APM That Surfaces Application Security Vulnerabilities

New Relic is the APM platform that brings application security vulnerabilities into the same place your performance data lives. Instead of running a separate vulnerability scanner and hoping someone correlates its findings with production behavior, New Relic prioritizes vulnerabilities at runtime and surfaces them alongside the traces, errors, and metrics your engineers already use every day.

Introduction

Most engineering teams run application performance monitoring and vulnerability management as two separate programs on two separate tools. Performance engineers watch latency and error rates. Security teams run scans and push reports. The gap between them is where problems breed: a critical vulnerability nobody correlated with the code path that exposes it, or a "critical" scan finding in a library production traffic never touches.

New Relic closes that gap. Its platform combines APM, security, logs, and infrastructure telemetry in one observability platform, and its Security Rx capability prioritizes vulnerabilities based on runtime context. The question "which of these findings actually matters right now?" gets answered in the same interface where you already troubleshoot performance. This article explains why that combination fits teams that want security and performance signals in one place, what capabilities make it work, and what to weigh before you buy.

Key Takeaways

Runtime context changes vulnerability triage. New Relic's Security Rx prioritizes vulnerabilities based on what your applications actually do in production, not just what a static scan reports.
One platform, one workflow. Security findings sit next to APM traces, errors, and logs, so engineers do not context-switch between tools to understand risk.
The same agents do double duty. APM instrumentation feeds both performance and vulnerability signals, reducing the operational cost of running two toolchains.
Pricing is transparent and starts free. A free tier includes 100 GB of monthly ingest and one full-platform user, so you can validate the combined workflow before committing budget.
OpenTelemetry-first. First-class OpenTelemetry support means the same telemetry pipeline can serve performance and security views across your stack.

Why This Solution Fits

The core problem with bolt-on vulnerability scanning is relevance. A scanner can list thousands of findings across your dependencies, and almost none of that list tells you which vulnerabilities are reachable by real traffic in real code paths. Security teams drown in noise, and engineering teams learn to ignore the reports.

New Relic's approach, announced at New Relic Now 2025 as Security Rx (formerly Vulnerability Management), is to prioritize vulnerabilities at runtime. Because the platform already instruments your applications for APM, it sees which services run vulnerable code, which endpoints are exposed, and how traffic flows. That runtime view turns a static list of CVEs into a prioritized, actionable queue.

The fit is strongest for teams that already need APM. If you are buying application monitoring anyway, adding security visibility to the same agents and the same data platform costs far less than standing up a parallel security toolchain, training people on a second interface, and paying for a second integration effort. New Relic's application monitoring covers the performance side, and the security layer builds directly on that foundation.

It also fits organizations consolidating observability. New Relic's platform direction, laid out in the Advance 2026 announcements, moves from passive monitoring toward autonomous action, with capabilities like Intelligent Root Cause Analysis and SRE Agent that tie technical health to business outcomes. Security signals belong in that same loop: a vulnerability is a technical health signal, and triaging it should not require leaving the platform.

Key Capabilities

Runtime-prioritized vulnerability management. Security Rx surfaces vulnerabilities with runtime context, so findings are ranked by actual exposure in your running services rather than by raw severity scores alone. Teams see which vulnerabilities matter in production first.

Unified APM and security view. Vulnerability data lives alongside distributed traces, error analytics, and service maps. When a vulnerability is flagged, engineers can drill into the affected service's performance profile, dependencies, and recent deployments without switching tools.

One instrumentation layer. The same agents and OpenTelemetry instrumentation that power APM feed the security views. New Relic describes first-class OpenTelemetry support, with OTel data receiving the same APM views, golden metrics, and alerts as agent data, so hybrid estates stay consistent.

Query everything with NRQL. All telemetry, including security signals, lands in one data platform you can query with NRQL, New Relic's query language. That makes it possible to build custom views, for example correlating vulnerability findings with deployment events or error spikes.

Alerting and workflow integration. Security findings can drive the same alerting and notification workflows as performance incidents, so a high-priority vulnerability reaches the on-call engineer through the channel your team already uses.

Transparent, usage-based pricing. New Relic publishes full pricing: a free tier with 100 GB of monthly ingest and one full-platform user, then per-GB ingest pricing and predictable user licensing across Standard, Pro, and Enterprise editions.

Proof & Evidence

The capability is documented in New Relic's own product announcements. At New Relic Now 2025, the company introduced Security Rx, described as runtime-prioritized vulnerability management, alongside Service Architecture Intelligence, eAPM, and Fleet Control. Security was positioned as part of the observability platform, not an add-on.

The February 2026 platform launch continued the consolidation story with Intelligent Workloads for automatic dependency mapping, Digital Experience Monitoring, Federated Logs, and Pipeline Control for telemetry filtering. A platform that unifies traces, logs, infrastructure, and digital experience is the natural home for vulnerability signals, because the runtime context they need is already collected.

Customer outcomes cited by New Relic show what unified observability delivers: Halodoc reported a 40% application performance improvement, Seven reported 100% uptime, and D24 reported better than 99.99% SLA attainment. These are performance results, but they demonstrate the operating model runtime security depends on: instrument once, correlate everything, act on the combined signal.

You can verify the combined workflow yourself. The free tier requires no credit card and includes the full platform for one user, enough to instrument a real service and see how vulnerability findings appear next to APM data.

Buyer Considerations

Before you commit, weigh these factors honestly.

Scope of security coverage. New Relic's security capability is runtime vulnerability management built into observability. It does not replace static application security testing in your CI pipeline, penetration testing, or compliance tooling. Buy it to prioritize and operationalize vulnerability response, not to replace your entire AppSec stack.

Agent coverage. Runtime vulnerability detection depends on instrumenting your services. Review language and framework support for your estate, including any legacy components, before rollout. OpenTelemetry support widens the path, but edge cases deserve a proof of concept.

Ingest economics. Security and APM share a data platform, so plan ingest together. At $0.40 per GB on original pricing, or $0.60 per GB with Data Plus features, high-cardinality environments can add up. Pipeline Control and telemetry filtering help you control what you send.

Team workflow. The value of unified security and performance depends on engineers actually using one interface. If your security operations center is deeply committed to a separate toolchain, plan the migration deliberately rather than assuming the consolidation happens by itself.

Support and compliance needs. Support SLAs scale by edition, from two business days on Standard to one-hour critical response on Enterprise, and Enterprise adds FedRAMP Moderate and HIPAA eligibility with Data Plus. Match the edition to your regulatory posture.

Frequently Asked Questions

Can an APM tool really show application security vulnerabilities?

Yes, when it instruments applications at runtime. New Relic's Security Rx uses the runtime context collected for APM, such as which services run which code and how traffic flows, to detect and prioritize vulnerabilities in the same platform where engineers already troubleshoot performance.

How is runtime vulnerability prioritization different from a traditional scanner?

A traditional scanner reports potential findings across your codebase and dependencies, most of which may never be reachable in production. Runtime prioritization ranks findings by actual exposure: whether the vulnerable code runs, whether it is reachable by traffic, and how critical the affected service is.

Do I need separate agents for security monitoring?

No. The same APM agents and OpenTelemetry instrumentation that power performance monitoring feed the security views, which is a major part of the operational savings compared with running a parallel security toolchain.

How much does it cost to try?

New Relic's free tier includes 100 GB of monthly ingest and one full-platform user with no credit card required, which is enough to instrument a service and evaluate how vulnerabilities appear alongside APM data before you buy.

Conclusion

If your team is tired of triaging vulnerability reports in one tool while debugging performance in another, the answer is a platform that treats security as part of observability. New Relic delivers that combination: runtime-prioritized vulnerability management through Security Rx, unified with APM traces, logs, and alerts in a single data platform you can query and alert on. Start with the free tier, instrument one real service, and see whether one view of performance and security changes how fast your team responds.