One expansion first, because the rest of the chapter leans on it. A SIEM — Security Information and Event Management — collects logs from everything you own (servers, laptops, firewalls, cloud services, applications), keeps them in one searchable place, and runs rules over them looking for attacks. The reason it exists is correlation: a failed sign-in means nothing, but a failed sign-in, then a success from a new device, then a mailbox rule forwarding externally is an attack — and no single system can see it, because each holds only its own piece.

What changed afterwards is worth knowing because it is what you would have asked for: runtime bounds checks in the Content Interpreter; template testing across varied matching criteria; instance validation that actually exercises the Interpreter; staggered canary deployment for Rapid Response Content with monitoring gating each ring; customer control over when and where content updates land; and independent third-party code and process reviews.

The commercial lesson is the uncomfortable one. The stock fell about 45% over eighteen days. Two years later the recovery is unambiguous — ending ARR of $5.51B growing 24%, a record first-quarter net-new ARR, four consecutive quarters of revenue acceleration. The largest IT outage in history cost the responsible vendor essentially no market share. Switching costs in endpoint security are enormous, and that should inform how much weight you put on “we would just replace them” as a risk control.

Before it, runtime visibility meant a kernel module — crash it and you take the host, as above — or ptrace-style interception, which was too slow to run everywhere. eBPF gives verified, sandboxed, JIT-compiled in-kernel programs with bounded execution. The verifier is the whole point: a bad eBPF program is rejected at load time rather than panicking the machine. That is the direct architectural answer to the failure mode above, and it is why endpoint vendors are being pushed out of the kernel.

• Falco — created at Sysdig in 2016, donated to the CNCF in 2018, graduated February 2024, with maintainers now including Amazon, Apple, IBM and Red Hat. The de facto Kubernetes threat-detection engine.
• Tetragon — part of Cilium. Its differentiator is in-kernel enforcement via LSM hooks: it can block, not just alert, without a round trip to userspace. That matters, because a detection that must leave the kernel to decide has already lost the race against a fast attacker.
• Tracee — Aqua's equivalent, and part of the same open-source-scanner-as-loss-leader pattern.

What eBPF still cannot do: distinguish malicious from legitimate use of a legitimate syscall without context. curl | bash in a CI runner is a build step; in a production pod it is an incident. The kernel sees identical syscalls. Runtime security is a context problem wearing a telemetry costume — which is why the false-positive burden lands here too.

The defining constraint: SIEM is priced on ingest volume while security value comes from coverage. Those pull in opposite directions, so every SIEM programme becomes a negotiation about which logs you can afford not to collect — and the engineering discipline that creates, pipeline filtering and routing and tiering, is now a named job function.