Skip to content

53,600 AI-swarm attacks. Every one stopped in the kernel. 0 bytes leaked.See the evidence

Solution · Cloud Security

Agentless reach. Kernel-level runtime.

Connect AWS, Google Cloud and Azure with read-only access and see your clusters, instances and audit logs in one place. Where speed matters, the Solomon eBPF Client runs on your Kubernetes nodes and stops the attack inside the kernel.

Request a pilot Explore OmniMesh
Cloud connectionsagentless · read-only
  • AWSdiscovery
    Cross-account IAM role, read-only APIsEKS clusters, EC2 instances, CloudTrail
  • Google Clouddiscovery
    Read-only service accountGKE clusters, Compute Engine, Cloud Audit Logs
  • Azurediscovery
    Entra ID service principal, Reader roleAKS clusters, Compute, Activity Log
Runtime sensor on Kubernetes nodesSolomon eBPF Client · enforce

Illustration of the cloud connections view. The access levels are the ones the onboarding wizard asks for.

Capabilities

See the whole cloud. Stop what runs on it.

Agentless coverage for every account, a runtime sensor where workloads need prevention, and agentic investigation across both.

  • Agentless discovery and asset inventory

    • AWS through a cross-account IAM role and read-only APIs, Google Cloud through a read-only service account, Azure through a service principal with the Reader role
    • Kubernetes clusters and compute instances inventoried per account and region
    • Nothing to install for discovery: no sensors, DaemonSets or Helm charts

  • Cloud detection and response (CDR)

    • AWS CloudTrail read from your own S3 bucket, including KMS-encrypted trails
    • Google Cloud Audit Logs and the Azure Activity Log ingested alongside
    • Normalized to OCSF, then detected on and triaged by agents in Solomon SOC

  • Cloud workload protection platform (CWPP)

    • The Solomon eBPF Client on EKS and k3s nodes, as a systemd service or a Helm-installed DaemonSet
    • Policies scoped to pods by label, namespace or service account
    • Instance metadata service (IMDS) and EKS Pod Identity credential theft denied in the kernel

  • Cloud security posture management (CSPM)

    • Misconfiguration findings from Google Security Command Center and Wiz, normalized as OCSF security findings
    • Prioritized with vulnerability and runtime context, not as a flat list
    • Common fixes ready to apply, such as blocking public S3 access or closing open ingress rules

  • Automated cloud remediation

    • Through OmniMesh: revoke IAM sessions, quarantine an EC2 instance, isolate a Compute Engine VM, disable a service-account key
    • Every action carries a risk level, an approver count and a rollback
    • AI agents propose cloud changes; only a human can execute them

  • Containment on the node

    • Kill an attacker's whole process tree inside the kernel
    • Isolate a node from the network with in-kernel cgroup filters
    • AI- or analyst-ordered kills reach the host in 4–18 ms end to end

Agentless + runtime

Coverage without agents. Prevention with one.

Agentless discovery answers what you have and what changed. It reads cloud APIs and audit logs, so it covers every connected account without touching a workload.

It cannot stop a process that is reading your credentials right now. The Solomon eBPF Client can: it decides on the system call itself, on EKS and self-managed Kubernetes nodes, and leaves approved pods alone.

Two ways in, one platformagentless + runtime
What agentless discovery and the runtime sensor each cover
CapabilityAgentlesseBPF sensor
Asset inventory across accounts●yes–no
Cloud audit-log detection (CDR)●yes–no
Posture findings (CSPM)●yes–no
Blocks credential theft on the node–no●yes
Kills attacker process trees–no●yes
Stops container escapes–no●yes

Emulated AI-agent swarm evidence run, 1 Oct 2026

swarm attempts on a live AWS EKS cluster, all stopped1
9,600
attempts from Kubernetes pods, all stopped2
2,400
to deny cloud role credential theft (IMDS)3
55–200 µs
native connectors in OmniMesh4
35
  1. 1Emulated AI-agent swarm evidence run, 1 Oct 2026: Live AWS EKS cluster · Intel + Graviton · 3 runs.
  2. 2Emulated AI-agent swarm evidence run, 1 Oct 2026: Kubernetes pods on the EKS node image.
  3. 3Emulated AI-agent swarm evidence run, 1 Oct 2026: medians, MITRE ATT&CK T1552.005.
  4. 4Connectors in the portal's integrations catalog today; the number updates as the catalog grows.

Remediation

AI proposes the fix. A person approves it.

When an investigation finds a leaked key or an exposed instance, the agents queue the cloud action that fixes it, with its risk level, the number of approvers it needs and how to roll it back.

Nothing changes in your cloud until a human approves. Agent identities can propose actions but never approve or execute them, and every decision is written to the tenant’s audit log.

Proposed cloud actionsawaiting approval
  • quarantine_ec2_instancehigh
    i-0a12… · us-east-1
    Needs 1 approverRollback: restore security groups
  • isolate_gce_instancehigh
    web-7 · europe-west1
    Needs 2 approversRollback: restore network tags

Proposed by the triage agent. Agent identities never count as approvers.

Solomon platform

Which products

Let’s stop the swarm, together.

Run Solomon against your own workloads in a guided pilot. We’ll show you the kernel log, the investigation and the approval, on your infrastructure.

Request a pilot Talk to us