Seventy-three percent of container intrusions go undetected on hosts relying solely on traditional EDR telemetry. That statistic from the 2026 Sysdig Threat Report isn't just a number—it’s a mandate to stop guessing at runtime behavior and start observing it at the kernel level.
Why User-Space Agents Fail
EDR agents and sidecars live in user space. They see what the OS chooses to show them: process trees, open file descriptors, network sockets after the fact. Sophisticated attackers know this. They use direct syscalls, memory injection, and kernel exploits to bypass hooks entirely. By the time a user-space agent correlates an anomaly, the blast radius has expanded.
eBPF Changes the Observation Point
Extended Berkeley Packet Filter (eBPF) runs sandboxed bytecode inside the Linux kernel. It attaches to tracepoints, kprobes, uprobes, and Linux Security Modules (LSM) without loading kernel modules. This gives defenders a tamper-resistant, low-overhead view of every syscall, network packet, and capability check as it happens.
"eBPF moves the security sensor from the application layer to the kernel layer, eliminating the blind spots attackers exploit.
— Liz Rice, Chief Open Source Officer, Isovalent
Detection Stack: Falco, Tetragon, and Cilium
Three projects dominate the 2026 eBPF security landscape. Each maps kernel events to MITRE ATT&CK techniques and exports structured JSON for SIEM ingestion.
| Tool | Primary Hook | Detection Focus | Enforcement |
|---|---|---|---|
| Falco | Syscall tracepoints, kprobes | Runtime anomalies, fileless malware, crypto miners | Alert only |
| Tetragon | LSM hooks, tracepoints, eBPF maps | Process exec, network connections, capability usage | Policy-based kill/block |
| Cilium | LSM, TC/XDP, socket ops | Network policy, service-to-service auth, L7 visibility | Enforce zero-trust network |
Mapping to MITRE ATT&CK
Modern eBPF rulesets tag every event with ATT&CK technique IDs. A single `execve` hook catches T1059 (Command and Scripting Interpreter), T1059.004 (Unix Shell), and T1505.003 (Web Shell) simultaneously. Network hooks surface T1071 (Application Layer Protocol) and T1571 (Non-Standard Port). This tagging enables automated triage in your SOAR platform.
Telemetry Reach: The 2026 Numbers
Clusters running Falco-based detection saw only 11 percent of intrusions go undetected versus 73 percent for pure EDR hosts. The delta comes from kernel-level visibility into:
- Direct syscalls bypassing libc (common in Go/Rust malware)
- Memory mapping anomalies (memfd_create, mprotect)
- Namespace escapes via unshare/setns
- Capability escalation (CAP_SYS_ADMIN, CAP_DAC_OVERRIDE)
💡
TipEnable Tetragon’s OpenTelemetry exporter to correlate kernel traces with application spans in a single Jaeger or Tempo backend.
Enforcement Without Kernel Modules
Cilium’s LSM-based enforcement drops packets and kills processes before the syscall returns. No iptables chains, no CNI plugin races. Policy is defined as Kubernetes NetworkPolicy or CiliumNetworkPolicy CRDs and compiled to eBPF at load time. Rollback is instant—delete the CRD, the map entry vanishes.
Operational Checklist for 2026
- Deploy DaemonSets for Falco (detection) and Tetragon (detection + enforcement) on every node.
- Enable LSM hooks in your kernel config (CONFIG_SECURITY=y, CONFIG_BPF_LSM=y).
- Ingest JSON logs into your SIEM; map `mitre_technique` fields to detection rules.
- Enforce default-deny CiliumNetworkPolicy; allow-list by identity labels, not IPs.
- Run quarterly purple-team exercises using Stratus Red Team to validate coverage.
✦
⚠️
WarningeBPF requires kernel 5.10+. Verify your distro backports LSM BPF hooks (Ubuntu 22.04+, RHEL 9.2+, Flatcar, Bottlerocket).
Runtime security is no longer a post-deployment checkbox. With eBPF, detection latency drops from minutes to seconds, and enforcement becomes a native kernel primitive. Start instrumenting the kernel today—your attackers already are.
