Features and Capabilities

Core Capabilities

Visibility

Real-Time Monitoring: Provides live status updates on images and workloads detected in monitored clusters.
Enhanced Visibility for Runtime Impact only: Provides process-level visibility into running workloads by identifying the actual OS executables and application processes executing inside containers. This enables Runtime-Validated Vulnerability detection. It shows not just what vulnerabilities exist in an image, but whether the vulnerable code is actively loaded and running. By focusing on live processes, Runtime Impact reduces noise, highlights real risks, and enables full traceability from a running process back to the originating build and developer.

Examples include:
- Shell processes: Detects interactive shells running in containers, such as bash and sh, which may indicate manual intervention or potential compromise.
- System utilities: Monitors file movement and outbound network activity, such as mv and curl, that could indicate data exfiltration, lateral movement, or persistence attempts.
- Application runtimes: Confirms whether application processes, such as java and go, are live, allowing correlation with JFrog Xray findings to determine if specific CVEs are truly exploitable at runtime.

Trust Assessment

Trusted Registry Verification: Confirms whether an image originates from a trusted registry. JFrog Runtime flags images pulled from unverified or unknown registries as untrusted.
Integrity Violation Detection and Explainability: Identifies discrepancies between running container images and their source artifacts in JFrog Artifactory. When JFrog Runtime detects a violation, it provides a detailed explainability view with the violation type, severity, forensic evidence, the exact location in your infrastructure, and actionable remediation steps.

Integrity Violation Explainability

JFrog Runtime detects the following integrity violations. Each type has a different severity level that reflects the risk to your environment.

Violation Type	Severity	Description
Digest Mismatch	Critical	The running image digest doesn't match the digest stored in Artifactory. This indicates potential image tampering, a man-in-the-middle attack, or a mis-deployment event.
Missing Source	High	The image is running in your cluster, but JFrog Runtime couldn't find the source artifact in the Artifactory registry. This may indicate a deleted artifact or an unauthorized image sideloaded into the cluster.
Post-Deployment Tag Update	Medium	The source image tag was updated in Artifactory after this running instance was deployed. This indicates mutable image tags, for example `latest`, where the running code differs from the code currently stored under the same tag.

For each violation, the explainability view presents the following sections:

Evidence: What was found? Forensic details specific to the violation type, such as digest comparisons, deployment-to-update timelines, or missing artifact status.
Location: Where is the violation? The exact infrastructure context includes when it was first detected and which cluster, namespace, workload, and node.
Recommendations: What steps are recommended? Actionable remediation guidance tailored to the violation type.

For more information, see Integrity Violation Explainability.

Prioritization

Cross-Correlation Insights: Integrates with Xray and JFrog Advanced Security to assess the severity and relevance of detected images and potentially malicious packages.
Blast Radius Analysis: Evaluates the number of workloads using specific images and their locations across clusters, helping to gauge the impact of vulnerabilities.
Skip If Not In Runtime: With a connected JFrog Runtime controller and Advanced Security, Xray security policy rules can suppress violations for Docker images that aren't running in your clusters. For more information, see Skip If Not In Runtime.
Vulnerability Prioritization for Runtime Impact only:
- Determines if vulnerable code is actively loaded into memory, focusing on real threats.
- Helps prioritize remediation efforts by identifying vulnerabilities currently in use.

Vulnerability Prioritization Dashboard

The Vulnerability Prioritization Dashboard provides a centralized view of all CVEs detected across running container images, combining static scan data from JFrog Xray and Advanced Security with runtime intelligence from deployed sensors. It enables security teams to cut through vulnerability noise and focus on the issues that pose real risk to production.

The dashboard includes:

Prioritization Funnel: A multi-stage funnel that progressively narrows vulnerabilities from all detected CVEs down to those that are Critical or High severity, confirmed applicable by Contextual Analysis, have a fix version available, and are validated as actively running in production. Stages are cumulative, so each layer builds on the previous one.
Vulnerability Table: A detailed, searchable, and filterable table of individual CVEs with severity, CVSS scores, JFrog Research severity, contextual analysis status, fix availability, runtime validation status, affected components, and related images.
Blast Radius View: For any CVE, you can drill down to see all running container images affected and gauge impact across clusters and workloads.
Running Images Trend Chart: A 30-day time-series tracking running image counts, scan coverage, and vulnerability severity breakdowns over time.
Live Assessment Highlights: At-a-glance risk indicators for malicious packages, critical and applicable CVEs, and integrity violations across the environment.

Traceability

Enhances traceability by identifying image owners and enabling rapid risk mitigation by locating the build owner and deployer.

Real-Time Alerting

Automates security policy enforcement, allowing organizations to apply predefined security rules.

Access Control

JFrog Runtime uses a Role-Based Access Control (RBAC) model that limits access to runtime-detected Docker images based on project-level permissions. JFrog Runtime monitors container environments and reports both trusted and untrusted images, and RBAC ensures that you see only the images associated with the projects you belong to.

Admins have full visibility across all runtime data. If your access is project-scoped, you see only the images relevant to your assigned projects. This reduces unnecessary exposure of sensitive information and keeps visibility aligned with your responsibilities.

On self-hosted deployments, version 1.14 or later, project filtering is disabled by default. For more information, see Enable Project Support for Live Assessment on Self-Hosted Deployments. On SaaS, contact your JFrog Customer Success representative to enable project RBAC.

Visibility of Projects on the JFrog Platform

Every Docker image that JFrog Runtime monitors is associated with one or more JFrog Projects, based on repository assignment or admin configuration.
When you access JFrog Runtime in the UI or API, JFrog Runtime automatically filters the image list according to the projects you belong to and the roles assigned to you.

Project Members: See only the images associated with their assigned projects.
Project Admins: Manage which members can access the project's runtime assets.
Platform Admins: Configure all projects and assign roles globally.