Catching Attacks in the Act: eBPF for Runtime Security

Since the SolarWinds attack and the Biden-era cybersecurity executive order, much of the security industry’s energy has gone into preventing attacks in the software supply chain, before software is ever deployed. That work matters — but it is not enough. Defence in depth means accepting that vulnerabilities, misconfigurations, and unexpected behaviour will still reach production. Runtime security is essential, especially under the threat of AI-driven automated attacks.

eBPF has fundamentally changed what’s possible at runtime by opening up the kernel as a safe, programmable place to observe — and increasingly enforce — system behaviour with rich context and low overhead. This talk focuses on how that power can be used to spot when something is actively going wrong in production.

We’ll look at how open source tools such as Tetragon use eBPF to detect real attack techniques, from suspicious process execution to unexpected privilege changes and anomalous network activity. Rather than starting from tools, we’ll start from attacker behaviour and work backwards to the kernel signals that matter.

Along the way, we’ll examine which signals are reliable indicators of compromise, how containers change the threat model, and when it makes sense to enforce policy directly in the kernel rather than deferring decisions to user space.

The goal isn’t to turn everyone into a kernel hacker, but to provide a clear mental model for how eBPF enables practical, opinionated runtime security — no prior eBPF deep dives required.