Engineering Blog
Technical writing from the Primod team — eBPF internals, CVE prioritization methodology, and runtime security architecture.
October 13, 2026
Primod 2026.10.0 is here: cases with the evidence already attached, runtime reachability for every CVE, a traffic map that names your apps, and attack graphs for AWS, Azure and Google Cloud.
CTO, Primod
SBOMs tell you which components are present. VEX tells you whether a supplier says a product is affected. Neither can prove whether a vulnerable path executed in your cluster, which is why platform teams should separate supply-chain assertions from runtime evidence.
March 18, 2026
Pod Security Admission, CEL policies, and admission webhooks can reject unsafe manifests before they land in etcd. They still do not tell you what a workload executed after startup, which is why platform teams should separate preventive policy from runtime evidence.
March 11, 2026
Tetragon gives platform teams precise eBPF observability and in-kernel enforcement through tracing policies. Primod adds the investigation and vulnerability workflows on top of a sensor. Where each fits.
September 6, 2026
Pick Falco for rule-driven threat detection and alerting. Pick Cilium Tetragon when you need kernel-level eBPF observation and in-kernel enforcement.
September 6, 2026
Use process activity, workload identity and event outcomes to scope an incident, record uncertainty, and hand the evidence to the responding team.
February 4, 2026
A CVE with a 9.8 score that never executes in your environment is less dangerous than a 5.3 that runs on every request. We built a scoring model around this idea.
February 11, 2026
Knowing a vulnerability is reachable is step one. Knowing which downstream services it can propagate to is what turns a finding into a prioritized action.
January 28, 2026
Two fundamentally different approaches to runtime visibility. One lives in the kernel, one lives next to your container. We compare latency, fidelity, and operational cost.
January 21, 2026
Audit season should not mean two weeks of manual log exports. Here is how runtime execution data maps to SOC2 CC6 controls and what auditors actually ask for.
January 14, 2026
Weekly email
One email a week: a runtime finding worth understanding, how it was investigated, and what to check in your own clusters. No product pitches in disguise; unsubscribe in one click.
