RS Runtime Security Observability + Control
Start Free Read Docs
eBPF-powered runtime protection

See every process, file, and network event across your infrastructure in real time.

Runtime Security is a lightweight eBPF sensor that monitors what actually happens inside your Kubernetes clusters, containers, and Linux hosts. It detects threats, surfaces vulnerabilities, and lets you enforce security policies -- all from one dashboard.

Start Free Explore Features Deployment Docs
Zero instrumentation eBPF hooks into the kernel -- no code changes, no sidecars, no restarts needed.
Threat + compliance Findings mapped to MITRE ATT&CK and PCI DSS so you can triage and report faster.
One sensor, any target Same agent runs on bare-metal Linux, Docker, Kubernetes, EKS, and ECS.

How it works

From install to protection in five minutes

One sensor gives you full runtime visibility. No code changes, no complex configuration.

Step 2

Deploy the sensor

Run a single command to install the eBPF sensor in your environment.

Standalone Docker K8s EKS ECS
Step 3

See runtime activity

Process, file, and network events stream into your dashboard within seconds of deployment.

Step 4

Investigate findings

Threats and vulnerabilities surface automatically with severity, MITRE mapping, and event context.

Step 5

Enforce policies

Set file, process, and network rules based on what you found. The sensor enforces them at the kernel level.

Ready to see it in your environment?

Create a free account, deploy the sensor, and start seeing runtime activity in minutes.

Start Free Deployment Docs

What you get

One sensor covers three problems

Most teams use separate tools for visibility, detection, and enforcement. Runtime Security handles all three from a single eBPF agent.

Runtime event stream

Every process execution, file access, and network connection is captured at the kernel level and visible in your dashboard in real time.

AI-scored threat findings

Raw events are correlated and scored by an AI evaluation engine. You see prioritized findings with MITRE ATT&CK and PCI DSS context, not raw logs.

Kernel-level policy enforcement

Define file, process, and network rules in the dashboard. The sensor enforces them via Linux Security Module hooks -- blocking happens in the kernel, not in userspace.

Detection in action

What findings look like in your dashboard

These are real detection categories. Each finding links directly to the event timeline so you can see exactly what happened, when, and where.

MITRE ATT&CK T1059 Command and Scripting Interpreter 18 events across production namespaces in the last 30 minutes.
PCI DSS Requirement 10.2 high-risk event cluster 9 audit-linked events with privileged command execution.
Vulnerability CVE-linked runtime signal in payment service image Image hash drift observed after container restart.
Exposure Unexpected open admin port on non-managed container Port surfaced after deployment policy bypass.

Process Alerts

Prioritized by severity and recent activity
  • bash spawned by nginx in production containerhigh
  • curl executed with external IOC domain argumentmedium
  • chmod 777 on executable path under /usr/local/binmedium
  • scp initiated from host to unknown destinationlow

Enforce at the kernel

Turn detections into policies that actually block

When you find something wrong, create a policy. The sensor enforces it via eBPF and LSM hooks -- no firewall rules, no iptables, no restart.

File Monitoring Control

Watch sensitive files, configuration paths, and drift-prone binaries with policy scoping.

  • Include and exclude path rules
  • Read and write action filters
  • Policy templates for high-risk files

Process Monitoring Control

Control runtime execution with process-based include/exclude patterns and context filters.

  • Binary and command pattern controls
  • Per-host and container targeting
  • Drift and privilege escalation focus

Network Monitoring Control

Monitor DNS and egress behavior with policy-level baselines for runtime activity.

  • Protocol and endpoint-focused rules
  • Service and namespace segmentation
  • IOC-aware runtime monitoring hooks

One command to deploy

Runs wherever your workloads run

Choose the deployment method that matches your environment. Every method gives you the same full feature set -- same dashboard, same findings, same policies.

Standalone

Linux Host Binary

Install directly on Linux hosts for rapid proof of value and full host-level visibility.

Docker

Docker Runtime

Run as a privileged container where Docker is primary runtime and keep full event plus control coverage.

Kubernetes

K8s Clusters

Deploy with cluster manifests for namespace, pod, and container telemetry with unified policy controls.

EKS

AWS EKS

Use AWS-tailored deployment for managed Kubernetes while preserving full detection and policy features.

ECS

AWS ECS

Deploy on ECS EC2 launch type for task-level runtime visibility and centralized investigation workflow.

How data flows

Sensor to dashboard in three hops

Nothing changes about where or how your applications run. A lightweight sensor attaches to the kernel, captures security-relevant activity, and sends it to your console.

Your environment

Linux hosts, Docker, Kubernetes, EKS, or ECS workloads where your applications already run.

Runtime sensor

The sensor is installed with one of the deployment commands and watches process, file, and network activity.

Runtime Security console

Events, findings, and policy controls are presented in one place so teams can review and respond.

Deployment walkthrough

Four steps from zero to live coverage

After sign-up, your dashboard shows personalized install commands with your credentials pre-filled. The examples below use placeholders -- your real values appear once you log in.

1

Choose a path

Pick Linux, Docker, Kubernetes, EKS, or ECS based on where your application runs.

2

Get your credentials

Your dashboard provides a unique customer ID and PIN. These link the sensor to your account.

3

Run the command

Install the sensor in the target environment with the matching command shown below.

4

Verify visibility

Open the console and confirm new findings, timeline activity, and policy coverage start to appear.

The commands below use placeholders. After you sign up, your dashboard shows the same commands with your real credentials pre-filled -- just copy and run.

Kubernetes

Direct cluster install.

kubectl create -f "https://runtimesecurity.in/k8s.php?code=YOUR_CUSTOMER_UUID&pin=YOUR_PIN"

Amazon EKS

Configure cluster access, then install.

aws eks update-kubeconfig --region <region> --name <cluster-name>
kubectl create -f "https://runtimesecurity.in/eks.php?code=YOUR_CUSTOMER_UUID&pin=YOUR_PIN"

Amazon ECS

EC2 launch type only.

curl -fsSL "https://runtimesecurity.in/ecs.php?code=YOUR_CUSTOMER_UUID&pin=YOUR_PIN" -o bpfaudit-ecs-task.yaml
aws ecs register-task-definition --cli-input-yaml file://bpfaudit-ecs-task.yaml
aws ecs update-service --cluster <ecs-cluster> --service <service-name> --force-new-deployment

Linux host

Run the downloaded binary on the host.

wget https://runtimesecurity.in/download/bpfagent-amd64
CUUID=YOUR_CUSTOMER_UUID PIN=YOUR_PIN ./bpfagent-amd64

Docker

Run the sensor as a privileged container.

docker run --rm -itd --privileged --pid=host --env CUUID=YOUR_CUSTOMER_UUID --env PIN=YOUR_PIN docker.io/bpfaudit/bpfaudit:latest

Under the hood

Platform architecture and data flow

See how the sensor, backend, AI evaluation engine, and dashboard connect. Telemetry flows left to right; policy enforcement flows back to the agents.

Read direction: runtime telemetry flows left to right. Policy updates flow right to left.

Technical diagram

Sensor to AI data path

go sensor -> eBPF hooks -> kprobe/tracepoint -> ringbuffer -> go processing -> backend -> database -> AI evaluation -> overview_enh.php

Technical foundations

Why this works where other tools can't

eBPF kernel instrumentation

Runs inside the kernel with near-zero overhead. No kernel modules to compile, no agents polling /proc. Built with Cilium eBPF libraries in Go.

kprobe and kretprobe hooks

Captures every file open, process exec, and network connect at the kernel function level -- nothing bypasses it because nothing bypasses the kernel.

LSM policy enforcement

Policies block at the Linux Security Module layer before the action completes. This means a blocked file write never touches disk.

Ring buffer transport

Events move from kernel to userspace via lock-free eBPF ring buffers. High throughput with predictable latency, even under heavy workloads.

Go normalization pipeline

Raw kernel events are decoded, enriched with container and namespace context, deduplicated, and batched before reaching the backend.

Live policy sync

Change a policy in the dashboard and it reaches the sensor within seconds. No sensor restart, no redeployment -- the eBPF maps update in place.

MITRE + PCI DSS mapping

Every finding is automatically classified against MITRE ATT&CK tactics and PCI DSS requirements so you can report without manual mapping.

SSL/TLS visibility

Uprobe-based hooks on OpenSSL and GnuTLS capture encrypted traffic metadata without terminating connections or installing certificates.

End-to-end path: kernel hooks capture events, ring buffers transport them to the Go agent, the backend stores and AI-scores them, and your dashboard displays the results.

See what's running in your infrastructure

Sign up, deploy the sensor in your environment, and get runtime visibility in under five minutes. Free to start.

Start Free Read Docs