Runtime Correlation

ByteHide AI connects what Radar finds in your code with what Monitor sees in production. A vulnerability is not just "medium severity" — it's "medium severity, actively exploited, last attack 2 hours ago".

Why Runtime Context Matters

Static analysis tells you a vulnerability exists. Runtime correlation tells you if anyone is actually attacking it.

How It Works

When both Radar (SAST/SCA/Secrets) and Monitor (RASP) are active on the same project, they share data automatically through the ByteHide platform. No additional configuration is needed.

Escalation: theoretical to actively exploited

1. Radar flags a SQL injection in /api/users — assigns it Medium severity
2. Monitor detects 47 SQL injection attempts targeting that exact endpoint this week

Click to expand

3. Radar receives the runtime signal and escalates the finding to Critical
4. The finding shows a "Runtime Confirmed" indicator with a link to the Monitor incidents

De-escalation: flagged but unreachable

1. Radar flags an SSRF with Critical severity (CVSS 9.1)
2. Monitor confirms the endpoint is internal-only, behind authentication, unreachable from external traffic
3. Radar adjusts the priority to Medium — your team stops wasting time on it

Attack detail and AI analysis

When Monitor detects an attack, it captures the full context: payload, injected content, SQL query, stacktrace, and origin. You get the exact data you need to understand the attack.

Click to expand

Monitor also provides an AI-powered analysis that explains what happened, why it matters, the attack vector, and the severity — all in plain language.

Click to expand

MCP: Runtime Context in Your AI Conversation

When you use ByteHide through MCP, runtime correlation enriches the responses your AI agent gives you. Instead of just reporting a static finding, the AI can tell you:

• "This dependency has a known vulnerability and it's running in your production environment"
• "The last attack targeting this endpoint was today at 11:00"
• "This vulnerability is actively being exploited — 47 attempts this week"
• "Monitor is currently blocking attacks against this while you prepare the fix"

This turns security conversations from theoretical ("this could be vulnerable") into actionable ("this is under attack right now, here's what to do").

Example: dependency check with runtime context

When you ask your AI agent to check a dependency, the MCP doesn't just report the CVE — it cross-references with Monitor to tell you if that vulnerable dependency is loaded in a running application:

You: Is express@4.17.1 safe?

Claude: express@4.17.1 has 3 known CVEs (1 Critical, 2 High).

        ⚠️ Runtime alert: This exact version is currently running in
        your "api-gateway" production environment. Monitor detected
        2 exploit attempts targeting CVE-2024-43796 in the last 24h.

        Recommended: upgrade to express@4.21.0

You: Is express@4.17.1 safe?

Claude: express@4.17.1 has 3 known CVEs (1 Critical, 2 High).

        ⚠️ Runtime alert: This exact version is currently running in
        your "api-gateway" production environment. Monitor detected
        2 exploit attempts targeting CVE-2024-43796 in the last 24h.

        Recommended: upgrade to express@4.21.0

Example: code scan with runtime enrichment

When you scan code for vulnerabilities, findings that match active attacks in Monitor get flagged immediately:

You: Scan this file for vulnerabilities

Claude: Found 3 vulnerabilities:

        🔴 SQL Injection (CWE-89) — line 47 [RUNTIME CONFIRMED]
           47 exploit attempts this week targeting /api/users
           Monitor is blocking attacks. Fix urgently.

        🟡 XSS (CWE-79) — line 112
           No runtime activity observed

        🟡 Path Traversal (CWE-22) — line 89
           Endpoint is internal-only (Monitor confirms unreachable)

You: Scan this file for vulnerabilities

Claude: Found 3 vulnerabilities:

        🔴 SQL Injection (CWE-89) — line 47 [RUNTIME CONFIRMED]
           47 exploit attempts this week targeting /api/users
           Monitor is blocking attacks. Fix urgently.

        🟡 XSS (CWE-79) — line 112
           No runtime activity observed

        🟡 Path Traversal (CWE-22) — line 89
           Endpoint is internal-only (Monitor confirms unreachable)

The AI agent prioritizes the SQL injection first because it's the one under active attack — not because it has the highest CVSS score.

AI-Assisted Security During Development

Runtime correlation is not only for triage. When your AI coding agent has access to ByteHide MCP, security becomes part of the development conversation in real time:

• While writing code — the AI can scan what you're writing for vulnerabilities before you even commit
• Before installing dependencies — check if a package is safe and whether similar vulnerable versions are already running in production
• During code review — the AI can audit the diff for security issues and flag anything that matches known attack patterns from Monitor
• When debugging — if Monitor detected an attack, the AI can explain the incident, show you the vulnerable code, and suggest the fix

The MCP tools are available throughout the conversation. You don't switch to a separate security tool — the AI proactively uses ByteHide as part of its workflow.

Impact on Prioritization

Without runtime correlation, priority is based on severity score alone:

With runtime correlation from Monitor:

The SSRF had the highest CVSS score, but runtime data shows it's unreachable. The SQL injection had a lower score, but it's actively under attack. Runtime correlation ensures your team fixes the right thing first.

False Positive Reduction

Runtime correlation reduces false positives by up to 90% through three mechanisms:

Setup

Runtime correlation activates automatically when both products are connected:

1. Create a Radar project and connect your repository
2. Set up Monitor on the same application
3. Both products share data through the ByteHide platform automatically

No additional configuration is needed. When Monitor detects an attack that matches a Radar finding, the correlation appears in both dashboards within seconds — and becomes available to your AI agent through MCP.

Next Steps