Rising Star ARMO

Short Summary

ARMO is a cloud-native application security vendor founded in 2019 and headquartered in Palo Alto, operating with Series A funding and a licensing model based on the number of worker nodes and cloud resources. The company is best known for creating and maintaining Kubescape, a widely adopted open-source Kubernetes security platform, and for translating that open-source momentum into an enterprise offering, the ARMO Platform. The portfolio targets security needs across modern environments built on Kubernetes, microservices, and containers, where traditional perimeter-based and static models are increasingly insufficient due to dynamic and ephemeral infrastructure.

Kubescape provides Kubernetes-native security capabilities including risk analysis, compliance and misconfiguration scanning, and advanced threat detection. The ARMO Platform extends this foundation with lifecycle coverage from code through runtime, adding Infrastructure-as-Code scanning, runtime threat detection and response, CSPM and KSPM, and integrations into CI/CD pipelines and Kubernetes control planes to support continuous “shift-left” security alongside runtime protection. Its eBPF-powered sensor delivers deep kernel-level telemetry for real-time observability with minimal performance overhead.

ARMO differentiates through behavior-based detection and response, positioning its Cloud Application Detection and Response (CADR) as a runtime-first approach that prioritizes cloud-native threat detection over broad cloud service coverage. It builds a behavioral baseline—Application Profile DNA—using telemetry across infrastructure, clusters, containers, and applications, then applies reachability and threat intelligence to produce contextual prioritization and reduce vulnerability overload by up to 90%. Strengths include explainable “Threat Stories,” strong Kubernetes integration without dependency on cloud-specific APIs, and open-source leadership via Kubescape. Challenges include competing against broader-suite vendors, educating customers on CADR’s value, and overcoming perceived risk of adopting a younger vendor for mission-critical workloads.

Interesting Facts

• ARMO was founded in 2019 and is headquartered in Palo Alto, California, USA.
• The company is funded through a Series A stage.
• The market segment is Cloud-Native Application Security.
• Licensing is based on the number of worker nodes and cloud resources.
• The geographic focus is North America and Europe, with expansion to other markets.
• ARMO is the creator and primary maintainer of Kubescape, an open-source Kubernetes security platform.
• ARMO introduced a Cloud Application Detection and Response (CADR) solution focused on behavioral runtime protection for cloud-native workloads.
• The ARMO Platform includes capabilities such as IaC scanning, runtime threat detection and response, CSPM, and KSPM.
• The platform’s sensor is powered by eBPF technology to provide real-time insights with minimal performance overhead.
• The platform’s contextual prioritization is described as reducing vulnerability overload by up to 90%.

Notable Quotes

• “Traditional perimeter-based and static analysis security models are no longer sufficient in these environments.”
• “Unlike traditional Cloud-Native Application Protection Platforms (CNAPP) that prioritize breadth across cloud services, ARMO focuses on cloud-native threat detection.”
• “The platform constructs a behavioral baseline, called Application Profile DNA (APDTM).”
• “This behavioral model, combined with runtime reachability and threat intelligence, allows for precise contextual risk prioritization.”
• “The result is a system capable of preemptive defense, explainable incident trails, and highly automated response workflows.”
• “Its runtime-first design addresses a persistent industry pain: existing CNAPPs often focus too heavily on proprietary cloud services.”
• “Visual, explainable, and traceable Threat Stories simplify forensics and response.”
• “Moreover, the use of eBPF for high-fidelity runtime observability without performance trade-offs sets a technical standard that others may soon follow.”
• “We expect the market to continue its shift toward context-aware, developer-integrated, and behavior-driven solutions.”
• “Open-source-driven vendors like ARMO are well-positioned to not only gain market share, but to define what next-generation security looks like for cloud-native applications.”