For compliance and GRC teams
Enforced at the kernel, on the record
In enforce mode, bifrost holds each workload to its own security profile at the kernel. That enforcement keeps its own record: profiles, violation logs, SBOM histories and CVE timelines, kept as it runs rather than assembled once per audit. Use it as audit evidence of the boundaries in place. Swedish and EU hosting, with data residency by design.
What you're up against
Evidence assembled by hand, once per audit, across a growing pile of frameworks you answer to.
SOC 2
Trust services criteria
PCI DSS
v4.0 requirements
HIPAA
Technical safeguards
ISO 27001
Annex A controls
GDPR
Security of processing
NIST CSF
Protect and detect
NIS2
Cybersecurity risk measures
DORA
ICT risk management
CRA
Cyber Resilience Act
Example: the Cyber Resilience Act
Vulnerability handling under the CRA: the records bifrost keeps
The CRA asks software makers to know their components, keep an SBOM, find and fix vulnerabilities without delay, test their products regularly, and report actively exploited vulnerabilities within 24 hours. bifrost keeps a record that bears on each of them, build by build.
Evidence, not certification: bifrost produces the record. How it maps to each obligation is a decision for you and your auditor.
An SBOM per build, re-scanned through the day. A verdict on every CVE, reachable ones first. Profiles learned in pre-production and enforced in production. When a CVE is exploited in the wild, bifrost assesses it against the workload context it already holds, and the exposure report follows.
What changes with bifrost
bifrost is not a compliance tool. It enforces a security profile per workload at the kernel, and that enforcement keeps a record of the boundaries in place. You and your auditor decide how those records map to your controls.
A security profile per workload, enforced at the kernel
bifrost learns and evaluates what each workload does, the syscalls, files, network connections and capabilities it uses doing its job, and generates its profile from that and its built-in knowledge. In enforce mode the kernel blocks anything outside it. A fresh profile with every build, so nothing rots.
Every CVE with a verdict, in runtime context
An SBOM per workload, re-scanned through the day, and every CVE gets a verdict against what actually runs: reachable, mitigated by the profile, or never loaded. Up to 90% fewer CVEs to triage, and every verdict keeps its evidence.
Drift detection and change management
Runtime behaviour is compared with the workload's profile continuously. A new binary, an unexpected file write, a connection that was never part of the job: each is reported as drift with its deployment context, and blocked once the workload is in enforce mode.
Deviations blocked and reported, with their context
In enforce mode, anything outside the profile is blocked at the kernel, and every blocked action becomes an event with its context: pod, image, profile, the attempted action and what was denied. It feeds your SIEM and alerting, so nothing reaches a human without its context.
Records for audit preparation
One view of the records enforcement keeps. Export profiles, violation logs, SBOM histories and CVE timelines whenever an auditor, a regulator or a customer asks.
Third-party software and the supply chain
The same profiles apply to vendor and third-party workloads. With the SBOM alongside, you know what third-party code is running, what it is allowed to do, and which of its CVEs are reachable in your environment.
What you can show
Profiles, violation logs, SBOM histories and CVE timelines are a consequence of enforcement, not something assembled by hand before an audit. The order matters: enforcement comes first, and the evidence follows from it.
Profiles are documented
Every workload's profile is stored as code: a readable statement of what it is allowed to do, versioned with every build.
Enforcement is automatic
Once a workload is in enforce, its profile is enforced at the kernel on every deploy, with no manual step to forget. Your team decides when each workload moves to enforce, and acts on the verdicts that need attention.
Everything is logged
Every blocked action and every deviation is recorded with its context and timestamp, from the first deploy onwards.
Records are ready
Export the records whenever the auditor or the regulator asks.
Sample audit evidence
# Security profile for payment-service
Profile: payment-service-v2.3.1
Status: Enforcing
Last updated: 2026-09-21T10:30:00Z
# Blocked actions (last 24h)
Blocked: 47 unauthorised syscalls
Blocked: 12 unauthorised file access
Blocked: 3 unauthorised network connections
# Exported for audit
Profile history: attached
Blocked-action log: attached
SBOM and CVE timeline: attached
Where the records are used
The record enforcement keeps, at the moments compliance needs it.
Audit preparation
Start from the record, not from a blank spreadsheet.
Customer security questionnaires
Answer from what is enforced, not from memory.
Exploited vulnerabilities
When a CVE is exploited in the wild, start from protection status.
Audit evidence, from enforcement
See the records bifrost keeps on your own workloads: security profiles, violation logs and CVE timelines.