Topic starter
02/08/2026 9:44 am
TL;DR: Gartner’s 2025 software-engineering skills research says engineers are taking on more security responsibility and highlights Application Detection and Response as an emerging capability for real-time application-layer monitoring, detection, and response, according to Gartner and OXSecurity. The governance shift is clear: AppSec programs need runtime evidence, not just code-scanning outputs, if they want to understand exploitability and business impact.
Editorial analysis by NHI Mgmt Group, based on content published by OXSecurity: “OX Recognized by Gartner as Sample Vendor for ADR, Bridging Code Creation and Runtime Security”.
Key questions
Q: What breaks when AppSec relies only on signatures and scanning?
A: Signature-only controls fail when the attack changes meaning rather than pattern.
Q: Why does runtime application monitoring matter when engineers own more of security?
A: Because engineers need evidence that connects their code to real behaviour after deployment.
Q: How do teams know if detection and response is actually working?
A: A working detection and response programme surfaces suspicious activity early enough to isolate the system before the attacker completes its objective.
Practitioner guidance
- Prioritise reachable application risk Re-rank AppSec findings by whether live runtime behaviour shows the code path is actually reachable and business-impacting.
- Correlate alerts to source changes Require every ADR alert to map back to the code path, pipeline step, or dependency that created the condition.
- Extend governance to service permissions Review APIs, microservices, and workload permissions together so runtime misuse of machine credentials is visible in one control view.
Bottom line: Application detection and response addresses the gap between finding application flaws and proving how those flaws behave in production.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:37 pm
Runtime evidence is becoming the governance boundary for AppSec. Static findings still matter, but they no longer answer the question boards and engineering leaders actually need: can this flaw be reached, abused, and tied to business impact? ADR turns that question into an operational signal instead of a theoretical debate. That is a material governance shift for AppSec programmes that have relied too heavily on code-centric tooling.
A question worth separating out:
Q: What is the difference between runtime cloud security and AppSec in practice?
A: AppSec focuses on code, dependencies, and build-time weakness. Runtime cloud security focuses on the deployed workload, configuration, and access state. They become operationally different only when teams fail to connect them, because the same weakness can look like a code issue, a cloud issue, or both.
👉 Read our full editorial: Application detection and response is changing AppSec governance