The Open-Source Trojan Horse: How ARMO Turned 11,000 GitHub Stars Into a Cloud-Security Business
ARMO gave away a Kubernetes scanner, watched 40,000 companies download it, then built a runtime-security business on top. This is the story of the open-source Trojan horse - and the eBPF sensor that made it work.
The oldest trick in enterprise software is also the hardest to pull off: give the good stuff away, and trust that the money follows. Most companies flinch. They cripple the free tier, hide the useful feature behind a sales call, and wonder why nobody loves them. ARMO, a security company out of Tel Aviv, did the opposite. It built a genuinely excellent Kubernetes scanner called Kubescape, released it as open source, and let it spread to more than 40,000 companies and 100,000-plus deployments. Only then did it start selling.
That is the whole strategy, and it is worth understanding because it works. Kubescape is not a demo or a teaser. It is a real tool that DevOps engineers install because it solves a real problem - scanning Kubernetes clusters, YAML files, and Helm charts for misconfigurations, vulnerabilities, and risky permissions, and then explaining, in plain terms, why a given control failed. It earned more than 11,000 stars on GitHub and became the first security scanner ever accepted into the Cloud Native Computing Foundation. Every one of those installs is a warm introduction to the paid platform sitting on top.
01 / The ProblemSecurity's real vulnerability is noise
Ask anyone who runs a security team what keeps them up at night and the honest answer is rarely a single dramatic breach. It is the flood. A modern cloud scanner can surface ten thousand vulnerabilities in an afternoon, and almost none of them matter, because almost none of them are reachable by an attacker. The team burns out triaging a list that is mostly theoretical. The one issue that is genuinely exploitable sits three thousand rows down, unread.
ARMO's argument is that the fix is not a prettier dashboard or a bigger scan. It is context. Specifically, runtime context - knowing what your code actually does when it runs, not just what it could theoretically do on paper. A vulnerability in a library that never loads is noise. A vulnerability in a function that executes on every request, with a path to the cloud API where your customer data lives, is an emergency. Signature-based tools cannot always tell the two apart. ARMO's bet is that behavior can.
Illustrative. ARMO's pitch is prioritization: use what code does at runtime to shrink a wall of alerts down to the handful an attacker can actually reach.
02 / The TechnologyAn eBPF sensor that learns your code's habits
The engine underneath all of this is eBPF - a Linux kernel technology that lets software observe what a system is doing, in detail, without slowing it down. Observability companies used eBPF to make metrics and tracing fast. ARMO uses it for security. Its sensor sits directly in the execution path of your workloads and records a baseline of how each application normally behaves: which files it touches, which network calls it makes, which system calls are routine.
ARMO calls that baseline the Application Profile DNA. Once the system knows what normal looks like, anything that deviates - a process spawning a shell it never spawns, a container reaching for a cloud credential it never uses - stands out. That is how ARMO claims to catch both everyday threats and zero-days it has never seen a signature for. It is not matching against a list of known-bad behavior. It is noticing when something departs from known-good.
03 / The ProductFrom the exploited line of code to the cloud API
In March 2025, ARMO put a name on the whole thing: CADR, or Cloud Application Detection & Response. The company positions it as a runtime-native category - a cousin to the CDR and CNAPP acronyms already crowding the market, but built from the workload up rather than the cloud down. The promise is a single thread of evidence that runs from the exploited line of application code, through the container and the Kubernetes layer, all the way to the cloud API where the data sits.
ARMO CADR traces a threat across every layer instead of leaving four tools to argue about which alert was real.
That matters because most security stacks are fragmented. One tool watches the code, another the container, another the cloud account - and none of them share a story. When something goes wrong, an engineer spends the night stitching timestamps together across three consoles. ARMO's argument is that if a single sensor watched the whole path, the story would already be written by the time the pager went off. And because the response can be policy-driven and automatic, an attack can be halted even when the root cause has not yet been patched.
04 / The ModelWhy giving it away is the growth engine
The founders came out of DevOps, not classic infosec, and it shows in the design choices. Their whole thesis is that security should be explainable and traceable to the developer who has to fix it - not a black box that files tickets. That instinct is also good business. A tool that developers understand is a tool developers adopt, and adoption is distribution.
Here is the loop. Kubescape is free and open source, so it spreads without a sales team. Its usefulness builds trust. Its membership in the CNCF - progressing from Sandbox in 2022 to Incubation in 2025 - signals maturity to the risk-averse buyers at banks, telecoms, and government agencies. When those organizations decide they need runtime detection, response, and multi-cloud management with a support contract behind it, ARMO Platform and CADR are already familiar. One enterprise customer reported cutting security issues by more than 90% and saving around $200,000 a year. The tool that hooked them cost nothing.
05 / The MarketA narrow wedge in a loud category
Cloud security is not a quiet neighborhood. Wiz, Aqua Security, Sysdig, Palo Alto Networks, and a wave of newer entrants all promise to protect cloud-native workloads, and many of them are large and well-funded. ARMO is not trying to out-feature them across every dimension. Its wedge is narrow and sharp: runtime behavior, delivered from an open-source base. When a category is crowded and loud, the durable move is to own one true thing completely, and ARMO's one true thing is knowing what your code actually does when it runs.
Whether CADR becomes a category the rest of the industry adopts, or stays ARMO's own framing, is still an open question. What is not in question is the adoption underneath it. Kubescape is installed in tens of thousands of environments, the CNCF badge keeps getting more prestigious, and the runtime data flowing back is exactly the raw material a behavioral security product needs. For a company that started by giving its best work away, that is a defensible place to stand. The conditions where this stalls are familiar ones - if the open-source funnel stops converting to paid, or if a larger rival bundles runtime detection into a suite buyers already own, the wedge gets harder to defend. For now, the horse is inside the gate.