Platform features
Every feature, from the runtime up
From learning and evaluating behaviour to CVE verdicts and kernel-enforced profiles, every bifrost feature is built on what your workloads actually do, not on what their images say they could do.
Runtime behavioural profiling
The bifrost agent learns how each container behaves in staging and test environments: system calls, file access patterns and network connections. bifrost then evaluates that behaviour against its own knowledge of how services on each framework behave, surfaces weaknesses and assesses how fully it has captured the workload: what the container does, not what it could do.
- Observes at the kernel level: no code changes needed
- Captures system calls, file access, signals, capabilities, network ports per container
- Flags weaknesses even when the profile must allow them: if your app reads /etc/passwd, it keeps working, and you keep tabs on it
- Collects behavioural metadata only: never application data or PII
CVE prioritisation and reachability analysis
bifrost ingests your SBOM data and maps known CVEs against the behaviour it has learned and evaluated. A first assessment of CVE exploitability sharpens into one verdict per CVE: reachable, mitigated by the profile, or never loaded. Your team works the reachable list, up to 90% fewer CVEs to triage, each verdict with its evidence.
- Ingests CycloneDX and SPDX SBOMs for each build
- Correlates CVEs against actual runtime behaviour
- Never-loaded code paths and profile-mitigated vectors marked as such, with the evidence
CVE tracking per build
Every build is scanned and every service version keeps its own CVE picture, so you can see the trend across releases: which version added exposure, which one removed it, and how much of it the security profile already mitigates. A regression shows up on the next build, not at the next audit.
- CVEs tracked per service version, by severity, across every environment the build runs in
- Trend lines across releases show where exposure went up or down
- Toggle mitigated CVEs off to see only what is still reachable
Automated security profile generation
bifrost generates a tailored security profile for every container from its learned behaviour and built-in knowledge, fresh with every build. In enforce mode, only that behaviour is allowed and the kernel blocks everything else by default, including what an exploit not yet discovered would need. Your team decides when each workload moves from observe to enforce. No profiles written by hand, no YAML wrangling. Under the hood, each profile is a standard AppArmor profile enforced by the Linux kernel.
- Regenerates each workload's profile with every build
- Default-deny in enforce mode: only learned behaviour is permitted
- Profiles automatically delivered via the agent
Continuous CVE monitoring
bifrost re-scans the SBOM of every deployed workload through the day, across all your environments, and re-evaluates every CVE against the workload context it already holds, without rebuilding or rescanning the workload. When a new CVE is disclosed, the assessment leads with protection status: whether an enforced profile already blocks what the exploit needs. Then which workloads carry it, whether the vulnerable code is loaded, and what to do next.
- Every active SBOM re-scanned through the day, from staging to production
- New CVEs assessed in a set order: protection status, scope, exposure, next action
- No rebuild and no new scan of the workload to assess a new CVE
Alerts where you already work
bifrost isn't another dashboard to check. It delivers verdicts and blocked events, each with its context, into the tools your team already uses: Slack, Microsoft Teams, webhooks or your SIEM. Answers go back into the development loop, to whoever writes the next change. When an enforced profile blocks an operation, or a new CVE reaches a running workload, the right people get it in the right channel.
- Native integrations with Slack, Microsoft Teams, and major SIEM platforms
- Webhook support for custom integrations: pipe events into any system you run
- Metrics export to Prometheus and Grafana for security posture dashboards
Technical specifications
Built for production workloads: a DaemonSet per node, enforcement by the kernel, and no sidecars.
Enforcement
AppArmor LSM
Deployment
DaemonSet via Helm
Setup
One Helm chart
Performance impact
< 1% CPU
SBOM formats
CycloneDX, SPDX
Data residency
Swedish and EU hosting
See it on your cluster
Book a demo, or start a 14-day trial: one Helm chart, and a first assessment of CVE exploitability in under 10 minutes.