Runtime Correlation

ByteHide AI connects what Code finds in your code with what App runtime sees in production. A vulnerability is not just "medium severity" — it's "medium severity, actively exploited, last attack 2 hours ago".

Why Runtime Context Matters

Static analysis tells you a vulnerability exists. Runtime correlation tells you if anyone is actually attacking it.

How It Works

When both Code (SAST/SCA/Secrets) and App runtime (RASP) are active on the same project, they share data automatically through the ByteHide platform. No additional configuration is needed.

Escalation: theoretical to actively exploited

1. Code flags a SQL injection in /api/users — assigns it Medium severity
2. App runtime detects 47 SQL injection attempts targeting that exact endpoint this week

Click to expand

3. Code receives the runtime signal and escalates the finding to Critical
4. The finding shows a "Runtime Confirmed" indicator with a link to the Monitor incidents

De-escalation: flagged but unreachable

1. Code flags an SSRF with Critical severity (CVSS 9.1)
2. App runtime confirms the endpoint is internal-only, behind authentication, unreachable from external traffic
3. Code adjusts the priority to Medium — your team stops wasting time on it

Attack detail and AI analysis

When App runtime detects an attack, it captures the full context: payload, injected content, SQL query, stacktrace, and origin. You get the exact data you need to understand the attack.

Click to expand

App runtime also provides an AI-powered analysis that explains what happened, why it matters, the attack vector, and the severity — all in plain language.

Click to expand

MCP: Runtime Context in Your AI Conversation

When you use ByteHide through MCP, runtime correlation enriches the responses your AI agent gives you. Instead of just reporting a static finding, the AI can tell you:

• "This dependency has a known vulnerability and it's running in your production environment"
• "The last attack targeting this endpoint was today at 11:00"
• "This vulnerability is actively being exploited — 47 attempts this week"
• "App runtime is currently blocking attacks against this while you prepare the fix"

This turns security conversations from theoretical ("this could be vulnerable") into actionable ("this is under attack right now, here's what to do").

Example: dependency check with runtime context

When you ask your AI agent to check a dependency, the MCP doesn't just report the CVE — it cross-references with App runtime to tell you if that vulnerable dependency is loaded in a running application:

You: Is express@4.17.1 safe?

Claude: express@4.17.1 has 3 known CVEs (1 Critical, 2 High).

        ⚠️ Runtime alert: This exact version is currently running in
        your "api-gateway" production environment. Monitor detected
        2 exploit attempts targeting CVE-2024-43796 in the last 24h.

        Recommended: upgrade to express@4.21.0

You: Is express@4.17.1 safe?

Claude: express@4.17.1 has 3 known CVEs (1 Critical, 2 High).

        ⚠️ Runtime alert: This exact version is currently running in
        your "api-gateway" production environment. Monitor detected
        2 exploit attempts targeting CVE-2024-43796 in the last 24h.

        Recommended: upgrade to express@4.21.0

Example: code scan with runtime enrichment

When you scan code for vulnerabilities, findings that match active attacks in App runtime get flagged immediately:

You: Scan this file for vulnerabilities

Claude: Found 3 vulnerabilities:

        🔴 SQL Injection (CWE-89) — line 47 [RUNTIME CONFIRMED]
           47 exploit attempts this week targeting /api/users
           Monitor is blocking attacks. Fix urgently.

        🟡 XSS (CWE-79) — line 112
           No runtime activity observed

        🟡 Path Traversal (CWE-22) — line 89
           Endpoint is internal-only (Monitor confirms unreachable)

You: Scan this file for vulnerabilities

Claude: Found 3 vulnerabilities:

        🔴 SQL Injection (CWE-89) — line 47 [RUNTIME CONFIRMED]
           47 exploit attempts this week targeting /api/users
           Monitor is blocking attacks. Fix urgently.

        🟡 XSS (CWE-79) — line 112
           No runtime activity observed

        🟡 Path Traversal (CWE-22) — line 89
           Endpoint is internal-only (Monitor confirms unreachable)

The AI agent prioritizes the SQL injection first because it's the one under active attack — not because it has the highest CVSS score.

AI-Assisted Security During Development

Runtime correlation is not only for triage. When your AI coding agent has access to ByteHide MCP, security becomes part of the development conversation in real time:

• While writing code — the AI can scan what you're writing for vulnerabilities before you even commit
• Before installing dependencies — check if a package is safe and whether similar vulnerable versions are already running in production
• During code review — the AI can audit the diff for security issues and flag anything that matches known attack patterns from App runtime
• When debugging — if App runtime detected an attack, the AI can explain the incident, show you the vulnerable code, and suggest the fix

The MCP tools are available throughout the conversation. You don't switch to a separate security tool — the AI proactively uses ByteHide as part of its workflow.

Impact on Prioritization

Without runtime correlation, priority is based on severity score alone:

With runtime correlation from App runtime:

The SSRF had the highest CVSS score, but runtime data shows it's unreachable. The SQL injection had a lower score, but it's actively under attack. Runtime correlation ensures your team fixes the right thing first.

False Positive Reduction

Runtime correlation reduces false positives by up to 90% through three mechanisms:

Setup

Runtime correlation activates automatically when both products are connected:

1. Create a Code project and connect your repository
2. Set up App runtime on the same application
3. Both products share data through the ByteHide platform automatically

No additional configuration is needed. When App runtime detects an attack that matches a Code finding, the correlation appears in both dashboards within seconds — and becomes available to your AI agent through MCP.

Next Steps