Congruent Media Resourcing LLC v. Rapid7 Inc

I. Executive Summary and Procedural Information

• Parties & Counsel:
  • Plaintiff: Congruent Media Resourcing LLC (Texas)
  • Defendant: Rapid7, Inc. (Delaware)
  • Plaintiff's Counsel: Direction IP Law
• Case Identification: 7:26-cv-00155, W.D. Tex., 07/16/2026
• Venue Allegations: Plaintiff alleges venue is proper because Defendant maintains a place of business in the district and has allegedly committed acts of patent infringement within the district.
• Core Dispute: Plaintiff alleges that Defendant's cybersecurity products, which provide endpoint and application protection, infringe a patent related to methods for creating and operating secure software applications.
• Technical Context: The technology concerns application security, specifically methods of modifying compiled applications without source code access to enforce security policies, a practice often referred to as "app wrapping" or Runtime Application Self-Protection (RASP).
• Key Procedural History: This filing is an Amended Complaint. The complaint alleges Defendant became aware of the patent and its infringement at least as of the date of service of the Original Complaint, forming the basis for allegations of post-suit willful infringement.

Case Timeline

Date	Event
2011-10-10	'418 Patent Priority Date
2015-09-15	'418 Patent Issue Date
2018-10-15	Rapid7 announces acquisition of tCell.io, Inc.
2026-07-16	Amended Complaint Filing Date

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 9,135,418 - "System and Method for Creating Secure Applications"

• Patent Identification: U.S. Patent No. 9,135,418 ("the '418 Patent"), "System and Method for Creating Secure Applications," issued September 15, 2015.

The Invention Explained

• Problem Addressed: The patent's background describes corporate concerns over security breaches that can arise from employees using personal devices for work, as applications on those devices may contain malware or other questionable code that could compromise sensitive corporate data '418 Patent, col. 1:25-41 At the time, enterprises had limited ways to manage applications on employee devices '418 Patent, col. 1:33-36
• The Patented Solution: The invention provides a method for transforming a "target application" into a "secure application" without needing access to its source code '418 Patent, abstract This is achieved by binding one or more "intercepts" to the target application, which can modify or override the application's original behavior to enforce security policies '418 Patent, col. 1:54-61 The modified application is then "repackaged" with the intercepts integrated, creating what can be an "immutable deployable entity" '418 Patent, col. 2:4-10 A securitization agent can be used to inject these intercepts between the application and system APIs, as illustrated in the patent's Figure 10 '418 Patent, Fig. 10
• Technical Importance: This "app wrapping" approach addressed a critical need in the enterprise "Bring Your Own Device" (BYOD) environment by enabling security controls to be applied to third-party applications after they have been compiled Compl. ¶13

Key Claims at a Glance

• The complaint asserts independent claims 1 and 9 Compl. ¶¶26-27
• Claim 1 (Method of operating a secure application):
  • receiving a request to activate the secure application, where the secure application was created from a target application and has a second set of functions imposed on the target's first set of functions;
  • in response, forcing the secure application to override the first application behavior with a second application behavior that takes priority; and
  • via a processing unit, performing the second application behavior.
• Claim 9 (Method of generating a secure application):
  • via a processor: receiving a target application;
  • configuring the target application by imposing one or more intercepts on it, converting it into a secure application that maintains interaction with the operating system; and
  • repackaging the secure application such that the intercepts are integrated and inseparable from it.
• The complaint does not explicitly reserve the right to assert dependent claims, but this is standard practice.

III. The Accused Instrumentality

Product Identification

• The complaint identifies "Rapid7's Insight Agent with Endpoint Prevention" and "Rapid7 tCell" as the Accused Instrumentalities Compl. ¶28

Functionality and Market Context

• Insight Agent with Endpoint Prevention is described as endpoint security software that provides threat visibility by collecting system information and running processes from assets Compl. ¶29 It uses "prevention engines" that, based on a configured policy, can automatically respond to detected threats by taking actions such as "Block" (terminating malicious processes) or "Disinfect" (removing threats from files), thereby overriding the asset's default behavior (Compl. ¶29; Compl. ¶31). The complaint includes an architectural diagram showing how the Insight Agent and its features fit within Rapid7's broader security ecosystem Compl. p. 12
• Rapid7 tCell is described as a Runtime Application Self-Protection (RASP) technology that combines Web Application Firewall (WAF) and RASP capabilities to protect web applications Compl. ¶33 It operates by injecting an agent into the application's runtime environment (e.g., JVM or CLR) to intercept the application's internal file I/O and other operations from within, allowing it to monitor and block malicious requests "at the code level" Compl. ¶35 The complaint provides a diagram from Rapid7's materials showing the tCell Agent integrating with a web application to monitor requests Compl. p. 23

IV. Analysis of Infringement Allegations

'418 Patent Infringement Allegations (Claim 1)

Claim Element (from Independent Claim 1)	Alleged Infringing Functionality	Complaint Citation	Patent Citation
receiving a request to activate the secure application through an input device, wherein the secure application was created from a target application having a first set of functions associated with a first application behavior and the secure application has a second set of functions that are imposed on the first set of functions and that are associated with a second application behavior;	The Insight Agent monitors the endpoint for a user or system attempting to launch a "target application," which is alleged to be any untrusted or malicious executable (e.g., ransomware payload). The "second set of functions" are the prevention engines imposed by the Insight Agent.	¶30	col. 9:1-10
in response to the receipt of the request, forcing the secure application to override the first application behavior with the second application behavior, wherein the second application behavior takes priority over the first application behavior; and	When configured to "Block," the Insight Agent actively blocks threats by terminating malicious processes or denying access to files. This is alleged to be an override of the first application behavior (the malicious action) with the second application behavior (the protective action).	¶31	col. 9:11-18
via a processing unit, performing the second application behavior.	The Insight Agent, via a processing unit, performs the "second application behavior" by, for example, preventing malware from making deceptive modifications to files and processes as part of a "File and Process Manipulation Attacks" prevention engine.	¶32	col. 9:19-20

'418 Patent Infringement Allegations (Claim 9)

Claim Element (from Independent Claim 9)	Alleged Infringing Functionality	Complaint Citation	Patent Citation
via a processor: receiving a target application that is designed to interact with an operating system;	Rapid7 tCell is alleged to receive a target application, such as a web application, for protection.	¶34	col. 41:20-23
configuring the target application by imposing one or more intercepts on the target application, wherein the imposition of the intercepts converts the target application into a secure application that maintains the interaction with the operating system; and	The tCell agent is injected into the application's runtime environment (e.g., JVM) to intercept internal operations. The complaint alleges this in-memory instrumentation constitutes "imposing one or more intercepts" that converts the application. A Rapid7 screenshot describes this as layering security "onto the runtime process of applications themselves" Compl. p. 22	¶35	col. 41:24-30
repackaging the secure application such that the intercepts are integrated with the secure application and are inseparable from the secure application.	The complaint alleges that tCell's "in-memory instrumentation repackages the secure application" by making its monitoring intercepts "structurally integrated into the application's internal execution path, rendering them inseparable from the application process during its lifecycle."	¶35; ¶36	col. 41:31-35

• Identified Points of Contention:
  • Scope Questions: Claim 9 requires "repackaging" the application so intercepts are "inseparable." A central question will be whether tCell's runtime, in-memory instrumentation meets this limitation. The patent's description of creating an "immutable deployable entity" '418 Patent, col. 2:9-10 may suggest a static, pre-deployment process, whereas tCell's agent is injected into an application's live runtime environment Compl. ¶35
  • Technical Questions: For Claim 1, the infringement theory posits that a malicious executable ("target application") becomes a "secure application" when Insight Agent blocks its malicious behavior. A question for the court will be whether blocking or terminating a malicious process constitutes the creation and operation of a "secure application" with a "second set of functions," as the claim requires, or if there is a mismatch between terminating a process and operating a modified, functional application.

V. Key Claim Terms for Construction

• The Term: "repackaging the secure application such that the intercepts are integrated with the secure application and are inseparable from the secure application" (Claim 9)

  • Context and Importance: This term is critical for the infringement allegation against Rapid7 tCell. Its construction will determine whether tCell's runtime instrumentation falls within the scope of the claim. Practitioners may focus on this term because it pits the patent's language about creating a durable, modified application against the accused product's dynamic, in-memory operation.
  • Intrinsic Evidence for Interpretation:
    • Evidence for a Broader Interpretation: The patent specification mentions that linking may be "statically or dynamically linked, and that priority can be established during runtime," which may support an interpretation that includes runtime integration '418 Patent, col. 25:6-9 The complaint argues that tCell's in-memory instrumentation renders intercepts "inseparable from the application process during its lifecycle" Compl. ¶35
    • Evidence for a Narrower Interpretation: The specification describes repackaging as resulting in an "immutable deployable entity" and notes this feature can "prevent the secure application from having the intercepts removed by an unauthorized party" '418 Patent, col. 2:7-11 This language may support a narrower construction requiring the creation of a new, persistent, and tamper-resistant application file, rather than just in-memory modification.

• The Term: "secure application" (Claim 1)

  • Context and Importance: This term's definition is central to the infringement allegation against the Insight Agent. The case may turn on whether an originally malicious application that is blocked or terminated at runtime can be considered a "secure application" that is "operating" with a "second application behavior."
  • Intrinsic Evidence for Interpretation:
    • Evidence for a Broader Interpretation: The patent defines the "behavior of the secure application" as being "different from the original behavior of the target application" '418 Patent, col. 1:59-61 Plaintiff's theory is that the "different" behavior is the protective action (e.g., blocking) imposed by the Insight Agent (Compl. ¶31). The claim language focuses on "overrid[ing] the first application behavior with the second application behavior" Compl. ¶26, which could be read to include blocking an unwanted behavior.
    • Evidence for a Narrower Interpretation: The patent repeatedly describes a process of creating a secure application that is then published, installed, and operated '418 Patent, col. 3:5-10 '418 Patent, col. 24:16-20 This suggests the "secure application" is a transformed, functional entity, not simply a terminated malicious process. The claim states the secure application "has a second set of functions," which may imply more than just the absence of the first set of functions.

VI. Other Allegations

• Indirect Infringement: The complaint alleges both induced and contributory infringement Compl. ¶37 The allegations are based on Defendant providing the Accused Instrumentalities to its customers with the knowledge and intent that their use will infringe, supported by Defendant's marketing materials, instructional guides, and user manuals Compl. ¶¶37-39
• Willful Infringement: Plaintiff alleges willful infringement based on Defendant's continued infringement after having knowledge of the '418 Patent, with knowledge dating from "at least as of the date of the service of the Original Complaint" Compl. ¶38 Compl. ¶39 This establishes a claim for post-suit willfulness, as no pre-suit knowledge is alleged.

VII. Analyst's Conclusion: Key Questions for the Case

• A core issue will be one of definitional scope: can the term "repackaging...such that the intercepts are...inseparable," which the patent links to an "immutable deployable entity," be construed to cover the dynamic, in-memory instrumentation performed by the accused tCell product during an application's runtime?
• A second central issue will be one of functional identity: does the accused Insight Agent's function of blocking or terminating a malicious process at runtime create a "secure application" that is "performing the second application behavior" as required by Claim 1, or does the claim require the transformation of a target application into a new, operational, and secure version?