Dynatrace

Dynatrace is a publicly traded (NYSE: DT) observability and application performance monitoring platform, founded in 2005 in Linz, Austria and now headquartered in Waltham, Massachusetts. Its Application Security module, Runtime Vulnerability Analytics, is built on top of the same OneAgent instrumentation the company already uses for performance monitoring: rather than running a separate static or dynamic scan, it continuously watches custom code, open-source libraries, and container and language runtimes as they actually execute in pre-production and production, flagging vulnerable code paths that are reachable and in use.

The distinguishing idea is context. Because Dynatrace already tracks data flows, dependency graphs, and execution paths for performance purposes, it can attach real runtime evidence to a CVE, telling a team whether a vulnerable library function is actually invoked, exposed to the internet, or handling sensitive data, rather than surfacing every match a dependency scan finds regardless of exploitability. That reachability-based prioritization is the module’s core pitch against traditional SAST/DAST and software composition analysis tools that scan code or artifacts without full runtime context.

As a module bolted onto a much larger observability suite, Application Security’s adoption and roadmap are tied to Dynatrace’s broader platform strategy rather than existing as a standalone security product; its main competitors are more purpose-built application and cloud security posture vendors. For organizations already running Dynatrace OneAgent at scale, though, it turns performance telemetry they are already collecting into a genuine, low-friction vulnerability prioritization signal.