RunSafe targets new cybersecurity niche for fielded software

RunSafe Security is positioning itself to lead Operational Software Assurance, a new category focused on protecting software already deployed in defense and critical infrastructure. The move comes as a White House strategy and independent research highlight a gap between finding vulnerabilities and securing operational systems in the field.

Why it matters: - Operational Software Assurance is aimed at software that is already running in weapons systems, energy grids, factories, vehicles, medical devices and other mission-critical environments. - The category addresses a gap that traditional software security leaves behind: vulnerability discovery keeps accelerating, but fielded systems can take months or years to patch, test and recertify. - The approach is becoming more relevant as AI speeds up both vulnerability discovery and exploit development.

What happened: - RunSafe Security said Sept. 8 that it plans to lead the emerging Operational Software Assurance market. - The company framed the market around protecting deployed software across the full operational lifecycle, from supply chain exposure through runtime. - The announcement followed the White House’s National Security Science and Technology Strategy, released Aug. 18, which elevates cybersecurity across U.S. technology and homeland defense priorities. - RunSafe tied its strategy to new independent research from former Gartner analysts Brad LaPorte and Rob Smith of Lionfish Tech Advisors.

The details: - The Lionfish report, The Call for a Digital Golden Dome, defines Operational Software Assurance as the next step beyond development security and software supply chain protection. - The report breaks OSA into three capabilities: Identify, Protect and Comply. - RunSafe says its platform identifies what is present in compiled software and firmware, including vulnerabilities, dependencies and whether vulnerabilities are reachable. - RunSafe says its platform protects deployed binaries and firmware with runtime protection that does not require source code changes or waiting for a patch. - RunSafe says its platform supports compliance by generating continuous assurance evidence and artifacts for cybersecurity, regulatory and mission requirements. - CEO Joseph M. Saunders said cybersecurity has improved at finding vulnerabilities, but that does not protect aircraft, weapons platforms, energy systems, factories and other critical infrastructure already in operation. - Saunders said AI is making the gap harder to ignore because defenders and attackers can both use AI to move at machine speed. - CTO Shane Fry said defenders cannot assume they will find, patch, test and recertify every vulnerability before an adversary exploits it. - The White House strategy places a next-generation missile defense shield under a Golden Dome for America alongside protection of critical data, networks, assets and infrastructure from cyberattacks and espionage. - The strategy maps critical and emerging technologies to priority national security needs, including battlefield advantage, undersea superiority, national-security AI and autonomy, border security, nuclear deterrence and missile defense, cyber defense, and biological weapons defense. - Those missions depend on software that can stay operational for years or decades. - The Lionfish report describes Embedded Runtime Security as the Protect component of Operational Software Assurance. - The report’s Digital Golden Dome framework applies a missile-defense principle to software by blocking threats that reach deployed systems instead of assuming every threat can be eliminated in advance. - RunSafe says its runtime protection technology came out of DARPA-funded research. - RunSafe says the technology protects compiled binaries and firmware without source code changes. - RunSafe says the technology is available through the Department of War’s Iron Bank and is used across defense, aerospace and critical infrastructure environments.

Between the lines: - The announcement is as much a category-creation move as a product update. RunSafe is trying to define the language and market structure around protecting software after deployment. - The White House strategy gives the message policy tailwinds, especially for long-lived systems that cannot easily be rewritten or replaced. - The research also tries to quantify exposure, not revenue, which suggests the market opportunity may be larger than current cybersecurity budgets reflect. - AI is strengthening the case for runtime defenses because discovery speed is now outpacing remediation speed.

What's next: - RunSafe says OSA will extend beyond defense into industrial control systems, energy, automotive, medical devices, telecom, rail, robotics and space. - The company expects adoption to grow where software is long-lived, hard to patch and tied directly to physical or mission outcomes. - The Lionfish report estimates more than 140 funded U.S. defense programs across 19 Department of War components fall within the scope of runtime protection. - Those programs represent about $87 billion in FY2026 procurement and $159.5 billion in the FY2027 request, which the researchers describe as software exposure rather than market revenue. - RunSafe is inviting readers to learn more about its approach to Operational Software Assurance here.

The bottom line: - RunSafe is betting that the next cybersecurity battleground is not software development alone, but the software already in the field that national security and critical infrastructure depend on every day.