Aikido
Start for Free
No CC required
PlatformCloud
Runtime Sensors

Detect suspicious activity across VMs and Kubernetes

Runtime Sensors flag attacker-like behavior in your Kubernetes clusters and Linux VMs. You see the affected workload and the commands it ran, so you can contain it fast.
Book a demo
How it works
Your data won't be shared · Read-only access · No CC required
Trusted by 150k+ orgs
|
Loved by 300k+ devs
|
4.7/5
Lovable
Pendo
Revolut
Soundcloud
Niantic
n8n
Deel
Visma
Handshake
Joe & the juice
Runway
Too Good To Go
NiCE
Belfius
Lovable
Pendo
Revolut
Soundcloud
Niantic
n8n
Deel
Visma
Handshake
Joe & the juice
Runway
Too Good To Go
NiCE
Belfius
THE PROBLEM

Runtime detection tools are noisy and difficult to run

Existing runtime threat detection solutions are too complex and noisy. Real attacks go unnoticed in an avalanche of alerts. Teams spend more time tuning the tool than investigating threats.
RUNTIME SENSORS

Every detection shows the VM or pod where it ran

Spot container escapes attempts

Attempts to break out of a container to the host are flagged on the cluster and pod where they happened.

Catch container drift in Kubernetes

When a process runs a binary that didn’t ship with the container image, you get the command and the workload that ran it.

Tell real attackers from false alarms

Every detection shows the command and user, labeled with the matching attack technique, quickly separating intruders from your own tooling.
See your attack paths
Book a Demo

Where runtime sensors work

Why teams use Runtime Sensors

Runs in the Aikido agent

Runtime Sensors is part of the Aikido agent that also scans your VMs and Kubernetes clusters

Low noise

Aikido groups matching events by rule and workload so you get a single item to review

Silence false positives

Add exceptions for your own tooling so expected behavior stops raising alerts.

Runtime findings, same platform

See live-attack detections in the same Aikido workspace as your code and cloud issues.

Detect live attacks across your production fleet

Runtime Sensors flag attacker-like behavior across your Kubernetes clusters and Linux VMs, with the workload and commands in one view.

Book a demo
Start for free
Runs in the Aikido agent · Kubernetes and Linux VMs · Detections alongside your code and cloud findings
Trusted by 150k+ orgs
Faq

Frequently Asked Questions

What are Runtime Sensors?

Runtime Sensors monitor your Kubernetes clusters and Linux VMs while they run. They use eBPF to observe workload activity from the kernel and flag behavior that matches Aikido's detection rules, such as container escapes or unexpected binaries.

What is eBPF, and do I need to change my code?

eBPF (extended Berkeley Packet Filter) lets a program observe kernel activity safely, without kernel modules. The sensor runs in the Aikido agent on each node or VM. Your application code and container images stay unchanged.

What do Runtime Sensors detect?

Aikido ships and maintains the detection rules. They cover behaviors such as container escapes and binaries running in a container that weren't part of its image. Each rule maps to a MITRE ATT&CK technique and tactic. You can turn any rule on or off for your workspace.

Which environments are supported?

Kubernetes clusters connected to Aikido, and Linux VMs that run the Aikido agent with systemd and kernel 5.8 or later. Windows VMs aren't supported. Agentless scanning of AWS, Azure and Google Cloud VMs doesn't include runtime detection, because it doesn't install the agent.

How do I turn it on?

For a cluster, turn on threat detection in its settings and run a Helm upgrade with runtimeDetection.enabled=true. For a VM, set RUNTIME_DETECTION_ENABLED=true when you install the agent. See the setup docs for details.

How do I handle false positives?

Open the detection and click Add Rule Exception. Aikido pre-fills the conditions from the event, and uses wildcards for generated pod names so the exception survives restarts. Exceptions apply across your whole workspace.

Can Runtime Sensors block an attack?

Not today. Runtime Sensors detect and give you the context to respond. For blocking attacks inside your application, see Runtime Protection.

How are Runtime Sensors different from Aikido Runtime Protection (Zen)?

Zen is an in-app firewall that runs inside your application and blocks attacks like injection against it. Runtime Sensors run on the host and watch containers and processes from the kernel. They catch what happens after something gets in, regardless of the language or app.

Is this CWPP or CDR?

Runtime Sensors cover runtime threat detection for workloads, the detection side of cloud workload protection (CWPP). They don't analyze cloud provider audit logs.

How is this different from Wiz?

Draft for PM review: Wiz sells its runtime sensor as an add-on to its detection and response product. Aikido Runtime Sensors put runtime detections in the same workspace as your code and cloud findings, triaged by the same team. (Needs a second, sharper point: price, setup time or detection quality. Coverage alone won't hold up, since Wiz covers more environments today.)