Definition. A security discipline that observes and evaluates processes, network and file activity during execution instead of relying on static checks (SAST, image scans). Typical building blocks are eBPF-based sensors (Falco, Tetragon), syscall monitoring and behavioural rules against drift.

Why it matters. Static checks catch vulnerabilities before deployment. Runtime security catches what happens anyway: compromised images, unintended configuration drift, insider actions and live exploitation of zero-days.

Related. Falco, Tetragon, Threat Detection, Container Escape, DevSecOps