Once teams find malicious activity, they must limit its reach and preserve evidence before the workload ends. Without containment, a single compromise can spread while the details needed to investigate disappear.
Static scanning cannot always reveal how a suspicious image will behave, allowing malicious activity to remain hidden until production.
An unrestricted compromised workload can become a path into other workloads, expanding an attack's reach and impact.
Container memory and process history can disappear when a compromised workload terminates, taking critical forensic evidence with them.
Expose malicious behavior before deployment, restrict compromised workloads at runtime and capture the evidence needed to reconstruct an attack.
Run suspicious container images in a safe, isolated sandbox before deployment to reveal malicious behavior without exposing production environments
Limit network and process activity in compromised workloads in real time to prevent lateral movement and limit further impact.
Capture container memory, process lineage and runtime telemetry before a compromised workload terminates to preserve critical evidence for investigation.
Use memory snapshots, process lineage and runtime telemetry to reconstruct the attack path and show what happened, what was affected and how far it spread.
Containment means limiting how far a suspicious or malicious workload can affect other systems, typically by isolating it or restricting its network and process activity, rather than only detecting that something is wrong.
Yes. Aqua runs suspicious container images in an isolated sandbox where their behavior can be safely observed before deployment, preventing malicious activity from reaching production.
Aqua restricts a compromised workload’s network and process activity in real time, preventing it from reaching other workloads and limiting how far an active attack can spread.
Containers are ephemeral. Memory and process history are lost the moment a workload terminates, so evidence has to be captured while the workload is still running or it’s gone for good.
Aqua captures memory snapshots, process lineage and runtime telemetry before a compromised workload terminates, then uses that evidence to reconstruct how the attack unfolded and what it affected.
See runtime control stop an attack the moment it tries to execute.