Skip to content

Security superpowers with eBPF and Tetragon - BRKSEC-2167#

Cisco Live US 2025 (San Diego) digest Program Core pick San Diego · 8–12 June 2025

Abstract

Liz Rice (Cisco)

  • Why: Liz Rice is one of the leading voices in eBPF/Cilium, and Tetragon is the open-source enforcement engine underneath Cisco's Hypershield — this session reveals where a major vendor's security stack is actually being built, from a contributor rather than a marketer.
  • What: A deep dive into Tetragon: YAML tracing policies mapped to eBPF programs attached to a variety of event types, multi-program "following" of a series of events to pinpoint likely-malicious behavior, and in-kernel event aggregation/filtering to minimize observability overhead (from abstract only).
  • How: eBPF programs attached at kernel event points; policy-based correlation across event sequences; in-kernel aggregation and filtering to keep overhead low.
  • Where applicable: Linux hosts and Kubernetes broadly — Tetragon is open source and vendor-neutral in applicability, while also being the substrate for Cisco's commercial Hypershield.