What Static Analysis Overlooks: From Known Vulnerabilities to Active Exploitation
We analyzed six months of runtime telemetry from early-access deployments to understand the gap between CVE findings and actual in-production exploitation events.
Security Lab
Deep eBPF security insights from the builders
Kernel internals, runtime detection research, AppSec practice, and threat analysis from the Oligo team, grounded in production instrumentation.
eBPF Kprobes vs Uprobes: Selecting an Application Security Hook
Kprobes and uprobes give you fundamentally different views of your application. Here is how each type works and when to use which for runtime security instrumentation.
SSRF Bypasses WAFs, Shows at Socket Layer with eBPF
Server-side request forgery exploits that bypass perimeter controls are detectable at the kernel socket boundary, long before they reach your internal network segments.
Runtime Detection in the SDLC: Where Shift-Left Falls Short
Shift-left matters. So does shift-right. A mature AppSec program needs observation at runtime as a complement to pre-production scanning, not a replacement for it.
How Attackers Exploit Trusted Processes: Fileless Execution and eBPF Tracing
Fileless attacks leave no binary on disk. But they do leave kernel syscall traces. This post walks through how eBPF captures the execution path even when there is nothing to scan.
1.5% eBPF Overhead in Production: Results by Workload Type
We measured the performance impact of Oligo across four representative production workloads. Here are the raw numbers and what they mean for your deployment decision.
10-Minute Window: From Vulnerability to Exploit Before Patching Can Help
Once a proof-of-concept exploit is public, active exploitation in the wild typically begins within ten minutes. Static scanning cycles are not designed to operate at that speed.
Log4Shell, Two Years On: Unpatched Instances Persist and Runtime Finds Them
Log4j 2.x vulnerable instances are still found in production environments. Runtime monitoring provides a detection layer even when patching timelines stretch across quarters.
eBPF Sidecars or DaemonSets: Choosing Your Container Security Deployment
You should not have to change your container images to instrument them for security. This post compares two eBPF deployment patterns and explains why DaemonSets win for most teams.
Over-Noisy Detectors Destroy Trust: Behavioral Baselining Cuts Runtime Alert Noise
A runtime detector that cries wolf on every deployment event is worse than no detector. Behavioral baselining lets Oligo distinguish the normal from the anomalous without constant tuning.
CWE-416: Detecting Use-After-Free Attacks at the Kernel Boundary
Memory corruption exploits in C and C++ dependencies are notoriously hard to catch with static analysis. eBPF observation at the kernel boundary catches the exploitation attempt in real time.
AI-Generated Code and AppSec: Runtime's Last Honest Signal
AI-assisted development accelerates code output faster than security review can keep pace. Runtime observation becomes the honest ground truth when the code volume outpaces the reviewer.
MITRE ATT&CK Techniques Mapped to eBPF Hook Points
A practical mapping of 18 MITRE ATT&CK techniques to specific eBPF kprobe and tracepoint attachment points, with detection class annotations for each.
Why Runtime and eBPF: Oligo Security's Technical Foundation
The design decisions behind Oligo's runtime-first, eBPF-native approach: what we tried, what failed, and why the kernel boundary is the right observation layer for application security.
Read enough? See the platform in your environment.
Deploy Oligo on one cluster and see the runtime dependency graph for your actual workloads within the first session.