All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
ARMO sells runtime security software to organizations running Kubernetes and cloud applications. It detects threats by anomaly analysis and responds automatically. ARMO created and maintains Kubescape, an open-source Kubernetes security tool and Cloud Native Computing Foundation project. Rapid7 describes Kubescape as adopted by over 100,000 organizations. Founded in 2019, it has raised $34.5 million, including a $30 million Series A in 2022 led by Tiger Global. Its named customers are Vandebron and Orange Business, which offers ARMO's software by default to its managed Kubernetes customers. Rapid7 has partnered with ARMO to add ARMO's runtime protection to its own exposure management platform. A rival would take longest to reproduce that partnership and ARMO's role maintaining Kubescape.
| Description | Cloud runtime security company that created and maintains the open-source Kubescape project and sells ARMO Platform, which combines Kubernetes posture management, runtime vulnerability prioritization, and behavioral threat detection and response. | [f1] |
|---|---|---|
| Founded | 2019 | [f2] |
| Funding | $34.5M total | [f3] |
| Latest funding | $30M Series A (April 2022) | [f4] |
| Product | What it does |
|---|---|
| ARMO Platform | Runtime security platform that baselines workload behavior with an eBPF sensor, detects and responds to anomalies, and adds Kubernetes posture, compliance, and vulnerability management. |
| Kubescape | Open-source Kubernetes security platform and CNCF incubating project that scans clusters, manifests, and CI/CD pipelines for misconfigurations and vulnerabilities, with runtime threat detection. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
ARMO Platform baselines cloud workload behavior with an eBPF sensor to detect runtime threats and respond automatically, and its Kubescape-based scanning inventories and hardens Kubernetes clusters and configurations. These capabilities are mapped to the Cyber Defense Matrix. [f5]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | ARMO names DevOps, security, and platform teams as its buyers and anchors the pain in alert noise and unprioritized vulnerabilities (s1, s2), and KuppingerCole independently names the alert-fatigue problem (s18), but the pain stays unquantified outside vendor claims. [s1, s2, s18] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 4/5 | Vendor pages detail the eBPF sensor, behavioral baselining, and automatic response (s1, s4), and the open-source Kubescape engine carries external validation through CNCF incubation and documented adoption at Intel and Bitnami (s13, s14). [s1, s4, s13, s14] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 | Independent demand signals arrived within the past year, with Rapid7 embedding ARMO's runtime protection in its Command Platform in January 2026 (s16) and KuppingerCole profiling the company as a Rising Star (s18). The enabler is kernel-level instrumentation maturing into production sensors after Kubescape's 2021 launch and 2022 CNCF entry (s6, s13). [s16, s18, s13, s6] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 4/5 | ARMO, founded by Shauli Rozen, Leonid Sandler, and Ben Hirschberg (s11), created and maintains a CNCF incubating project (s13, s14), and the team's kernel research on system-call blind spots drew independent coverage (s17), a sustained and multiply evidenced community standing. [s11, s13, s14, s17] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 | Vandebron and Orange Business are named case-study customers, with Orange Business offering ARMO Platform as the default security solution of its Managed Kubernetes Service (s7, s8), and the Rapid7 partnership is corroborated by independent press (s16). [s7, s8, s9, s16] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | The $34.5 million raised across two rounds (s12) is proportional to stage, and ARMO kept shipping on the 2022 raise, including the 2025 detection launch and Kubescape 4.0 (s12, s13), but no disclosed revenue or margin confirms efficiency. [s12, s10, s13] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | ARMO coined the CADR label and promotes it through its own summit and comparison pages (s1, s4), and while press repeats the term (s12), the analyst record still files the company under cloud-native application security (s18), so placement needs vendor explanation. [s1, s4, s12, s18] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Open-source distribution and the Rapid7 channel create absorption friction a single feature release cannot match (s9, s16), but the Apache-licensed engine is available to any platform vendor (s6) and no structural moat appears in the record. [s9, s16, s6] |
ARMO sells to the teams that operate cloud-native infrastructure, where security signal drowns in noise. The company's stated buyers are DevOps, security, and platform teams running Kubernetes and cloud workloads, and its pitch is that those teams face thousands of alerts and vulnerability findings that do not reflect what is actually exploitable in production (s1, s2). The remedy it proposes is runtime evidence: watch what workloads actually do, and use that to rank or dismiss everything else.
Independent observers describe the same pain, though without hard numbers. KuppingerCole's Rising Star profile names alert fatigue as the challenge ARMO addresses and places the company in cloud-native application security (s18). Rapid7's decision to add runtime protection to its exposure management platform through ARMO suggests the buyer demand extends beyond ARMO's own funnel (s16). The pain is real and recognized, but no third party quantifies it in the reviewed record. [s1, s2, s18, s16]
ARMO Platform packages posture, vulnerability, and runtime protection around one behavioral idea. A sensor built on eBPF, a Linux kernel instrumentation technology, learns the normal behavior of each workload, detects deviations through anomaly analysis, and can respond automatically, including quarantine of suspicious processes (s1, s4). The same runtime evidence filters vulnerability lists down to the findings that are reachable in running code, and feeds posture and compliance reporting for clusters and cloud accounts (s1, s7).
The engine underneath is open source. Kubescape, which ARMO created, scans clusters, manifests, and pipelines for misconfigurations and vulnerabilities, entered the CNCF Sandbox in 2022, and became a CNCF incubating project in February 2025 (s13, s14). Kubescape 4.0, released by March 2026, moved runtime threat detection to general availability and added scanning for AI agents (s13). A companion solution page extends the platform to AI workloads, discovering agents and inference servers in clusters and profiling their runtime behavior (s5).
The team's research gives the capability claims unusual specificity. ARMO researchers demonstrated a proof-of-concept rootkit that abuses the io_uring Linux mechanism, showing that the widely used Falco and Tetragon tools are blind to that class of operations (s17). Research of that kind supports the depth of the runtime engineering, though it does not by itself prove the commercial product's efficacy. [s1, s4, s5, s7, s13, s14, s17]
ARMO positions itself against the cloud security platform consensus. Its site argues that posture-centric platforms flag theoretical risk while behavioral runtime detection catches real attacks, and it markets the category as Cloud Application Detection and Response, a term ARMO coined and promotes through its own summit (s1, s4). KuppingerCole, the analyst voice in the reviewed record, still files ARMO under cloud-native application security (s18).
The crowd it must displace is large. Posture and vulnerability management for Kubernetes is a standard feature of cloud security platforms, and the open-source world offers free runtime detection in tools such as Falco and Tetragon, the same tools ARMO's research critiques (s17). ARMO's differentiators are the behavioral baseline it learns per workload and the open-source distribution of its engine, which reaches buyers a proprietary rival must win through sales calls (s9, s14). The Rapid7 partnership cuts both ways: it validates the technology and hands its distribution to a larger vendor's platform (s16). [s1, s4, s9, s14, s16, s17, s18]
ARMO's go-to-market runs from free software to paid platform. Kubescape spread first, and Rapid7 describes it as adopted by over 100K organizations, while ARMO's own site claims more than 40K companies and 15M scans per month (s9, s1). Those adoption numbers are vendor-published. The CNCF documents named adopters of the open-source project, including Intel, AWS in educational material, and Bitnami (s14).
Paying-customer evidence is narrower. The public record names two case-study customers: Vandebron, an energy company, and Orange Business, which runs ARMO Platform in a sovereign cloud environment and offers it as the default security solution of its Managed Kubernetes Service (s7, s8). The Orange arrangement doubles as a channel, since Orange's managed-service customers inherit the product. The January 2026 Rapid7 partnership embeds ARMO's runtime protection in Rapid7's Command Platform, a distribution motion corroborated by independent press (s9, s16). No revenue, retention, or customer-count disclosure appears in the reviewed record. [s1, s7, s8, s9, s14, s16]
Two of the three co-founders hold named executive roles. Shauli Rozen is CEO and Ben Hirschberg is CTO (s2), and Leonid Sandler co-founded the company with them in 2019 (s11). ARMO is the creator and main maintainer of Kubescape (s9), so the founders' engineering reputation and the project's standing rise and fall together.
The team's public output is a stronger signal than its resumes. Creating a security project that a foundation accepted and then promoted to incubating status is a multi-year, externally judged accomplishment (s13, s14). The io_uring rootkit research that exposed blind spots in Falco and Tetragon drew independent security press coverage (s17). The reviewed record documents no prior founder exit, so the credibility case is community standing rather than a track record of built-and-sold companies. [s2, s11, s13, s14, s17]
ARMO's public trust collateral is thin for a company selling to security teams. The homepage displays a SOC 2 badge image, and a probe of trust.armosec.io and security.armosec.io (no DNS record), the /trust and /compliance paths (404), and the /security page, which renders an empty body, found no attestation evidence beyond that self-displayed badge as of 2026-07-03 (s19). No inspectable trust portal or audit report backs the badge in the reviewed record.
Deployment flexibility partly compensates for the thin attestation record. Orange Business selected the platform for a sovereign cloud environment and runs it on premises, a requirement it says few tools support out of the box (s8). For buyers whose constraint is data residency rather than certification paperwork, that architecture is the more relevant trust signal. [s8, s19]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Oligo Security | competes with | Runtime application detection and response vendor whose eBPF sensor and similar category language overlap ARMO's pitch. | |
| Sweet Security | competes with | Runtime cloud security vendor selling a unified sensor-based detection platform to the same buyers. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Orca Security | competes with | Agentless cloud security platform whose posture and vulnerability coverage overlaps ARMO's posture pillars at larger scale. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Sysdig | competes with | Commercializes runtime detection around the open-source Falco project, the tool ARMO's kernel research directly critiques. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Wiz | competes with | Cloud security platform whose runtime sensor and broad coverage could absorb runtime application defense at far larger scale. |
Add analyzed competitors to compare them side by side with ARMO.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
pivot urgently
What ARMO sells is easier to copy than what ARMO is. The platform is software the customer runs, with behavior baselines learned separately for each customer. No cross-customer data asset appears in the record, and a self-displayed SOC 2 badge is the extent of its attestation evidence. The harder things for a rival to reproduce are institutional. ARMO maintains a Cloud Native Computing Foundation project, published kernel research showing that the Falco and Tetragon security tools miss a class of rootkits, and won the 2026 deal in which Rapid7 embeds its runtime engine. Each is a head start rather than a lock: Kubescape's open license lets anyone build on the same engine. Most defensible with buyers who already run Kubescape, weakest against platform vendors bundling runtime detection.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Customers buy and operate the software themselves, deploying the sensor and acting on its findings, with pricing tied to infrastructure size rather than to a judgment or accountability layer (s1, s3), the software-product level. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Learned behavioral baselines, tuned response policies, and workflow integrations such as automated ticketing accumulate meaningful friction (s1, s7), but no network effect or regulatory residency lock appears in the record, so leaving is expensive in effort rather than in consequence. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | A self-displayed SOC 2 badge is the attestation evidence found by probe (s19), a table-stakes credential rather than a certification position that blocks replacement, and no regulation mandates this product class. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Kernel-level instrumentation, behavioral baselining at cloud scale, and real-time automated response are systems work that takes years of specialized expertise, and the io_uring research that exposed blind spots in Falco and Tetragon evidences that depth (s4, s17). |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 2/3 | The evidenced buyers are enterprises with governance, including a telco running a sovereign environment (s7, s8), but the record shows no regulated-procurement position, such as a government authorization, that would put procurement and legal between ARMO and replacement. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | ARMO Platform is a security platform with application features that observes and constrains customer workloads rather than serving as infrastructure other applications depend on (s1, s4). |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | The behavioral baselines are learned per customer, the Kubescape engine and its detection content are public under the Apache license (s6), and no named non-public dataset or cross-customer corpus appears in the record. |
ARMO targets the teams that run and secure cloud-native infrastructure. The vendor names DevOps, security, and platform teams as its audience and frames the product around Kubernetes clusters, containers, and cloud accounts (s1, s2). KuppingerCole places the company in cloud-native application security (s18), and the named customers span a Dutch energy marketplace (s7) and a telco's managed-service arm (s8).
A sovereign and on-premises niche gives the segmentation an unusual edge. Orange Business chose the platform because it runs on premises in a sovereign cloud environment (s8), a deployment constraint many cloud security vendors do not serve. That niche is narrower than the mainstream cloud-security market but harder for SaaS-only rivals to enter.
The platform's organizing idea is behavioral runtime evidence. A sensor built on eBPF, a Linux kernel instrumentation technology, learns each workload's normal behavior, and anomaly analysis drives detection and automatic response, including quarantine (s1, s4). The same runtime context filters vulnerability findings to those reachable in running code and feeds posture and compliance reporting (s1). Kubescape 4.0 moved the open-source runtime threat detection to general availability by March 2026 and added scanning for AI agents (s13).
The AI capabilities center on AI as a protected surface. Detection leans on behavioral baselining and does not rely solely on static rules (s4), and a dedicated solution discovers AI agents, inference servers, and frameworks in clusters, profiles their runtime behavior, and inventories their components (s5). The AI-workload offering is a platform solution rather than a separately sold product in the reviewed record.
The team's kernel research sharpens the capability story. ARMO researchers demonstrated a proof-of-concept rootkit using the io_uring Linux mechanism and showed that Falco and Tetragon, two widely used open-source detection tools, are blind to that class of operations (s17). Aggregating anomaly baselines across customers could be a future data advantage, tuning detection in ways a single tenant cannot match, but no such cross-customer asset is evidenced in the record.
Distribution starts with free software. Kubescape spread through the open-source channel, with Rapid7 describing adoption at over 100K organizations and the CNCF documenting named adopters including Intel and Bitnami (s9, s14). ARMO's own site claims more than 40K companies and 15M scans per month, vendor-published figures (s1). The paid motion converts that installed base with an in-product upgrade pitch and named case studies (s7, s8).
Channel motions now carry the strongest commercial signals. Orange Business offers ARMO Platform as the default security solution of its Managed Kubernetes Service, so Orange's customers inherit the product (s8). In January 2026 Rapid7 embedded ARMO's runtime protection in its Command Platform, a partnership corroborated by independent press (s16). Both motions put other companies' sales forces to work for ARMO, and both leave ARMO one step removed from the buyer relationship.
ARMO prices by infrastructure size and does not publish rates. The pricing page asks buyers to request a quote and says the model depends on cloud-environment factors such as the number of vCPUs and other cloud resources (s3). Charging by compute footprint matches the unit in which buyers experience the problem, since a bigger estate means more workloads to watch, and it scales revenue with customer growth.
Hidden pricing signals negotiated, larger deals. A free entry point exists, with the site prompting visitors to start free (s1), so the funnel runs from unpaid open source through a free tier into quoted enterprise contracts. The record discloses no price points, which keeps the premium the company charges over bundled platform alternatives unverifiable.
Delivery is software the customer operates, with unusual deployment reach. The customer deploys the sensor and consumes findings through the platform, and onboarding in the Vandebron account was, in the vendor's telling, fast with clear documentation (s7). The about page markets coverage of managed, on-premises, and air-gapped deployments (s2), and the Orange Business case documents a real on-premises, sovereign-cloud installation (s8).
Operating responsibility stays with the buyer. The vendor supplies detection logic, automation such as ticket generation, and compliance reporting, while the customer operates the platform and acts on its output. No managed detection or accountability layer appears in the reviewed record.
The public attestation record is a single self-displayed badge. The homepage shows a SOC 2 badge image, and a probe of trust.armosec.io and security.armosec.io (no DNS record), the /trust and /compliance paths (404), and the /security page, which renders an empty body, found the badge linking to a SOC 2 certification post but no inspectable trust portal as of 2026-07-03 (s19). For a vendor whose sensor runs inside customer kernels, the absence of an inspectable trust portal is a gap enterprise reviews will notice.
Deployment architecture carries part of the trust load. The sovereign on-premises installation at Orange Business keeps data in the customer's environment (s8), which answers residency requirements certification paperwork alone cannot. Buyers with data-sovereignty constraints may weigh that above a portal full of badges.
ARMO's ecosystem position runs through the CNCF. Kubescape entered the CNCF Sandbox in 2022 and became an incubating project in January 2025, announced that February (s13, s14), which puts ARMO's engine inside the same foundation that stewards Kubernetes and gives platform engineers a vendor-neutral reason to adopt it (s14). Integrations documented in the case studies include GitOps pipelines and alerting workflows (s8, s7).
The openness is symmetric, and that is the strategic tension. The repository is Apache licensed (s6), so competitors and cloud providers can embed the same engine without a commercial relationship, and Rapid7's January 2026 embedding shows the engine's value can be delivered through someone else's platform (s9). ARMO's counterweight is its maintainer role, which gives it influence over the roadmap and community and ownership of the commercial layer above the engine.
Two of the three co-founders run the company day to day. Shauli Rozen is CEO and Ben Hirschberg is CTO (s2), and Leonid Sandler, the third co-founder, is on the board (s2, s11). ARMO remains the creator and main maintainer of Kubescape (s9), and its researchers publish kernel-level work, including the io_uring study that exposed blind spots in Falco and Tetragon (s17).
The backing is venture capital. Tiger Global led the $30 million Series A in April 2022, joined by Hyperwise Ventures, Pitango First, and Peled Ventures (s10). The reviewed record documents no prior founder exit, so the team's credibility case is the externally judged open-source accomplishment rather than a track record of sold companies.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | ARMO: About Us | official | 2026-07-03 |
| f2 | Calcalist CTech: ARMO raises $30 million for open-source Kubernetes security platform | press | 2026-07-03 |
| f3 | SiliconANGLE: ARMO launches Behavioral Cloud Application Detection and Response to unify runtime security | press | 2026-07-03 |
| f4 | TechCrunch: ARMO raises $30M to build an end-to-end open source Kubernetes security platform | press | 2026-07-03 |
| f5 | ARMO homepage: platform capabilities | official | 2026-07-03 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | ARMO homepage: Runtime Behavioral Cloud Application Detection & Response (CADR) “+11K GitHub Stars +40K Companies +100K Deployments +15M Scans per Month” | official | 2026-07-03 |
| s2 | ARMO: About Us (leadership and Kubescape stewardship) “Leadership Shauli Rozen CEO & Co-founder Ben Hirschberg CTO & Co-founder” | official | 2026-07-03 |
| s3 | ARMO: Kubernetes Security Pricing & Cost Tiers “ARMO Platform pricing model depends on a few factors specific to your cloud environment, such as the number of vCPUs and other cloud resources.” | official | 2026-07-03 |
| s4 | ARMO: Behavioral Cloud Application Detection & Response (CADR) product page “ARMO CADR is a behavioral security solution designed to protect cloud applications.” | official | 2026-07-03 |
| s5 | ARMO: Cloud-Native Security for AI Workloads “Complete AI Discovery: Automatically detect AI agents, inference servers, and frameworks (LangChain, AutoGPT, etc.) across your clusters.” | official | 2026-07-03 |
| s6 | GitHub API: kubescape/kubescape repository metadata (Apache License 2.0, created August 2021) “"stargazers_count":11505” | official | 2026-07-03 |
| s7 | ARMO case study: Vandebron (Kubernetes security) “Vandebron chose ARMO Platform for its comprehensive approach to Cloud & Kubernetes security.” | official | 2026-07-03 |
| s8 | ARMO case study: Orange Business (on-prem, sovereign cloud) “In addition to internal use, Orange Business offers ARMO Platform as the default security solution for its Managed Kubernetes Service (MKS) customers , extending the same level of protection, visibility, and compliance to their clients.” | official | 2026-07-03 |
| s9 | Rapid7 press release (January 14, 2026): Rapid7 and ARMO Enable Organizations to Stop Cloud Attacks Earlier with Runtime Security “ARMO is the creator and main maintainer of Kubescape, one of the most widely adopted cloud-native open source security projects today adopted by over 100K organizations worldwide” | official | 2026-07-03 |
| s10 | TechCrunch (April 27, 2022): ARMO raises $30M to build an end-to-end open source Kubernetes security platform “it has raised a $30 million Series A funding round led by Tiger Global. New investor Hyperwise Ventures as well as existing investors Pitango First and Peled Ventures also participated in this round.” | press | 2026-07-03 |
| s11 | Calcalist CTech: ARMO raises $30 million for open-source Kubernetes security platform “ARMO was founded in 2019 by Shauli Rozen, Leonid Sandler and Ben Hirschberg.” | press | 2026-07-03 |
| s12 | SiliconANGLE (March 25, 2025): ARMO launches Behavioral Cloud Application Detection and Response to unify runtime security “ARMO is a venture capital-backed startup that has raised $34.5 million over two rounds, including a round of $30 million in April 2022.” | press | 2026-07-03 |
| s13 | InfoQ (March 29, 2026): Kubescape 4.0 Brings Runtime Security and AI Agent Scanning to Kubernetes “Kubescape was accepted as a CNCF Incubating project in January 2025, having entered the CNCF Sandbox in 2022.” | press | 2026-07-03 |
| s14 | Cloud Native Computing Foundation (CNCF) blog (February 26, 2025): Kubescape becomes a CNCF incubating project “Notable examples of Kubescape adoption include: Intel uses Kubescape for security prioritization AWS using it in security educational material Bitnami uses Kubescape to improve Helm chart security” | research | 2026-07-03 |
| s15 | Dark Reading (January 30, 2021): Cloud Security Startup Armo Emerges from Stealth with $4.5M “A new cloud security startup emerged from stealth this week with $4.5 million in funding and a mission to strengthen security for cloud-native workloads.” | press | 2026-07-03 |
| s16 | SC Media (January 20, 2026): Rapid7 partners with ARMO for cloud runtime security “Rapid7 has announced a strategic partnership with cloud security firm ARMO, integrating advanced runtime protection into its Rapid7 Command Platform to extend its exposure management capabilities with real-time threat detection” | press | 2026-07-03 |
| s17 | The Hacker News (April 24, 2025): Linux io_uring PoC Rootkit Bypasses System Call-Based Threat Detection Tools (ARMO research) “both Falco and Tetragon are blind to io_uring-based operations owing to the fact that they are heavily reliant on system call hooking.” | press | 2026-07-03 |
| s18 | KuppingerCole: Rising Star ARMO (Alexei Balaganski) “ARMO, based in Palo Alto, excels in cloud-native application security with Kubescape, an open-source platform for Kubernetes. Kubescape emphasizes behavioral analytics, runtime threat detection, and compliance visibility, addressing challenges like alert fatigue.” | research | 2026-07-03 |
| s19 | ARMO trust-surface probe: trust./security. subdomains (no DNS), /trust and /compliance 404, /security empty render, homepage SOC 2 badge, 2026-07-03 “https://www.armosec.io/wp-content/uploads/2024/05/SOC_2-1.svg” | official | 2026-07-03 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | ARMO homepage: Runtime Behavioral Cloud Application Detection & Response (CADR) “+11K GitHub Stars +40K Companies +100K Deployments +15M Scans per Month” | official | 2026-07-03 |
| s2 | ARMO: About Us (leadership and Kubescape stewardship) “Leadership Shauli Rozen CEO & Co-founder Ben Hirschberg CTO & Co-founder” | official | 2026-07-03 |
| s3 | ARMO: Kubernetes Security Pricing & Cost Tiers “ARMO Platform pricing model depends on a few factors specific to your cloud environment, such as the number of vCPUs and other cloud resources.” | official | 2026-07-03 |
| s4 | ARMO: Behavioral Cloud Application Detection & Response (CADR) product page “ARMO CADR is a behavioral security solution designed to protect cloud applications.” | official | 2026-07-03 |
| s5 | ARMO: Cloud-Native Security for AI Workloads “Complete AI Discovery: Automatically detect AI agents, inference servers, and frameworks (LangChain, AutoGPT, etc.) across your clusters.” | official | 2026-07-03 |
| s6 | GitHub API: kubescape/kubescape repository metadata (Apache License 2.0, created August 2021) “"stargazers_count":11505” | official | 2026-07-03 |
| s7 | ARMO case study: Vandebron (Kubernetes security) “Vandebron chose ARMO Platform for its comprehensive approach to Cloud & Kubernetes security.” | official | 2026-07-03 |
| s8 | ARMO case study: Orange Business (on-prem, sovereign cloud) “In addition to internal use, Orange Business offers ARMO Platform as the default security solution for its Managed Kubernetes Service (MKS) customers , extending the same level of protection, visibility, and compliance to their clients.” | official | 2026-07-03 |
| s9 | Rapid7 press release (January 14, 2026): Rapid7 and ARMO Enable Organizations to Stop Cloud Attacks Earlier with Runtime Security “ARMO is the creator and main maintainer of Kubescape, one of the most widely adopted cloud-native open source security projects today adopted by over 100K organizations worldwide” | official | 2026-07-03 |
| s10 | TechCrunch (April 27, 2022): ARMO raises $30M to build an end-to-end open source Kubernetes security platform “it has raised a $30 million Series A funding round led by Tiger Global. New investor Hyperwise Ventures as well as existing investors Pitango First and Peled Ventures also participated in this round.” | press | 2026-07-03 |
| s11 | Calcalist CTech: ARMO raises $30 million for open-source Kubernetes security platform “ARMO was founded in 2019 by Shauli Rozen, Leonid Sandler and Ben Hirschberg.” | press | 2026-07-03 |
| s12 | SiliconANGLE (March 25, 2025): ARMO launches Behavioral Cloud Application Detection and Response to unify runtime security “ARMO is a venture capital-backed startup that has raised $34.5 million over two rounds, including a round of $30 million in April 2022.” | press | 2026-07-03 |
| s13 | InfoQ (March 29, 2026): Kubescape 4.0 Brings Runtime Security and AI Agent Scanning to Kubernetes “Kubescape was accepted as a CNCF Incubating project in January 2025, having entered the CNCF Sandbox in 2022.” | press | 2026-07-03 |
| s14 | Cloud Native Computing Foundation (CNCF) blog (February 26, 2025): Kubescape becomes a CNCF incubating project “Notable examples of Kubescape adoption include: Intel uses Kubescape for security prioritization AWS using it in security educational material Bitnami uses Kubescape to improve Helm chart security” | research | 2026-07-03 |
| s15 | Dark Reading (January 30, 2021): Cloud Security Startup Armo Emerges from Stealth with $4.5M “A new cloud security startup emerged from stealth this week with $4.5 million in funding and a mission to strengthen security for cloud-native workloads.” | press | 2026-07-03 |
| s16 | SC Media (January 20, 2026): Rapid7 partners with ARMO for cloud runtime security “Rapid7 has announced a strategic partnership with cloud security firm ARMO, integrating advanced runtime protection into its Rapid7 Command Platform to extend its exposure management capabilities with real-time threat detection” | press | 2026-07-03 |
| s17 | The Hacker News (April 24, 2025): Linux io_uring PoC Rootkit Bypasses System Call-Based Threat Detection Tools (ARMO research) “both Falco and Tetragon are blind to io_uring-based operations owing to the fact that they are heavily reliant on system call hooking.” | press | 2026-07-03 |
| s18 | KuppingerCole: Rising Star ARMO (Alexei Balaganski) “ARMO, based in Palo Alto, excels in cloud-native application security with Kubescape, an open-source platform for Kubernetes. Kubescape emphasizes behavioral analytics, runtime threat detection, and compliance visibility, addressing challenges like alert fatigue.” | research | 2026-07-03 |
| s19 | ARMO trust-surface probe: trust./security. subdomains (no DNS), /trust and /compliance 404, /security empty render, homepage SOC 2 badge, 2026-07-03 “https://www.armosec.io/wp-content/uploads/2024/05/SOC_2-1.svg” | official | 2026-07-03 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.