ebpf
Safeguard articles tagged "ebpf" — guides, analysis, and best practices for software supply chain and application security.
21 articles
Deploying Cilium Tetragon for eBPF Runtime Security in 2026
A practical guide to rolling out Tetragon for kernel-level runtime visibility, covering policy authoring, performance overhead, and integration with existing detection pipelines.
Tetragon vs Falco: 2026 Runtime Security Field Test
Both Tetragon and Falco run on eBPF and both ship as CNCF projects. We benched them side by side on a 400-node cluster — coverage, overhead, and enforcement behavior.
Container Runtime Scanning: Catching Threats After Deployment
Container runtime scanning watches workloads while they run, catching drift, new CVEs, and active exploitation that build-time scans miss entirely.
What is Runtime Protection
Runtime protection catches what pre-deployment scanning can't — live attacks like the XZ Utils backdoor and Log4Shell exploitation, detected only in production.
Cilium Tetragon Runtime Security with eBPF
A practical look at Cilium Tetragon for Kubernetes runtime security, what eBPF gives you that audit logs do not, and where Tetragon fits in a real stack.
Deploying Falco for Runtime Security in 2026
A pragmatic deployment guide for Falco 0.41 in production Kubernetes: driver selection, rule tuning, alert routing, and the operational debt teams underestimate.
Cilium Network Security in Kubernetes: Beyond Basic Network Policies
Cilium uses eBPF to provide network security that standard Kubernetes NetworkPolicies cannot match. Here is what it adds and how to configure it.
eBPF for Security Monitoring: What It Can and Cannot Do
eBPF is being called the future of security observability. It is genuinely powerful, but it is not a magic bullet for runtime security.
Container Runtime Security Monitoring: Catching What Scanners Miss
Image scanning finds known vulnerabilities before deployment. Runtime monitoring catches actual exploitation, zero-days, and behavioral anomalies after deployment. You need both.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.