Raven.io @Ravencloudinc

One runtime security advantage. Six major frameworks. DORA. PCI DSS 4.0.1. SOC 2. ISO 27001. NIST SP 800-53. FedRAMP. Next-generation runtime security helps teams see what’s actually executing, block covered exploit behavior, and retain evidence that the control operated. So when the patch is weeks away, you have a stronger answer to: “What protects the application today?” Protect sooner. Prove it operated. Patch when ready. Read the full blog: na2.hubs.ly/H07L1Rw0 #RuntimeSecurity #ApplicationSecurity #Cybersecurity #Compliance

Family 10 of the Raven Power List: Parsing, Decoding & Deserialization — "The Customs Officer." It opens every package that arrives. Parsers and deserializers process untrusted input before anything else validates it — the very first thing an attacker can reach. That's why insecure deserialization, XXE and RCE keep this family busy. The Customs Officer's risk lives at runtime: what it was handed, and what it turned that input into. Among the 14 most powerful families in software, this one checks the incoming crates. Download the research: na2.hubs.ly/H07KQbD0 #Deserialization #ApplicationSecurity #Cybersecurity #OpenSourceSecurity

What if AI finds the next critical software vulnerability before it has a CVE, advisory, or patch? Join Raven on October 8 for Before the CVE: The 14 Software Libraries AI Will Target First, featuring @ , @ Omer Yair and @ James Berthoty. They’ll explore: • Why focusing only on known CVEs leaves a critical gap • How dangerous components become difficult to see once an application is running • What cases like Log4j2 reveal about traditional defenses • How runtime attribution connects suspicious behavior to the exact library, function, input, and call chain responsible Save your spot: na2.hubs.ly/H07HRfW0 #Cybersecurity #ApplicationSecurity #OpenSourceSecurity

See the research: raven.io/the-14-most-po…

Family 09 of the Raven Power List: Code, Template & Expression Evaluation — "The Ventriloquist." It turns words into deeds. eval, template engines and expression evaluators execute text with access to your application context. Whoever influences that text influences what the app does — which is why code injection, SSTI and RCE concentrate here. The Ventriloquist can be fully patched and still speak an attacker's words at runtime. The question is never the CVE — it's the input. 14 families run modern software. This one puts words in its mouth. Download the research 👇 #SSTI #ApplicationSecurity #Cybersecurity #OpenSourceSecurity

Get your copy here: raven.io/the-14-most-po…

Family 08 of the Raven Power List: Dynamic Modules with Native Code — "The Smuggler." It crosses into unmanaged territory. Modules that bridge managed code into native libraries leave the safety of the runtime behind. Past that border live memory corruption, RCE and sandbox escape — the heavy, low-level outcomes. You won't spot the Smuggler's crossing in a package manifest. You see it at runtime, when managed code hands data to native memory. One of 14 families in our new research on library power. Download the research 👇 #MemorySafety #ApplicationSecurity #Cybersecurity #OpenSourceSecurity

What can EDR see when an attack moves inside a server application and what context is missing? In this clip, Raven Co-Founder and Chief Research Officer Omer Yair explains why application-level visibility matters when investigating an attack. Watch the full on-demand webinar to see a live attack and compare what EDR detects with what ADR reveals, down to the responsible library, function, and call chain. Watch on demand: na2.hubs.ly/H07Bb2N0

Download the research here: raven.io/the-14-most-po…

Family 07 of the Raven Power List: OS-Command & Remote-Shell Execution — "The Enforcer." It makes things happen with muscle. Libraries that spawn processes or run shell commands turn a string into an action on the host. It's the shortest path from input to command injection, RCE and a reverse shell. The Enforcer doesn't need a vulnerability to be dangerous — it needs untrusted input reaching the wrong call. That's a runtime question, not a CVE one. Among the 14 most powerful families in software, this is the one with hands. Download the research 👇 #RCE #ApplicationSecurity #Cybersecurity #OpenSourceSecurity

Download the power list: raven.io/the-14-most-po…

Family 06 of the Raven Power List: Cryptocurrency, Blockchain & Web3 Clients / SDKs — "The Money Mover." Irreversible transfers, signed quietly. Wallet SDKs and chain clients handle keys and sign transactions that can't be undone. The stakes are absolute — which is why key theft, fund drains and supply-chain attacks target this family hardest. The Money Mover's risk isn't in a CVE feed. It's in what gets signed at runtime, with which key, on whose instruction. 14 families, one research report. This one moves the money. Download the research 👇 #Web3Security #Blockchain #Cybersecurity #OpenSourceSecurity

A new Log4j RCE technique is making noise. No CVE. No signature. Yes, AI found it. We reproduced it in our lab. Raven prevented the exploit at runtime with no prior knowledge. 😎 Read our findings: na2.hubs.ly/H07thtL0

We are entering a CVE-less world. Attackers are using AI to find and weaponize weaknesses before they have a CVE, signature, patch, or detection rule. If your defenses depend on knowing the vulnerability first, you are already behind. Security teams need a way to recognize and stop malicious execution at runtime, whether a CVE exists or not. Watch the clip, then catch the full ADR vs. EDR webinar on demand: na2.hubs.ly/H07q57s0 #RuntimeSecurity #ApplicationSecurity #ZeroDay #ADR #Cybersecurity #AI

Family 05 of the Raven Power List: Network Egress & Client Transport — "The Courier." It carries anything, anywhere — credentials in hand. HTTP clients, URL fetchers and resolvers can originate connections from your server's trusted position, to places an outside attacker could never reach directly. That's why SSRF, data leaks and DoS trace back to this family. A patched, CVE-clean client can still hand an attacker control over the destination. Only runtime tells you where the Courier actually went. One of 14 families in our new research. Download the research: na2.hubs.ly/H07p3zM0

Security spent years getting very good at stopping postinstall attacks. Attackers moved on. More than 700 malicious npm packages skipped install hooks entirely. The malware executed when developers followed one ordinary README instruction: require() the library. The name can lie. The signature can change. The behavior cannot. Read: Postinstall Was the Labubu → na2.hubs.ly/H07d59x0

raven.io/the-14-most-po…

🆕 New research you won’t find anywhere else: The 14 Most Powerful Families in Software. After analyzing millions of open-source libraries, we identified 14 families with the most influence on modern applications and their risk. The research looks beyond known CVEs to evaluate what software is capable of doing at runtime. The link is in the comments.

Last chance to register: EDR vs. ADR with a live attack demo 🥷 Watch the same attack through two very different lenses and see where EDR visibility stops and how ADR traces suspicious behavior to the responsible library, function, and call chain. Join Raven’s Roi Abitboul and Omer Yair with Futurum's Fernando Montenegro. 📅 August 19 at 11:00 a.m. ET Save your spot: na2.hubs.ly/H07cVxm0

Get the research here: raven.io/the-14-most-po…

Family 03 of the Raven Power List: Database & Data-Store / Query Tier — "The Bookkeeper." It holds the ledgers. Every query builder, ORM and data-store client sits between your application and the data an attacker actually wants. That's its legitimate business — and why SQL injection, data exfiltration and tampering live here. You can't see the Bookkeeper's risk in a dependency list. You see it at runtime: which query ran, built from whose input, touching which records. We mapped 14 families with the most sensitive behavior in software. The Bookkeeper is one. Download the research 👇 #DataSecurity #ApplicationSecurity #Cybersecurity #OpenSourceSecurity