Runtime

Learn how JFrog Runtime secures workloads running in production.

JFrog Platform Integration

JFrog Runtime integrates with the broader JFrog Platform, which includes JFrog Artifactory, JFrog Xray, and JFrog Advanced Security. This integration allows it to:

Correlate runtime artifacts with their sources in Artifactory for complete trust in your Runtime environment.
Enrich runtime data with security insights from Xray, identifying vulnerabilities and malicious packages on an ongoing basis based on JFrog Catalog and JFrog research information.
Aggregate and analyze data for security triaging and prioritization.

Runtime Sensors Installed in Kubernetes Clusters

Within Kubernetes environments, JFrog Runtime deploys specialized sensors to collect real-time runtime data. These sensors:

Monitor running processes, file access, and kernel activity using extended Berkeley Packet Filter (eBPF) technology.
Detect security threats and integrity violations in real time.
Transmit collected data securely to the Runtime Service within the JFrog Platform for further analysis.

Runtime Modes of Deployment

JFrog Runtime offers two modes of deployment, each designed for different levels of security coverage and cost considerations.

Runtime Integrity

Runtime Integrity is the controller-only mode. It enables communication with the Kubernetes API. It tracks Kubernetes cluster activity, including resource execution and orchestration, and collects data on Nodes, Workloads, Pods, and Containers.

Runtime Integrity provides foundational security insights by:

Communicating directly with the Kubernetes controller API.
Focusing on monitoring Kubernetes cluster resources such as Nodes, Workloads, Pods, and Containers.

Runtime Impact

Runtime Impact is the controller and sensors mode. It installs an eBPF sensor on each node in a Kubernetes cluster to capture detailed runtime behavior at the process and file level. It sends collected data to the Runtime Service for security analysis.

Runtime Impact delivers a granular and comprehensive runtime security assessment by:

Deploying a sensor on every cluster node for deeper visibility.
Monitoring container runtime behavior, process executions, and file interactions.

Kubernetes DaemonSets with host privileges deploy the sensors.

Where Runtime Fits in the JFrog Security Timeline

The following table describes JFrog Runtime's role in the security timeline.

Stage	Runtime's Role
Production and Runtime Security	Provides real-time monitoring of your clusters for running images, workloads, and processes. Detects running vulnerabilities, unauthorized processes, and integrity violations. Prioritizes security incidents by determining if vulnerable code is actively loaded into memory.

For more information, see Installing JFrog Runtime Security.

Business Needs for JFrog Runtime

As you adopt Kubernetes and cloud-native architectures, securing the runtime environment becomes as critical as pre-deployment protection. JFrog Runtime extends security into live environments, ensuring continuous monitoring, trust validation, and real-time threat detection. Key concerns include:

Continuous Runtime Security and Threat Detection: Traditional security measures focus on static analysis, but runtime threats emerge dynamically. JFrog Runtime provides real-time monitoring of running workloads, processes, and file activity to detect security risks as they occur, preventing unauthorized code execution and integrity violations.
Trust Validation for Deployed Artifacts: You need assurance that only trusted and verified artifacts run in production. Runtime correlates live images with their source in JFrog Artifactory, flagging untrusted registry usage, image tampering, and discrepancies between stored and deployed artifacts.
Prioritizing Real, Exploitable Vulnerabilities: Security teams are often overwhelmed by vulnerability alerts that lack context. JFrog Runtime analyzes whether vulnerable code is actively loaded into memory, reducing false positives and prioritizing threats that pose immediate risks to running applications.
Visibility and Compliance for Kubernetes Security: Maintaining security visibility across distributed Kubernetes clusters is a challenge. Runtime provides blast radius analysis, workload risk insights, and integrity monitoring, helping you enforce security policies, meet compliance standards, and respond quickly to incidents.
Reducing Operational Overhead for DevOps and Security Teams: Manual runtime security management slows down operations and increases risk. JFrog Runtime automates security policy enforcement, alerting, and event-driven workflows, integrating seamlessly with existing DevSecOps pipelines for efficient risk mitigation.