Everything Cilera adds to Cilium

Threat detection

Know when a workload starts behaving like an attacker.

• Lateral movement, scans, new exposure and data leaving the cluster
• Contact with known command-and-control, malware and mining hosts
• Every incident with its evidence and MITRE ATT&CK technique
• Plain-language AI explanations, when you ask

Containment

Cut off a compromised workload in one click.

• Isolated within 30 seconds, released just as easily
• What stays reachable is your call, like DNS and the node
• Your own policies are never touched

Blast radius

See how far an attacker could get, before they try.

• Everything a workload could reach under your policies, hop by hop
• Which paths are used, and which are open for no reason
• Which crown-jewel zones are in reach

AI traffic security

Catch the AI traffic hiding in your containers.

• Every AI service your containers reach, approved or not
• AI agents probing new internal services, flagged as threats
• Model servers exposed to the internet
• One-click containment. Never reads prompts

coming next Alerts on any AI provider you haven't sanctioned.

Fleet map

Every cluster, namespace and workload on one map.

• New, blocked and silent paths stand out at a glance
• Path tracing between any two workloads, with verdict and policy
• See why traffic is dropped, with Cilium's own drop reason

Change detection

Spot what changed, not just what is happening.

• Every path compared with yesterday
• New, silent, dropping and slower paths flagged
• Seven days of history to look back through

Policies

Understand your network policies without reading YAML.

• Cilium and Kubernetes policies in plain language
• The traffic each one governs
• Never applied for you: changes go through your own pull requests

Segmentation and compliance

Evidence your auditors can use, every 15 minutes.

• PCI DSS, SOC 2, NIST SP 800-53 and CIS Kubernetes
• Segmentation verified against real traffic
• Downloadable evidence reports

Cluster insight

How Cilium is set up in every cluster, at a glance.

• Datapath, encryption, Hubble and versions, side by side

What Cilera doesn't see

Cilera sees what Hubble sees, and no more.

• No packet payloads or request bodies
• No process or file activity inside containers: pair it with a runtime sensor
• Detection never blocks traffic on its own; containment is your call