Gartner Names Oligo a Sample Vendor in ADR and Reachability Analysis: Why Runtime Is Where the Truth Lives

The 2026 Gartner Hype Cycle for Application Security placed Application Detection and Response (ADR) at the Peak and Reachability Analysis on the Slope of Enlightenment. Two categories, one story. Security teams have run out of room to defend modern applications with tools that can't see what code is actually running.

What ADR is, and what it is not

ADR observes applications at execution. It watches the functions being invoked, the syscalls being made, and the exploits that begin to unfold inside the workload. ADR is not a scanner run before deployment. ADR is not perimeter filtering. ADR is the layer that catches exploitation as it happens, and buys time to patch through virtual patching at the workload.

Reachability Analysis answers a different question. Which vulnerabilities in this codebase are actually loaded and executed in production. Together, they close a gap the older runtime layers were never built to cover.

Why the older runtime model breaks

Workload protection hardened the host. Cloud posture platforms unified misconfiguration signals. Web application firewalls filtered malicious traffic at the perimeter. Each solved a real problem in its era.

That model breaks because attacks don't stop at the infrastructure layer or the network edge. They land inside the application, in a function that deserializes untrusted input or renders a template with attacker-controlled data. Cloud Security teams see symptoms after the fact: unusual container activity, log anomalies, a process that shouldn't be running. AppSec teams get vulnerability lists that don't separate theoretical risk from active exposure. SOC analysts get alerts one layer removed from where the exploit executed. For a deeper comparison of ADR against these adjacent approaches, see how it compares to other runtime security approaches.

Exploitation collapsed from days to hours

Time-to-exploit data tells the story bluntly. What used to take attackers months now takes hours, and in many cases minutes. Generating working exploit code, mutating payloads, chaining CVEs across a target is only becoming easier as frontier and open-weight models evolve daily.

Patch cycles cannot keep up. If the mean time to exploit is shorter than the mean time to patch, prevention has to happen where the exploit executes. Not upstream, where it was supposed to be caught.

Advanced AI is cheap and everywhere

The economics of offense have shifted. What required a skilled operator two years ago now runs on a $20 subscription. Autonomous penetration tools discover vulnerabilities at scale. Frontier models write functional exploits from a CVE description. Runtime observation is the only vantage point that keeps pace, because it watches what's executing rather than what a scanner predicted might be reachable.

Agentic applications accept nearly infinite inputs

Traditional applications had structured inputs. Forms, API contracts, defined schemas. Agentic applications accept anything a user or upstream system can express in natural language, and translate it into tool calls, code execution, and system actions.

The input surface is unbounded, and prompt filters cannot enumerate every manipulation technique. The consistent signal isn't the prompt. It's the resulting execution: the syscall, the process spawn, the outbound connection. Runtime observation catches the deviation regardless of how the attacker phrased the request.

The takeaway

Reachability answers what to fix first. ADR stops what's being exploited right now. Delivered from a single sensor with visibility into both application code execution and OS-level activity, they give AppSec, Cloud Security, SOC, and security leadership one operational view of runtime truth. That's the shift Gartner's placement reflects, and it's the shift that's driving the market.