eBPF runtime detection for Linux workloads that prioritizes vulnerabilities using production execution evidence

Primod operates under the Turkish entity Prime Modality Teknoloji A.S. and dates to 2025. It positions itself in the cloud application detection and response category and compares its approach directly with Falco and Tetragon, the two open-source eBPF projects most teams reach for first. The argument it makes is about evidence: agentless scanners can enumerate every package in an image, but they cannot say which of those code paths a running workload ever touches, so remediation queues fill with findings that carry no production exposure. Primod treats the runtime as the authoritative source for both detection and prioritization.

The sensor is eBPF-based and runs on Linux hosts, containers, and Kubernetes nodes, capturing process chains, workload identity, and, for supported runtimes, the request context that led to a given execution. Detections arrive with that context attached, so an investigation timeline can connect a suspicious process back to the specific inbound request, the service that handled it, and the deployment it belongs to, rather than presenting an isolated alert on a node name. The same execution data feeds vulnerability prioritization: a vulnerable function observed running in production outranks one that ships in the image but is never loaded. The audience is security and platform engineering teams operating their own production clusters.