bifrost

bifrost is a runtime-based CVE prioritisation and workload protection platform for containerised workloads running on Kubernetes, Docker Swarm or Nomad. The product learns what each container does when it runs, including system calls, file access and network connections, and evaluates that behaviour for weaknesses. It also tracks the contents of each build (SBOM). Each CVE found in an image is given a verdict based on runtime behaviour: reachable, mitigated by the workload's profile, or never loaded. For protection, bifrost generates a tailored security profile for each workload with every build. In enforce mode, the kernel blocks any operation outside the profile, such as an unexpected shell exec. The company states that AI is used to assess workload behaviour and how a CVE's exploit would interact with the profile, while the profile and its enforcement are deterministic and no model decides at runtime whether an operation runs. When a new CVE is disclosed, bifrost assesses it against the context it already holds: protection status, where the affected component is deployed, the level of exposure and the recommended action. Alerts for blocked actions include the workload, build and denied action. Deployment on Kubernetes uses a Helm chart. Listed integrations include Docker, Google GKE, Azure AKS, AWS EKS, OVHcloud, DigitalOcean, GitHub Actions, ArgoCD, Talos Linux and Ubuntu, with notifications sent to Slack, Microsoft Teams or webhooks. The company offers demos and a 14-day free trial, and lists Vinnova, Almi Invest, LU Ventures and Quinary Investment as backers.