Aqua Security is a leader in the field of cloud-native security, providing full-stack security protection for containers Kubernetes and Serverless, as well as AI-enhanced threat detection and runtime protection.

AquaSecurity

Core parameters and statistics

Aqua Security is a cloud-native contextual application security platform (CNAPP), officially positioned as "Cloud Native Application Protection Platform", covering full-link security from construction to runtime. The core difference lies in: eBPF-based kernel-level monitoring capabilities and AI-driven abnormal behavior detection engine.

Projects	Public Information
Official Positioning	Cloud Native Application Protection Platform
Core capabilities	Container image scanning K8s security posture, runtime protection, compliance audit
AI capabilities	ML-based abnormal behavior detection, threat scoring and automatic response
Support context	Container Kubernetes, Serverless, VM, multi-cloud/hybrid cloud
Deployment models	SaaS cloud, self-hosted, hybrid deployment
Enterprise customers	500+ worldwide, covering technology, finance, retail, and government
Compliance Certification	SOC 2 Type II, ISO 27001, FedRAMP, GDPR, PCI DSS
Headquarters	Israel (R&D and Global Operations)
Financing stage	Cumulative amount exceeds 260 million US dollars, D/E round

Industry Echelon: Aqua has been listed as a leader in the Gartner CNAPP Magic Quadrant for many consecutive years, and together with Prisma Cloud (Palo Alto Networks), Sysdig, and Lacework, forms the first echelon of cloud native security. Its difference lies in the depth of eBPF technology self-research and the maturity of the AI ​​behavior analysis engine, rather than simple function stacking.

Differentiation of AI core: Traditional security tools rely on signature libraries to match known threats. Aqua's AI engine collects system calls, network traffic and file activity data through eBPF to establish a behavioral baseline for each Pod and container. Deviations from the baseline will trigger an alarm or automatic isolation. This mechanism can discover "unknown threats" such as zero-day exploits, fileless attacks, and cryptomining, rather than just matching exposed CVEs.

User and market recognition of Aqua Security

Gradually build user awareness in the field, and product capabilities are used by content creators and teams to improve work efficiency. Some industry users have incorporated it into their daily workflow. It is recommended to refer to the latest official disclosures for specific user scale and industry adoption rate data.

Cost Advantages of Aqua Security

• C-side/Individual: Usually a free version is provided to experience the core functions, and high-frequency use requires a paid package subscription.
• API/Developer: Billed by call volume, suitable for development teams that can be flexibly integrated into their own systems.
• Enterprise/Privatized: Contact the business owner for customized quotation and deployment plan. The specific price is subject to the official real-time pricing page.

Main features of Aqua Security

Aqua's capabilities are designed around "full-link security from image construction to runtime exit", and its core functions can be summarized into five lines:

• Container image scanning and CI/CD integration: Scan operating system packages (Alpine, Ubuntu, Debian), application dependencies (npm, pip, Maven) and basic image layers during the image building phase to identify CVE vulnerabilities, malware and sensitive information leaks. Directly connect to mainstream CI tools such as Jenkins, GitLab CI, and GitHub Actions. Images that do not comply with the policy are prohibited from being pushed to the mirror warehouse.
• Kubernetes Security Posture Management (KSPM): Continuously monitor the configuration deviation of the K8s cluster, including privileged container hostNetwork exposure RBAC over-authorization Pod Security Standards violations, etc., benchmarked against the CIS Kubernetes Benchmark. Generates remediation recommendations and automatically submits Admission webhook policies.
• AI Runtime Threat Detection and Response: Based on eBPF technology, it captures system calls (syscalls), network connections, file operations and process creation of containers at the Linux kernel layer; the ML model establishes behavioral baselines for each container, triggers alarms when it deviates from the baseline and supports automatic isolation (such as killing containers, blocking network connections, and generating forensic snapshots). Detections cover cryptomining, reverse shells, data theft, credential access, and lateral movement.
• Admission Controller: Before Kubernetes applications are deployed to the cluster, Webhooks intercept and verify image signatures, vulnerability thresholds, compliance policies, and supply chain sources. Pods that do not meet the conditions are directly rejected at the orchestration layer and do not enter the scheduling queue. This is the most critical "checkpoint" capability in the implementation of DevSecOps.
• Compliance and Audit Automation: Preset compliance baseline frameworks such as PCI DSS, GDPR, SOC 2, HIPAA, NIST 800-53, etc., regularly scan the compliance gaps between containers and standards, and automatically generate audit reports. Supports custom policy templates and regular export.

Hidden linkage: Vulnerabilities discovered by image scanning can be automatically associated with the real-time threat context of running Pods - if a running container is using a library with CVE and the AI ​​model detects abnormal traffic, Aqua will also provide "vulnerability paths + exploitation signs", so security analysts do not have to correlate and troubleshoot between multiple consoles. This signal connection from build to runtime is the core added value of CNAPP compared to isolated scanning tools and runtime tools deployed in isolation.

Version evolution of Aqua Security

Aqua's version strategy is based on annual major releases, supplemented by continuous feature updates. Since the official has not fully disclosed the precise dates of all historical versions, the following is organized according to publicly verifiable milestones.

Mainline version

Version	Release Date	Key Changes
2025.1	~2025-03	Introducing AI-driven runtime abnormal behavior detection and automatic response
2024.2	~2024-06	Enhanced container image scanning depth and admission controller functions
2024.1	~2024-01	KSPM module fully upgraded, new multi-cloud policy unified management
2023.3	~2023-09	Serverless security extensions, supporting AWS Lambda and Azure Functions
2023.1	~2023-03	Introducing the eBPF collection layer and reconstructing the runtime threat detection engine
2022.2	~2022-06	The first CNAPP unified platform version, integrating image scanning K8s security and runtime

Interpretation of key nodes

• 2023.1's eBPF refactor is a turning point in Aqua's technology roadmap. Before this, runtime detection of user-mode hooks that relied on agents was limited in coverage and performance; after switching to eBPF, the collection granularity was refined from the process level to the system call level, and there was no need to modify the kernel module.
• 2024.1's KSPM upgrade extends security policy management from single cluster to multi-cloud (AWS EKS, Azure AKS, GCP GKE) unified view, which is a key capability for enterprise customers with multiple K8s clusters.
• 2025.1's AI engine embeds the ML model directly into the runtime detection link. It is no longer an independent alarm rule engine, but a real-time behavioral baseline model.

Aqua Security’s Technical Advantages

Aqua's technical moat is not in a single algorithm, but in the synergy depth of the three lines of "eBPF collection + AI analysis + K8s native integration".

Self-developed advantages of the eBPF collection layer: Compared with Sysdig's reliance on the open source Falco community standard, Aqua's eBPF agent is completely self-developed and can more finely control the collection range (filtering events by namespace Pod, container granularity) and sampling rate (dynamically downsampling in high-frequency scenarios to reduce CPU overhead). This means that under the same kernel event throughput, Aqua agent consumes less resources and is suitable for production environments that are mixed with business containers.

Causal chain of AI behavioral baseline model: Aqua’s ML model is not a simple outlier detection, but a timing model specially trained for container workloads. The core logic is to establish a normal behavior portrait for each Pod during the "learning period" after startup (usually 24-48 hours), including system call frequency distribution, network connection topology, and file access mode; after the learning period, only events that deviate from the baseline by more than 3 standard deviations will trigger an alarm. This baseline accuracy of "per container rather than per node" can significantly reduce the false positive rate in microservice architecture. However, for Job/CronJob containers with extremely short life cycles, the learning period may not be able to complete baseline convergence, and static policies need to be configured separately.

K8s native admission control: Aqua's Admission Controller is natively connected to the K8s orchestration layer in the form of ValidatingWebhookConfiguration. It does not require sidecar or CNI plug-ins and has zero intrusion into the cluster's existing scheduling links. Policy evaluation is completed within this cluster and does not rely on external service availability to avoid deployment blocking of the entire cluster due to unreachable platforms.

Machine-readable maintenance of compliance baselines: Aqua converts compliance requirements such as CIS, PCI DSS, GDPR, etc. into machine-executable inspection rules (Rego policies or custom DSLs) instead of PDF documents. Enterprises can encode their own internal security baselines into policy templates for continuous and automated verification. This "compliance as code" approach shortens the audit preparation cycle from weeks to minutes.

How to use Aqua Security

Aqua provides two main entrances, SaaS cloud and self-hosted, suitable for different enterprise sizes and compliance requirements.

How to use	Suitable scenarios	Features	Cost model
SaaS cloud	Quick verification, small and medium-sized clusters	No operation and maintenance, manage policies and alarms through the web console	Monthly subscription by node
Self-hosting/privatization	Large enterprises with high data sovereignty requirements	Deployed in the enterprise's internal K8s cluster or your own cloud account	Business negotiation required
Hybrid deployment	Scanning SaaS + runtime privatization	Image scanning goes to the cloud, runtime detection agent smuggling private network	Combination pricing

Typical deployment steps:

1. Registration and Activation: Visit the Aqua official website to register a corporate account, and choose SaaS or self-hosted mode.
2. Platform Initialization: Configure scanning policies (vulnerability severity thresholds, compliance baselines), notification channels (Slack, PagerDuty, Splunk) and RBAC roles in the Aqua console.
3. K8s cluster access: Execute kubectl apply in the target cluster to deploy Aqua Operator (including eBPF DaemonSet and Admission Webhook). Helm Chart is officially provided, supporting parameterized configuration of monitoring namespace, collection granularity and agent resource limits.
4. CI/CD integration: Add an Aqua scan step (CLI or API) after the Dockerfile build phase, bind the scan results to the build pipeline, and block image push if it fails.
5. Operating baseline establishment: During the AI ​​learning period of 24-48 hours after access, the system automatically establishes a behavioral baseline for each Pod. During the learning period, only records are recorded but not blocked to avoid false alarms in the early stages of going online that may affect the business.
6. Policy Tuning: After the baseline is established, the security team adjusts the sensitivity threshold and whitelist rules based on the initial alarm, and then switches the protection mode from "monitoring only" to "monitoring + automatic blocking".

Recommendation for implementation rhythm: First select a non-core production Namespace (such as staging or dev) and run through the entire process, verify the scan coverage, runtime false alarm rate and agent performance overhead, and then expand to the core production cluster after confirming the baseline. Before each expansion, use kubectl describe and kubectl top to check the node resource balance to ensure that the eBPF agent will not cause resource contention.

Product Pricing for Aqua Security

Aqua adopts a tiered pricing strategy, and the public information is mainly based on two billing models: scan-by-image and subscription-by-node:

Tier	Billing granularity	Included capabilities	Public price
Image scanning (pay-as-you-go)	Number of scans	CI/CD vulnerability scanning, malware detection	Pay-as-you-go billing, please contact sales for unit price
Full version of the platform	Node/month per workload	Image scanning + KSPM + runtime protection + admission control	Subject to official real-time quotation
Enterprise Edition	Customization	Unlimited nodes + Private deployment + Dedicated support + SLA	Customized quotation

• C client/individual developer: Image scanning in the free tier is suitable for personal project verification, but runtime protection and access control cannot be used. Concurrency limits for free scans and vulnerability library update delays need to be confirmed.
• Developer/API Call: The pay-as-you-go scanning API is suitable for CI/CD pipeline integration, and the cost is related to the number of scanning image layers, vulnerability database version and application dependency resolution depth. It is recommended to estimate explicit costs based on monthly scan volumes after obtaining quotes during the PoC stage.
• Enterprise Procurement: Full platform is billed per protected workload node, and a typical enterprise annual contract typically includes a fixed node pool + elastic overage metrics. Before signing, it is important to confirm: the billing multiplier of excess nodes, the price locking clause for node expansion during the contract period, and whether the eBPF agent is included in the number of nodes (usually the agent itself is not charged extra, but the business nodes monitored by it are included). These details affect the evolution of TCO after large-scale launch.

Application scenarios of Aqua Security

Aqua's core scenarios focus on cloud native environments that require "integrated security from build to runtime":

• Runtime threat protection for Kubernetes production clusters: AI runtime detection monitors the system behavior of each container in real time, automatically isolates infected containers and generates forensic snapshots as soon as cryptominer, reverse shell, and data theft occur. Typical benefits: Security incident response time is reduced from hours (manual research and judgment) to minutes (automatic blocking). Verification points: During the PoC, simulated attacks (such as struts vulnerability exploit test CoinMiner simulated payload) must be used to verify the automatic blocking delay and false blocking rate.
• Security card embedding in the DevSecOps pipeline: Integrate Aqua scanning in the image building stage of the CI/CD pipeline. Images with vulnerabilities exceeding the threshold or containing malware are not allowed to be pushed to the image warehouse. Typical benefits: Move security detection to the left to the development stage, and the number of production-bound vulnerabilities changes from "weekly repair" to "blocking during the build stage". Verification points: Confirm that the threshold strategy (such as blocking only Critical/High vulnerabilities or including Medium) does not conflict with the existing development process, and whether the scanning throughput can match the concurrent build volume of CI.
• Unified security policy for multi-cloud and hybrid cloud: Deploy Aqua on AWS EKS, Azure AKS, GCP GKE and self-built K8s clusters at the same time, and manage all security policies and compliance baselines through a single console. Typical benefits: The security team does not need to configure inspection rules and alarm receivers for each cloud platform separately, and policy changes take effect once. Verification points: Policy synchronization delay between cloud platforms, API frequency control limits, and cross-cloud agent upgrade process.
• Compliance Automated Auditing for Regulated Industries: Financial, healthcare, and government customers face ongoing compliance pressures with PCI DSS, HIPAA, GDPR as they containerize. Aqua's pre-built compliance baselines + automated scanning + report generation turn audit preparation from "quarterly manual inspection" to "continuous automated verification." Typical benefits: The audit team can directly export the Aqua compliance report during the annual audit, eliminating the need for

There are knots in the cross-checking of manually collected evidence. Key points to check: How big is the gap between the preset baseline and the actual compliance needs of the enterprise, and whether the reporting format is recognized by external auditors.

• Software Supply Chain Security: Complete SBOM generation and vulnerability correlation from base image layer (e.g. Alpine, Distroless) to application dependency layer (npm, PyPI, Maven). Cooperate with image signature and access control to ensure that the deployed production image can be verified from source to content. Verification points: SBOM format (CycloneDX / SPDX support), image signature trust anchor configuration, and coverage of non-standard base images.

Who is Aqua Security suitable for?

Aqua's product positioning determines that it mainly serves organizational-level security capability building rather than individual enthusiasts:

• Security Operations Team (SOC/SecOps): Need to monitor abnormal behavior when containers are running in real time and respond to events. Aqua’s AI alarm sorting and automatic isolation capabilities can reduce daily alarm fatigue and allow security analysts to focus on high-confidence alarms. Prerequisites: The team needs to have basic knowledge of K8s and the alarm escalation process, otherwise automatic isolation may have unexpected impacts on the business.
• DevOps/Platform Engineering Team: Responsible for CI/CD pipeline and K8s cluster operation and maintenance. It needs to embed security scanning in the build phase and configure access policies at the cluster level. Aqua’s Helm Chart deployment method and the completeness of CI integration documents directly affect the team’s implementation efficiency. Prerequisites: The K8s cluster is running stably in a production environment and the CI/CD pipeline has a clear post-build stage for integration scanning.
• Compliance and Risk Management Team: Need to regularly prove the security compliance status of containers to the audit agency. Aqua’s automated compliance scanning and report generation reduces the burden of manual evidence collection. Prerequisite: The enterprise has a clear compliance framework (e.g. PCI DSS, SOC 2) and the auditor accepts automatically generated compliance reports as formal evidence.
• CISO and Security Architect: Responsible for selecting the enterprise-level CNAPP platform and evaluating the supplier's coverage depth, technical roadmap and procurement risks. They are concerned about Aqua's position in the Gartner MQ, the long-term sustainability of the eBPF technology roadmap, and the vendor's financial health. Prerequisites: Enterprises are adopting or planning to adopt Kubernetes at scale, and security teams are ready to move from traditional perimeter security to workload security.

Not suitable for boundaries: It is not recommended to give priority to Aqua in the following scenarios - non-containerized traditional virtual machines are bounded (Aqua's core capabilities are designed around containers and K8s, and pure VM scenarios are more suitable for CrowdStrike or SentinelOne); security teams have no K8s operation and maintenance capabilities at all (Aqua's deployment and policy configuration are highly dependent on K8s knowledge, and it is difficult to implement without the cooperation of the platform engineering team); teams that only need static image scanning (trivy, Clair can be considered) and other open source solutions, with lower costs and no need to purchase a complete platform); the life cycle of business containers is extremely short and stateless (such as millisecond-level FaaS functions, and the learning period of eBPF cannot converge to the baseline).

Summary and Outlook of Aqua Security

Aqua Security's core competitiveness lies in the technology route choice of "cloud native security" - since its establishment in 2015, it has designed security capabilities around containers and K8s, rather than adding container modules to traditional security products. Its self-developed eBPF detection layer and AI behavioral baseline engine are industry-leading in the accuracy and performance of container runtime threat detection, especially in unknown threat scenarios such as encrypted mining, zero-day vulnerability exploitation, and fileless attacks. CNAPP unified platform policy allows the security team to complete policy management on one console from build to runtime, reducing context switching costs when multiple tools collaborate.

Current Limitations and Uncertainties:

• Platform Complexity: The learning curve of the full set of CNAPP features is significantly higher than that of a single scanning tool. Enterprises usually need security engineers + K8s operation and maintenance engineers to be jointly responsible for going online. Small teams may face manpower bottlenecks.
• AI False Positive Governance: While "per-container baseline" is designed to outperform coarse-grained node-level instrumentation, in batch jobs, big data pipelines, and CI-intensive clusters where system call patterns are diverse, models can produce intermittent false positives. The PoC phase requires verifying the false positive rate with real business traffic and evaluating the security operations manpower required for tuning.
• eBPF Compatibility: eBPF is sensitive to Linux kernel version (usually requires 5.10+), older distributions or customized kernels may require additional adaptation. When enterprises evaluate privatized deployment, they need to check the kernel version list of each node in advance.
• Hidden risk of vendor lock-in: Once runtime protection, access control, and compliance baselines are all bound to Aqua, the cost of migrating to an alternative platform is not low. Enterprises should retain automated backup mechanisms for key strategies during the contract period, and pay attention to the capability gaps between the open source Falco ecosystem and Aqua to prepare for switching to competing products in the future.
• Pricing is not transparent: The per-node subscription price and overage billing ratio of the complete platform are not disclosed on the official website. Enterprises should ask the manufacturer to issue a formal quotation with overage terms during the PoC stage to avoid being pushed up by overage fees after large-scale volume expansion.

Procurement and Implementation Suggestions: It is recommended that enterprises that are adopting or planning to adopt Kubernetes on a large scale include Aqua in the CNAPP selection PoC short list. It is recommended to verify in the form of "single production cluster + one month PoC": in the first week, focus on testing scan coverage and CI/CD integration; in the second week, simulated attacks are introduced to verify the recall rate and false positive rate of AI runtime detection; in the third week, the impact of access control on the deployment pipeline is tested; in the fourth week, the security team evaluates the quality and export process of the compliance report. Determine whether to expand after confirming three key indicators: the eBPF agent's CPU usage of business Pods (target < 5%), the false positive rate of AI runtime detection on business traffic (target < 2%), and the impact of admission control on Deploy latency (target < 200ms). Before locking in an enterprise procurement contract, be sure to specify in the contract the excess node billing multiple, the price freeze clause SLA coverage of runtime detection availability in the contract, and the data export strategy.

Related tools: notion-ai, google-workspace

Aqua Security’s model and version evolution

Continuous iterative updates, the latest version introduces performance optimization and new features. Historical version information can be viewed on the official release page. There is no complete public version evolution timeline yet. It is recommended to pay attention to the official announcement to understand the rhythm of feature updates.

How to use Aqua Security

• Web client: You can use it by visiting the official website and registering an account. Most functions do not require installation.
• API access: Provides RESTful API, developers can obtain the API Key and integrate it into their own applications.

Version Info

• Aqua AI Threat Detection ：Introducing AI-driven runtime abnormal behavior detection and automatic response. There is no official precise date yet. （~2025-03）
• Aqua Cloud Native Security v2024 ：Enhanced container image scanning and admission controller functions. There is no official precise date yet. （~2024-06）