bifrost

bifrost is a runtime security platform for containerised workloads running on Kubernetes. It observes what each container does at runtime (system calls, file access, process activity and network connections) and uses that behaviour to produce CVE verdicts and kernel-enforced protection. Each CVE is given a verdict based on what the workload actually runs: reachable, mitigated by the profile, or never loaded. SBOMs are ingested on every deploy and re-scanned several times a day, so newly disclosed CVEs are matched against the existing inventory without a rebuild or new workload scan. bifrost generates a security profile for each build from learned behaviour and built-in knowledge. Each profile is an AppArmor profile enforced by the Linux kernel security module, with no sidecar or proxy. Protection moves through three modes that the team selects per workload: observe, detect and enforce. In enforce mode, operations outside the profile are refused. Blocked events raise alerts with context. Deployment: - Agent runs as a DaemonSet per node, installed with one Helm chart - Agent observes in pre-production clusters and enforces in production clusters - SBOM formats: CycloneDX and SPDX - Stated overhead is under 1% CPU - Hosting options: Swedish hosted, European hosted and private cloud; on-premise is listed as coming soon Verdicts and alerts can be sent to SIEMs, Jira, Slack, Microsoft Teams and webhooks.