Odigos
Get a demo
Security on the production context platform

Nation-state firepower is now an AI subscription.

One attacker with a frontier model now does what took a team. Odigos sees into the runtime like never before and blocks AI-powered attacks at the function level, with nothing in your code.

Talk to our security team

Understand the attack.

Connect the incoming request to the application actions it triggered and the data it reached. Your security team and AI investigators get the evidence to establish what happened and choose a response.

Example: a request reaches a database secretPOST /api/tickets

How the request reached the secret

  1. A customer submits a support ticket.TicketController.create
  2. The application renders the supplied text.TemplateRenderer.render
  3. The template reads a database secret.EnvironmentLookup.readObserved access to sensitive information
What the captured evidence shows

A database credential was read.

Requested secret
"DATABASE_URL"
Returned credential · redacted for this example
"postgres://[masked]/appdb"

That credential could give access to database data. Check whether it was used beyond this request and whether database data was exposed.

Illustrative investigation. Application functions, request details and values are examples.

Assess the blast radius.

Odigos maps all communications with the affected service. See which connected systems and data may also be at risk, and use those connections to decide where to investigate next.

Connections to the affected serviceIllustrative service map

Incoming requests

api-gateway

Forwards customer requests to tickets-api.

Affected service

tickets-api

A database credential was accessed in this service.

Database communication

appdb

Check whether the credential was used to access data.

Service requests

identity-api

Inspect requests from the affected service.

Messaging

notification-worker

Review messages sent along this path.
The secret access is confirmed in this example. Exposure of connected systems is still unconfirmed. These connections identify where to investigate; they do not by themselves prove data theft or compromise.

Contain the threat.

Function-level virtual patching blocks the application operation the attack depends on. Your team approves a rule that stops matching calls, so you can apply the mitigation before a code release.

Review which legitimate requests also use that operation. A targeted rule can leave other service traffic running while your team prepares the permanent fix.

Deploy or revert the virtual patch as needed. Remove it when the permanent fix is deployed.

Example virtual patch: block template access to environment variables

Block
Environment-variable lookups from the template-rendering code
Function
EnvironmentLookup.read
Called by
TemplateRenderer.render
The rule blocks these lookups, including the observed database-secret read. Other service traffic can continue.

Stop a thread or process when a wider response is needed.

These options can interrupt legitimate application work. Choose based on the spread of the attack and the service disruption your team can accept.

Stop the thread
Stops the thread executing the attack and interrupts the work running on that thread.
Stop the process
Stops the affected process, including its other threads and requests. This interrupts more application work than stopping one thread.

Deep visibility. Outside the application.

See how DeepBPF inspects running applications from the outside, with kernel-enforced constraints and capture controls for your team.

Explore the technology
Production context for security

Understand the attack. Contain the threat.

Talk to our security teamExplore the technology

See the evidence, assess the blast radius and explore the right response for your team.