How Did Aqua Catch a Cryptomining Attack Hiding in Memory?
Get Started
Author Page

Erin Stephan

Erin Stephan is the Head of Product Marketing at Aqua Security. Erin has more than a decade of product marketing experience in data protection and cybersecurity. She specializes in go-to-market strategy, messaging, and product launches, helping teams connect what they build to why it matters. When she’s not working, she’s usually planning her next trip.
Blog Posts by Erin Stephan
Trivy: The Universal Scanner to Secure Your Cloud Migration
Application security teams are challenged today with the need for a centralized view of exposure to security issues like Log4j and Spring4Shell. But an exploding set of artifacts and security tools makes it prohibitively difficult to secure the development life cycle. A universal scanner drastically reduces this management overhead and gets you started quickly.
Combat Zero-Day Threats with Aqua’s New eBPF Lightning Enforcer
We are excited to announce the latest addition to our portfolio, our eBPF-based Aqua Lightning Enforcer. It’s designed for busy security professionals to detect zero-day attacks and sophisticated threats that occur in runtime. It utilizes eBPF technology, making it more effective, safer, and faster. The new Lightning Enforcer and our Runtime Protection solution is an …
Conquer Cloud Security Risk: Introducing Real-Time CSPM
What if someone handed you a static picture of a highway and asked you to drive using only the picture? Would you still drive even if you knew you could not see all the traffic around you? Yet traditional CSPM solutions show the state of your environment as a snapshot in time, usually once per …
From Cloud Security Posture Management to Real-Time CSPM
With the growing sophistication of cyber-attacks and increasing complexity of multi-cloud environments, partial visibility alone isn’t enough. Real-Time CSPM improves upon traditional CSPM by bringing deep, real-time context and prioritization to discovered issues. Providing you with complete visibility to reduce the noise so you can focus on remediating the biggest security risks across your multi-cloud …
Innovating Cloud Security: Why Aqua Leads in Gigaom CSPM Radar
What does it mean to be an innovator?   Is it someone whose face and company are known? Whose product is the most popular? Who has the coolest ads or the most social media likes?  According to the Oxford dictionary, an innovator is someone who introduces change and new ideas. At Aqua we have always thought …
Lasting Legacy of Log4j: Lessons for Runtime Security
Another December is upon us, stores are full of shoppers, lights are illuminating cities, towns and cul-de-sacs as radio stations bombard listeners with the continuous rotation of holiday music. Yet amongst all this merriment sits the IT security professional behind their screen completing their end of year tasks. Their eyes slowly twitch, and they fill …
Elevating Security: Protecting Containerized Workloads on Mainframes
Mainframes and containers represent two distinct yet impactful elements in today’s modern computing architecture. Mainframes are powerful, centralized computing systems known for their reliability, scalability, and ability to handle massive workloads. While containers, on the other hand, have emerged as a lightweight and flexible solution for deploying, scaling, and managing cloud native applications across various …
Aqua: Leading the Charge in Container Security Innovation
Aqua named a leader and an outperformer in GigaOm Container Security Radar  Containerization has revolutionized application development and deployment, providing enterprises with enhanced speed, agility, and consistency across different computing environments. However, this transformation introduces complexities, particularly regarding security. With the increasing adoption of containerized applications, there’s a growing demand for specialized security solutions tailored …
Cloud Workload Security: Aqua Shines in GigaOm’s Radar Report 
Cloud workload security (CWS) plays a critical role in safeguarding the integrity and resilience of cloud native workloads. Defined through the lens of GigaOm, CWS primarily revolves around fortifying the dynamic and continuously evolving workloads within cloud environments. Its significance lies in bolstering security measures by pinpointing vulnerabilities, ensuring adherence to compliance standards, and swiftly …
Understanding the Importance of Runtime Security in Cloud Native Environments
Gartner has estimated that “90% of global organizations will be running containerized applications in production by 2026—up from 40% in 2021.”   The inherent benefits of cloud native application development enable developers to introduce new code into the environment at an accelerated rate. However, the dynamic nature of these environments amplifies the risks associated with runtime …
Walk the Line: High-Fidelity Incident Detection Without Disruption
In the dynamic world of cloud native, security teams are inundated with an overwhelming flood of alerts—far too many for any team to realistically manage. This constant barrage creates a risky dilemma: sift through the noise or silence alerts, risking missing real attacks. Like Johnny Cash’s “Walk the Line,” security teams must strike a careful …
New Aqua User Experience: Streamlined Vulnerability Management
The new Aqua Hub update is designed to take the headache out of vulnerability management, addressing common challenges like alert overload and data consistency issues. With this update, teams get a clean, streamlined view of vulnerabilities that cuts through the noise, so they can focus on the critical issues without getting lost in irrelevant details. …
From Theory to Practice: How to Make DevSecOps Work in Your Organization
Houston, we have a problem: implementing DevSecOps isn’t as straightforward as it seems. DevSecOps has redefined security in modern software development, becoming the benchmark for organizational success. By embedding security into every phase of the development lifecycle, organizations can deploy faster and collaborate more efficiently while ensuring security at every step. Yet, despite its advantages, …
Malware Forensic Analysis: Capturing What Attackers Leave Behind
Every attack leaves a trail, but in containerized environments, this trail can evaporate before you even realize you have been attacked. These environments bring new challenges for security teams, including an expanding attack surface. Containers, while incredibly powerful, are short-lived, and attackers exploit this by moving quickly and covering their tracks. They often download and …
GigaOm Radar: Aqua Leads in Container Security
Securing containerized applications demands a multi-layered strategy that spans the entire lifecycle from development to production, a challenge Aqua has spent nearly a decade mastering. Aqua’s Container Security solution provides full lifecycle protection by identifying vulnerabilities early in the build phase, integrating acceptance gates in the CI/CD pipeline to minimize risks, and offering real-time runtime …
Debunking Six Myths of Cloud Native Security
The promise of cloud native applications lies in their ability to provide enhanced agility, scalability, and resilience, perfectly aligning with the digital transformation needs of today’s enterprises. However, as we navigate this transformation, cloud native application security is often surrounded by myths and misconceptions. Understanding these myths and how they are being addressed is crucial …
Cut Through Alert Noise and Fix Toxic Combinations First
Not every security alert is a threat, but the right combination can bring down your cloud native and containerized applications. Security incidents rarely happen because of a single weak point. Instead, they stem from toxic combinations. A misconfigured workload might seem harmless on its own, but add exposed credentials and an unpatched vulnerability, and attackers …
From Prompt to Production: Runtime Protection for AI Workloads
The moment your app calls an LLM, it stops being just containerized software, and becomes an entirely new attack surface. Artificial Intelligence is transforming how applications behave and how they need to be secured. As generative AI and large language models (LLMs) become embedded into everything from customer support bots to internal data tools, security …
Unify to Fortify: Security for AI, Containers, and Every Cloud
Cloud adoption has transformed the enterprise IT landscape, but that transformation has not followed a clean or linear path. Instead of standardizing on a single platform, most organizations now operate across a patchwork of public clouds, private data centers, and legacy systems. Hybrid and multi cloud strategies have become the norm, not by design but …
Aqua Helps Close the DevSec Gap with Shift Left Security
Shifting security left has many benefits. Developers today have more ownership and responsibility for secure coding practices than ever before. However, this does not mean that the entire security burden falls on developers. Cloud native environments evolve rapidly. Teams rely on open source packages, build and deploy containers on demand, and push changes through CI/CD …
Patch, Ditch, Dodge, or Deal? Your Call on Vulnerabilities
Security teams are drowning in vulnerabilities. Cloud native environments can generate tens of thousands of new findings every month, even before factoring in CI/CD pipelines and third party dependencies. With this volume, the challenge is not just finding vulnerabilities, it is deciding what to do about them. Fix everything? Impossible. Ignore everything? Risky. The key …
Securing LLM Apps with Aqua: Beyond the OWASP Checklist
It started with a single LLM API call buried in a product prototype. By the time the team noticed, that call had turned into a full-blown feature. Customers were using it, business logic was being shaped by it, and the security team had not even seen it. That is the pattern we are seeing across …
Operationalizing AI Security: Protecting Workloads Where AI Runs
Security teams are facing urgent questions as AI moves from experimentation to production. What models are running in our environment? Where are they deployed? Are they operating within policy and if not, can we stop them? Existing tools offer limited answers and they rarely provide governance without slowing developers down. To move forward, security leaders …
AI Container Security Begins Inside the Workload
AI security is often discussed at the edge, through firewalls, proxies, SDKs, or prompt filtering. These approaches serve a purpose, but they overlook where many of the most serious risks actually take place, inside the container.
MCP to Agentic AI: Shaping AI Security for What’s Next
Enterprises are rapidly adopting large language model applications, AI assistants, and model orchestration platforms at a pace that rivals the early days of cloud computing. With this acceleration comes both significant opportunity and risk. Yet AI security is lagging behind, struggling to match the speed and scale of adoption. One of the hottest topics right …
Navigating the OWASP LLM and GenAI Security Landscape
The rush to adopt generative AI has created an explosion of new security tools targeting different aspects of an increasingly complex landscape. Every week, a solution promises to stop prompt injection, prevent data leakage, or harden models against attack. For security leaders, it can feel overwhelming. Which solutions matter, how do they fit together, and …
Secure AI Infrastructure On-Premises from Day One
Your company rolls out a new claims system powered by AI. It is fast, efficient, and customers love the experience. Then one day, a single malicious input slips through. The model is tricked into revealing sensitive records, or a workload spins out of control and consumes expensive GPU cycles. What began as a breakthrough quickly …
Aqua at KubeCon 2025: Securing Cloud Native and AI Apps
Every KubeCon tells a story about where the cloud native world is headed. In 2025, that story is about the evolution of AI from a bad movie script to a core part of enterprise solutions. Cloud native applications and artificial intelligence are now part of the same conversation, with security emerging as the vital connection …
Selective Memory Dump Technique for Deeper Container Forensic Analysis
Every attack leaves a trail, but in containerized environments, that trail can vanish before you even realize you have been attacked. Containers are short-lived, and attackers exploit this by executing malware in memory, loading hidden payloads, or deploying rootkits, then silently modifying or deleting evidence to cover their tracks. By the time security teams are …
Cloud Threat Detection in 2026: The Growing Role of SecOps
Cloud threat detection is changing as attacks increasingly unfold inside running workloads rather than in static code or configuration layers. This shift affects how detection works in practice and how security teams are able to investigate incidents once alerts appear.
Autonomous Runtime Security: Turning Runtime Intelligence into Agentic Response
TL;DR Security teams have spent years and billions of dollars shifting security left. This has changed what teams can see and introduced a new level of visibility, but it has not helped with what they can control. Last year, more than 48,000 new vulnerabilities were cataloged, growing at roughly 20 percent annually. Add to that …
Known Techniques, Unknown Speed: How AI Changes the Attack Chain
TL;DR AI-driven attacks on containerized environments are no longer theoretical. Frontier models can find vulnerabilities in hardened systems in hours and chain them into working exploits before your team has finished triaging the alert. When an attack moves that fast, the time your security program depends on between discovery and exploitation no longer exists. This …
How Do You Protect a Workload You Cannot Afford to Patch Right Now?
TL;DR Vulnerability management is collapsing under scale and the remediation timeline for production workloads is not going to shorten fast enough to keep pace with attacks that adapt at machine speed. Aqua vShield is a patented runtime capability that closes the gap between discovery and remediation by enforcing compensating controls directly inside running containers, blocking …
Need to secure enterprise workloads?

Aqua Cloud Native Application Protection Platform (CNAPP)

Go cloud native with the experts!

Get Demo