Platform features
Everything you need for runtime security
From behavioural observation to automated enforcement and intelligent CVE prioritisation, bifrost covers the full runtime security lifecycle.
Runtime behavioural profiling
The bifrost agent observes how each container actually behaves in staging and test environments: system calls, file access patterns, and network connections. It builds a precise behavioural model of each workload, capturing what the container does rather than what it could do.
- Observes at the kernel level: no code changes needed
- Captures system calls, file access, signals, capabilities, network ports per container
- Collects behavioural metadata only: never application data or PII
CVE prioritisation and reachability analysis
bifrost ingests your SBOM data and maps known CVEs against real runtime behaviour. Every CVE gets a verdict: reachable, mitigated by the profile, or never loaded. Your team works the reachable list, with the evidence behind each verdict.
- Ingests CycloneDX and SPDX SBOMs for each build
- Correlates CVEs against actual runtime behaviour
- Never-loaded code paths and profile-mitigated vectors marked as such, with the evidence
CVE tracking per build
Every build is scanned and every service version keeps its own CVE picture, so you can see the trend across releases: which version added exposure, which one removed it, and how much of it the security profile already mitigates. A regression shows up on the next build, not at the next audit.
- CVEs tracked per service version, by severity, across every environment the build runs in
- Trend lines across releases show where exposure went up or down
- Toggle mitigated CVEs off to see only what is still reachable
Automated security profile generation
bifrost automatically generates a tailored security profile for every container from its observed behaviour. Only what was observed is allowed. Everything else is blocked by default. No manual profile writing, no yaml wrangling, no drift. Under the hood, each profile is an AppArmor profile enforced by the Linux kernel.
- Generates a security profile per workload automatically
- Default-deny posture: only observed behaviour is permitted
- Profiles automatically delivered via the agent
Continuous CVE monitoring
bifrost doesn't just scan once at build time and move on. It continuously rescans SBOMs for every deployed workload across all your environments. When a new CVE is discovered, you know within minutes which workloads are affected, whether the vulnerable code is reachable at runtime, and whether your security profiles already block the attack vector.
- Continuous SBOM rescanning across all environments: staging, production, everything
- Instant impact assessment when new CVEs drop: affected workloads, reachability, and mitigation status
- Know immediately if a new CVE is already mitigated by an existing security profile
Alerts where you already work
bifrost isn't another dashboard to check. It delivers verdicts and blocked events, each with its context, directly into the tools your team already uses: Slack, Microsoft Teams, or your SIEM. When a security profile blocks unauthorised behaviour or a new CVE affects a running workload, the right people know immediately, in the right channel.
- Native integrations with Slack, Microsoft Teams, and major SIEM platforms
- Webhook support for custom integrations: pipe events into any system you run
- Metrics export to Prometheus and Grafana for security posture dashboards
Technical specifications
Built for production workloads. Minimal overhead, maximum protection.
Enforcement
AppArmor LSM
Deployment
DaemonSet via Helm
Resource Usage
< 200MB RAM per node
Performance Impact
< 1%
SBOM Formats
CycloneDX, SPDX
Data Residency
EU-hosted
See it on your cluster
Book a demo, or start a 14-day trial and see your first security profile in under 10 minutes.