5 Runtime Security Platforms for Detecting and Responding to Cloud Attacks in Progress

For the first time in the 19 years Verizon has published its Data Breach Investigations Report, exploiting a software vulnerability has overtaken stolen credentials as the most common way attackers break in. Approximately 31% of breaches in the 2026 report started that way, and Verizon says AI is helping attackers turn known flaws into working attacks in hours, not months.

Once an attacker is in, the first signs of trouble usually appear inside a running application or server, such as a process that shouldn’t be there, a file that changes, or a connection to an unfamiliar address. That’s runtime, the stage after deployment when software is up and handling real traffic, and it’s where a live attack plays out. Runtime security tools watch that stage and take action when something goes wrong.

The five platforms below detect and respond to attacks in progress on cloud workloads, each from a different starting point. Datadog builds runtime protection into the monitoring agent many teams already run, and Upwind leads with a runtime sensor. Wiz pairs its agentless view of cloud risk with Wiz Sensor, an agent-based sensor that runs on the workloads themselves and can terminate malicious processes. TrendAI adds runtime rules to its container and workload security, and FortiCNAPP uses machine learning to flag workload behavior that strays from the norm.

Key Takeaways

• Exploiting software flaws is now the most common way attackers break in, according to Verizon, so in addition to preventing attacks, today’s cyber teams need to catch attacks while they run.
• Runtime security watches what software actually does once it’s running, such as starting processes, changing files, and opening network connections, and it can act on what it sees.
• Agentless scanning and runtime sensors work best together: scanning shows where the risk is across the cloud, and a sensor on the workload confirms what’s actually running and can stop it.
• Among the best runtime security tools for cloud workloads, Datadog, Upwind, Wiz, TrendAI, and FortiCNAPP each take a different approach to detection and response.
• Response capabilities vary widely, from killing a single process to isolating a container to handing off to orchestration playbooks, so buyers should consider and test what each platform does when it detects an attack.

What Happens When an Attacker Exploits a Running Application

Picture a web application running in the cloud with a flaw nobody has patched yet. An attacker finds it, sends a crafted request, and gets code running inside the application’s container. From there, the next steps are quiet ones: installing a cryptominer or a backdoor, reading credentials stored on the server, and probing for other systems the workload can reach.

None of that shows up in a configuration scan. The container still looks the way it did when it was approved, and its settings haven’t changed. What has changed is its behavior: a new process, an unexpected file, an outbound connection to an unfamiliar address.

That’s the gap runtime security fills. Exposure management tools are built to find and prioritize weaknesses before attackers reach them, and that work still matters. Runtime security covers the next stage, after a weakness has been used, by watching for that change in behavior and acting on it.

What Runtime Security Covers, and What It Does Not

A cloud-native application protection platform, or CNAPP, is an all-in-one cloud security solution that covers areas such as configuration (often called posture), vulnerabilities, identities, and workload protection. A CNAPP can cover runtime threats as well, but only when it includes a runtime sensor on the workloads themselves.

Many CNAPPs started with agentless scanning, which reads cloud settings and snapshots of workloads from the outside without installing anything. That maps risk across an entire cloud account quickly, but it can’t see a process start inside a running container.

A runtime sensor can. In real time, it sees processes starting, files changing, and workloads making unexpected network connections. In containers, it can also catch drift, when a program runs that wasn’t part of the approved image.

On its own, though, a sensor lacks context. It doesn’t know that the server it’s watching is exposed to the internet, holds sensitive data, or can be reached through an overprivileged account. Scanning alone produces a long list of possible problems with no way to tell which are active. Combining agentless scanning with a runtime sensor gives teams both the live evidence and the context they need.

Many runtime security tools are built on eBPF, a Linux kernel technology that lets them watch system activity safely while workloads run. It applies to Linux only, so tools use different mechanisms on Windows.

At a Glance: Runtime Security Platforms for Cloud Workloads

• Datadog – Best for organizations that want to add runtime protection without deploying another agent.
• Upwind – Best for cloud-native teams that want a runtime-first platform built around an eBPF sensor.
• Wiz – Best for teams that want runtime detection and response tied to a full map of cloud risk, identities, and data.
• TrendAI – Best for container-heavy environments that want enforceable Kubernetes runtime rules alongside wider workload security.
• FortiCNAPP – Best for Fortinet customers that want behavioral workload detection connected to the rest of their security stack.

Datadog

Datadog is best known for infrastructure and application monitoring, and many teams already run its Agent on the workloads they want to protect. Workload Protection adds runtime security through that same Agent, which makes Datadog a natural shortlist candidate for companies already invested in it.

The Datadog runtime security solution watches process, file, and network activity in real time across Linux and Windows hosts and containers. It uses eBPF on Linux, a separate driver on Windows, and a tracer on AWS Fargate, where the host kernel isn’t available. When a rule fires, Datadog can kill a process or container, or isolate the workload’s network traffic, either automatically or manually from a security signal.

Datadog suits teams that want runtime protection to work alongside their existing monitoring. Buyers should confirm which rules run in monitoring mode and which have automated response turned on, and check the Agent version each response action requires.

Key capabilities

• eBPF-based monitoring on Linux, with a separate Windows driver
• Coverage of hosts, containers, and AWS Fargate
• Monitoring of more than 40 types of process, file, kernel, and network events
• Automated or manual actions that kill processes or containers, or isolate network traffic
• Deployment through the existing Datadog Agent

Upwind

Upwind is a runtime-first cloud security platform. It builds its platform around what its sensor sees on running workloads, then adds wider cloud context to those runtime findings.

The Upwind runtime security solution uses an eBPF sensor to monitor processes, file activity, system calls, and network traffic at layers 3, 4, and 7 in real time, alongside Kubernetes audit logs. It combines that runtime view with posture, identity, and data security modules. Upwind says it can terminate malicious processes and apply prevention policies to stop them from returning.

Upwind suits cloud-native teams running Linux containers and Kubernetes. Buyers should ask the vendor to show exactly which of their workloads get live runtime telemetry, especially any that don’t run on Linux.

Key capabilities

• eBPF sensor for Linux workloads
• Process, file, Kubernetes audit log, and network monitoring at layers 3, 4, and 7
• Process termination and prevention policies
• Posture, identity, and data security modules alongside runtime
• Coverage for containers, Kubernetes, and serverless

Wiz

Wiz made its name with agentless visibility into cloud risk, mapping what’s exposed, who can reach it, and where sensitive data sits. It pairs that with Wiz Sensor, an opt-in, agent-based sensor that runs on the workloads themselves, and both feed one map of the environment that Wiz calls the Security Graph.

The Wiz runtime security solution watches running workloads, using eBPF on Linux and a lightweight kernel driver on Windows. Its Runtime Response Policies can terminate malicious processes, such as cryptominers and reverse shells, on VMs, containers, and serverless workloads, and block unapproved programs inside containers. Every alert arrives tied to the identity involved, what’s exposed to the internet, and what data is at risk, and the sensor confirms which vulnerabilities are actually loaded in memory.

Wiz suits teams that want runtime alerts ranked by business risk across multi-cloud and hybrid environments. Buyers should confirm Wiz Sensor is deployed on the workloads they need covered, and test response policies in simulate mode before enforcing them.

Key capabilities

• Runtime threat detection on Linux and Windows VMs, Kubernetes, serverless containers, and hybrid and on-premises environments
• Automatic termination of malicious processes, plus blocking of container drift
• Simulate mode to test response policies before enforcement
• Confirmation of which vulnerabilities are actually loaded in memory, to cut noise
• Runtime alerts tied to identity, exposure, and data context on the Security Graph

TrendAI

Trend Micro renamed its enterprise business TrendAI in March 2026, and its platform is now TrendAI Vision One. Its Container Security follows a container from image scanning into production, with runtime protection sitting alongside posture and workload security.

The TrendAI runtime security solution detects container drift and blocks disallowed commands and file access in running containers, with many rules mapped to the MITRE ATT&CK framework. When a Kubernetes pod breaks a runtime rule, a policy can log the event, isolate the pod from network traffic, or terminate it. Scheduled scans also check running containers for malware.

TrendAI suits organizations that want container runtime rules and server protection from one vendor. Buyers should check which response actions apply outside Kubernetes, since pod isolation and termination are documented for Kubernetes pods specifically.

Key capabilities

• Detection of container drift, mapped to the MITRE ATT&CK framework
• Blocking of disallowed commands and unauthorized file access
• Log, isolate, or terminate actions for Kubernetes pods
• Scheduled malware scans of running containers
• Kubernetes posture management, plus server and workload protection

FortiCNAPP

FortiCNAPP, formerly Lacework, is Fortinet’s cloud security platform. It combines posture management, workload protection, and cloud detection and response with Fortinet’s wider security operations tools.

The FortiCNAPP runtime security solution uses a lightweight Linux agent that runs eBPF programs in passive mode, collecting process and network activity. Machine learning builds a baseline of normal behavior and flags what doesn’t fit, without hand-written rules, and surfaces composite alerts such as potentially compromised hosts, Kubernetes clusters, or cloud keys.

FortiCNAPP suits Fortinet customers. Because the agent is passive, response runs through orchestration in the Fortinet Security Fabric, such as FortiSOAR, so buyers should map out which actions are automated and which product performs each one.

Key capabilities

• Machine-learning detection of compromised credentials, ransomware, and cryptojacking
• A passive eBPF agent for Linux workloads
• Composite alerts that link related suspicious activity
• File integrity monitoring and host intrusion detection
• Integration with FortiSOAR and FortiGuard

How to Choose a Runtime Security Platform for Cloud Workloads

Start with where your workloads run. List your Linux and Windows servers, Kubernetes clusters, serverless services, and any on-premises systems, then ask each vendor to show which of them its runtime component actually covers.

Next, find out what the platform does when it detects an attack. Put a safe test process into a proof of concept and watch: does the platform kill that process, isolate the container, or send an alert to another tool for someone to handle? Note how long each step takes.

Then look at how alerts are ranked. A runtime alert is far more useful when it shows which identity was involved, whether the workload is exposed to the internet, and what data sits behind it.

Finally, ask whether the platform offers both posture management and runtime defense in one view. Wiz, for example, combines agentless posture analysis with Wiz Sensor on workloads in the same Security Graph, so a risk found by scanning and an attack caught at runtime can be investigated together.

FAQ

What is runtime security?

Runtime security watches and protects software while it’s running. It looks at what applications and servers actually do, such as starting processes, changing files, and making network connections, and it can act when that behavior looks like an attack.

Does CNAPP cover runtime threats?

Yes, but only when the CNAPP includes a runtime sensor on the workloads. Wiz does this with Wiz Sensor, and Upwind’s platform is built around an eBPF sensor. A CNAPP that relies on agentless scanning alone can map risk across the cloud, but it can’t watch processes running inside a workload.

What is the difference between agentless CNAPP and runtime protection?

Agentless scanning reads cloud configuration and workload snapshots from the outside to map risk, without installing anything, but it can’t watch processes running inside a workload. Runtime protection uses a sensor on the workload to see and stop what’s executing. Combined, each covers the other’s gap: the sensor shows which risks are active, and the scan supplies the context to rank them.

Which cloud security tools use eBPF for runtime monitoring?

From this list, Datadog, Upwind, Wiz Sensor, and FortiCNAPP use eBPF on Linux. eBPF is a Linux-only technology, so Windows coverage works differently: Wiz Sensor uses a lightweight kernel driver on Windows, and Datadog uses a separate Windows driver.

Can runtime security stop an attack, or only detect it?

It depends on the platform. Datadog and Wiz can terminate malicious processes, and Upwind says it can as well. Datadog can also kill containers or isolate network traffic, and TrendAI can isolate or terminate Kubernetes pods. FortiCNAPP’s agent is passive, so it detects attacks and routes response through orchestration tools such as FortiSOAR.