Products · Runtime Security

Stop Unauthorized Actions Inside Running Workloads

Aquasec protects AI and containerized applications while they run. The Enforcer operates at the kernel layer, turning deep runtime intelligence into inline enforcement that stops unauthorized actions at the point of execution.

Get Demo Get the Solution Brief

Turn Runtime Intelligence Into Control

Collect runtime telemetry and make policy decisions directly inside the workload, enabling teams to detect threats, enforce security policies, and contain attacks without relying on remote analysis.

577K+ runtime threats blocked across 146 production environments
142K Drift Prevention blocks
17+ patents

Detect

Detect abnormal process, file, network and memory activity using behavioral indicators and Aqua Nautilus threat intelligence to identify emerging threats, even those without known malware signatures.

Explore Detect

Enforce

Enforce runtime policies deterministically across containers, VMs, serverless and AI workloads, applying the same policy locally across environments without depending on a continuous connection to a central system.

Explore Enforce

Contain

Combine runtime telemetry, memory evidence, process lineage and MITRE ATT&CK mapping to show clearly how an attack unfolded and what it affected.

Explore Contain

Deny Unauthorized Activity Without Stopping the Application

Block the specific process, file, network or privilege action that violates policy, without making workload termination the default response. Runtime Policy Enforcement starts with out of the box policies you move from audit to enforcement as behavior is validated.

Webinar

Beyond Detection: The Aqua Runtime Difference

Watch the Webinar

Deny Unauthorized Activity Without Stopping the Application

Keep Containers Identical to Their Approved Image

Stop unauthorized executables from running in your containers. Drift Prevention anchors each container to its approved image, so binaries added after deployment are blocked, including tools an attacker drops after an exploit.

Blog

Blocking Attacks in Runtime with Drift Prevention

Read the Blog

Keep Containers Identical to Their Approved Image

Block Malware on Download or Execution

Stop ransomware, cryptominers, backdoors and supported fileless techniques in running workloads with Advanced Malware Protection. The malicious file is preserved as evidence, even after the container that ran it is gone.

Feature Brief

Real-Time Malware Protection for Cloud Native Environments

Get the Solution Brief

Segment Workload Traffic with Identity Aware Policy

Limit lateral movement by controlling how workloads communicate. Aquasec derives microsegmentation policy from observed traffic and blocks connections to malicious DNS and IP destinations, working alongside your existing service mesh and CNI.

Solution Brief

Detect and stop live attacks with intelligence-driven runtime protection

Get the Solution Brief

Segment Workload Traffic with Identity Aware Policy

Detect Unknown Techniques with Behavioral Indicators

Catch new techniques and zero day activity that signature matching misses. Behavioral detections built from Aquasec Nautilus research map each finding to MITRE ATT&CK and to the affected workload and Kubernetes context.

Webinar

Blinders Off: Advanced Threat Detection in Cloud Native Runtime Environments

Watch the Webinar

Detect Unknown Techniques with Behavioral Indicators

Preserve Memory Evidence Before Containers Disappear

Reconstruct attacks on ephemeral workloads with forensic detail that would otherwise be lost. Container Memory Forensics captures the relevant memory at the moment of attack so responders can analyze it with familiar tools such as Volatility.

Solution Brief

Container Memory Forensics: Preserving Malware Evidence in Ephemeral Environments

Feature Brief

Preserve Memory Evidence Before Containers Disappear

Integrations

Protect Workloads Wherever They Run

Choose SaaS or a fully self hosted deployment, including disconnected and air gapped networks. The Aqua Enforcer makes policy decisions locally, so protection does not depend on a connection to the cloud.

See All Integrations Protect Any Environment

“True runtime enforcement: AquaSec can actively block unauthorized code executions. vShield acts as a temporary patch, protecting workloads during patching windows.”

IT Associate
IT Services

FAQs

What is runtime security?

Runtime security protects applications and workloads while they execute in production. It covers monitoring workload behavior, detecting malicious activity, enforcing policy inline and containing threats. Aquasec delivers runtime security through the Aquasec Enforcer, which operates inside each workload at the kernel layer and can deny supported unauthorized actions at the point of execution.

How does Runtime Security relate to CWPP?

Runtime Security provides the capabilities analysts group under cloud workload protection platforms, or CWPP, across containers, Kubernetes, virtual machines and supported serverless workloads. Aquasec’s focus goes beyond workload visibility to inline enforcement at the kernel layer, so policy can deny a supported unauthorized action instead of reporting it after it runs.

How is Aquasec different from an eBPF based runtime sensor?

An eBPF sensor can provide deep telemetry, but observing an action and reporting it to a control plane does not stop it from completing. The Aquasec Enforcer operates inside the workload at the kernel layer, where it evaluates process, file, network and privilege activity and can deny a supported unauthorized action at the point of execution. Aquasec uses eBPF as one part of that architecture, alongside other operating system and runtime mechanisms.

Does Runtime Security need a cloud connection to block an attack?

No. Runtime policy decisions are enforced locally by the Aquasec Enforcer, so protection continues in disconnected and air gapped environments. Management and update workflows still depend on the deployment architecture you choose.

Will enforcing runtime policy disrupt my applications?

Aquasec denies the specific unauthorized process, file operation, network connection or privilege action rather than making workload termination the default response. Teams can start in audit mode, validate how workloads behave and move each workload group to enforcement once the policy is confirmed.

Watch Aqua Stop a Live Attack

See What Runtime Control Looks Like in Your Environment

See runtime control stop an attack the moment it tries to execute.