Runtime security is moving from shipping data to a back end to defending at the edge. Abhinav Mishra explains the self-defending container and how Qualys validates exploits and applies mitigations right in the runtime. Join us at ROCon Americas, October 13-15 in Austin, Texas: https://www.qualys.com/rocon/2026/americas Try Qualys ETM free for 30 days: https://www.qualys.com/free-trial-new/enterprise-trurisk-management Recorded at Black Hat USA 2026, this session introduces the Qualys Smart Sensor for Kubernetes and OpenShift environments. It builds automated baselines of process, network, and file events, plus AI events such as connections to MCP servers, then maps anomalies to threat intelligence, validates exploits with safe payloads, and applies eBPF-based mitigations such as blocking a process or a connection to a rogue MCP server in seconds. One large customer running 4 million containers and 70 million vulnerabilities a day cut time to fix key zero days to under two hours. The demo traces a LangChain vulnerability through an anomalous Python process, confirms it with Agent Val, and lets Agent Nexa generate a mitigation when no patch exists. New automatic mitigation policies cover 2025 and 2026 CVEs. Speaker: Abhinav Mishra, Director of Product Management, Qualys Chapters: 0:00 Intro: AI exploits push defense into runtime 0:52 Why runtime intelligence must move to the edge 2:02 From runtime intelligence to intelligent runtime 2:25 Smart Sensor: baseline, validate, mitigate 4:01 Drift detection and AI-powered baselines 4:47 Example: a LangChain anomaly 5:08 Customer scale: 4 million containers 6:02 The full remediation suite 6:45 Demo: cluster discovery and Smart Sensor baselines 8:21 Demo: Agent Nexa prioritizes with runtime context 10:14 Demo: attack path and compensating controls 10:56 Demo: no-patch mitigation and automatic policies #BlackHat2026 #ContainerSecurity #Kubernetes

 74      0