> For the complete documentation index, see [llms.txt](https://docs.opsmx.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.opsmx.com/code-to-cloud-security-and-scanners/runtime-security.md).

# Runtime Security

Runtime Security is the **last line of defense and continuous feedback loop** in OpsMx Delivery Shield's Code-to-Cloud model. While earlier stages like SAST, SCA, and DAST aim to prevent vulnerabilities from reaching production, Runtime Security operates on the assumption that some risks will inevitably pass through — and ensures they are **detected and mitigated in real time** before they cause damage.

Modern cloud-native systems are highly dynamic — with frequent deployments, auto-scaling workloads, and complex microservice interactions. This makes it impossible to rely solely on pre-deployment controls. Runtime Security fills this gap by continuously monitoring system behavior, detecting deviations from established baselines, and feeding insights back into earlier pipeline stages to prevent recurrence.

{% hint style="info" %}
Runtime Security in OpsMx is not passive monitoring — it is active, continuous, and connected. Findings from runtime feed directly back into code, build, and deployment controls — creating a true closed-loop security posture.
{% endhint %}

## Why Runtime Security Is Used in OpsMx

OpsMx uses Runtime Security in Delivery Shield to:

* **Detect threats that pre-deployment scanning cannot catch** — insider threats, zero-days, and runtime exploits that circumvent earlier controls
* **Continuously validate production workloads** — ensuring the security posture of running systems does not degrade between deployments
* **Create a feedback loop** — runtime anomalies inform and strengthen earlier-stage controls (code, build, deployment)
* **Enable faster incident response** — real-time detection reduces mean time to detect (MTTD) and mean time to respond (MTTR)
* **Protect AI systems in production** — extending runtime security to LLMs, agents, and AI-driven workloads