KubeSeccomp Workload Security Profiler

Generate per-workload seccomp and network policies from real eBPF behavior

Problem

Many teams still run the runtime's default seccomp profile in production, with no idea which syscalls their pods actually make or which network endpoints they touch. One team ended up manually capturing and auditing syscalls to build a workload-specific list, which is tedious and hard to keep current. Default profiles are either so broad they provide little protection or so tight they break workloads.

Solution

A lightweight agent listens to target workloads via eBPF for a period, tallies actual syscalls and network connections, and emits ready-to-apply seccomp profiles and NetworkPolicies with an over-broad/too-tight risk report. One-click sampling per namespace or workload, YAML output, and a diff against the default profile.

Users

Platform and security engineers at small-to-mid Kubernetes shops without a dedicated security team but facing audits and compliance

MVP

eBPF collection of syscalls and connections in one namespace; generate seccomp profile and NetworkPolicy YAML; diff against the default profile; export a report; Linux plus common container runtimes only

Revenue

Subscription per cluster node, with an open-source core collector; enterprise tier adds multi-cluster aggregation, compliance reports, and alerts; optional per-scan billing

Why now

The eBPF toolchain is mature and Kubernetes security compliance is rising, yet big vendors focus on runtime protection rather than config generation, leaving room for a solo developer to ship with Go and libbpf in weeks