls, or privilege escalation, can be detected during runtime long before a zero-day is ever exploited in the wild.
Runtime detection helps small teams manage risk more efficiently by focusing only on vulnerabilities that are actually exploitable in their environment. This eliminates the noise of CVE overload and significantly reduces the remediation workload.
Runtime detection also shows potential mitigation paths beyond patching, allowing unpatchable risks to be quickly addressed.
If there's no patch, or if patching is too much of a business risk to seriously consider, runtime detection can still show you the next best step to prevent or at least detect exploitation.
By analyzing how vulnerable software behaves in context, a runtime detection tool like Spektion recommends practical mitigation steps such as policy updates, isolation strategies, or privilege restrictions.
Don't guess risk based on metadata and theoretical scenarios. See risk using real-time data instead.
Spektion runtime vulnerability detection shows how software really behaves in your systems, offering visibility into post-installation behavior that static scanning can't match.
Learn more about runtime vulnerability management (RVM) in our explainer of what the latest evolution of vulnerability management looks like.
Or contact us for a free demo of our runtime detection tool in your environment.