Detection & Response

Unlock unparalleled security insights using ThreatMapper's deep analysis of vulnerabilities and configurations, alongside ThreatStryker's robust traffic filtering capabilities. Deepfence's lightweight sensors ensure seamless protection across Kubernetes nodes, Docker hosts, bare metal, VMs, and serverless instances!

How It Works

How Deepfence’s Detection & Response Works

Deepfence’s eBPF sensors gather and prioritize critical security telemetry from hosts, intervene to protect the application stack as needed, and present this to the Deepfence Console for analytics and reporting purposes.

Attack Surface Mastery

Master your attack surface with Deepfence's CNAPP. Our powerful solution observes and prioritizes your attack surface, allowing you to focus on the most critical vulnerabilities and potential entry points. By effectively managing and minimizing your attack surface, you'll drastically reduce the opportunities for threat actors to exploit your infrastructure.

Live Traffic Vigilance

Stay vigilant with Deepfence's CNAPP by observing live traffic, both encrypted and plain text, in real-time. Our advanced system detects and alerts you to any threat actor activity, ensuring you have the visibility necessary to maintain a secure environment. With Deepfence, you can swiftly identify and respond to potential threats before they escalate.

Real-Time Threat Neutralization

Stop threat actors in their tracks with Deepfence's CNAPP. Our real-time response capabilities empower you to rapidly neutralize threats, preventing them from causing damage or compromising your infrastructure. With Deepfence, you can rely on swift, decisive action to protect your environment from even the most sophisticated attacks.

Deepfence surpasses the limitations of agentless solutions, which lack in-depth visibility, and circumvents performance-impacting heavyweight agents. Our innovative method is the critical middle ground between security observability and runtime protection.

Key Benefits

Lightweight to minimize impact on production infrastructure

On-host sensors for deep visibility into dependencies and activity

Secure host-to-console communications ensure data remains private

Supported Platforms

Sensors support a wide range of deployment options


Sensors are deployed as a daemonset, a common pattern for log, metrics, monitoring, and security services that run alongside Kubernetes workloads in a non-intrusive manner.


Sensors are deployed as a Docker container on each Docker host.

Bare metal and VM-based platforms

Sensors are deployed as a Docker container on each operating system instance, using a Docker runtime. Both Windows and Linux instances are supported.


Deepfence supports AWS Fargate, where sensors are deployed as a daemon service alongside each serverless instance.